HackTheBox - DropZone

01:00 - Start of Recon 02:15 - TFTP Enumeration - Identifying configuration and OS information 06:32 - Finding a path to code execution 07:17 - Examining PSExec Metasploit Module 08:55 - Using irb within metasploit to print a powershell payload 12:30 - Examining PsExec() 15:40 - Examining native_upload 18:10 - Examining mof_upload 20:34 - Using irb within metasploit to print the MOF File 22:35 - Quick explanation of MOF Files 25:05 - Modifying the MOF to run NetCat 27:30 - Uploading nc to the target 28:50 - Uploading the malicious MOF File and getting a shell! 29:50 - Using Streams to view Hidden text within ADS ==== Box Done, Lets play with MSF 33:08 - Start of Bonus Content, finging a TFTP Exploit that uses MOF 35:05 - Attempting to use distrinct_ftp_traversal against DropZone 36:30 - Installing pry.byebug in order to allow us to drop to a debug console and step through metasploit modules 40:50 - Testing out pry.byebug 42:30 - Finding why the exploit module didn't work 44:50 - Module still doesn't work, TFTP Stopping mid transfer 49:30 - Whoops, changed the delay on the wrong timeout 51:00 - Meterpreter Shell returned, showing off the extended API and some WMI Commands.