HackTheBox - Fulcrum

Name: HackTheBox - Fulcrum
Uploaded: 2018-06-09T15:00:01Z
Channel: IppSec
Description: 02:08 - Begin of Recon 14:00 - XXE Detection on Fulcrum API 17:40 - XXE Get Files 23:40 - XXE File Retrieval Working 24:30 - Lets Code a Python WebServe...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·7y ago

02:08 - Begin of Recon 14:00 - XXE Detection on Fulcrum API 17:40 - XXE Get Files 23:40 - XXE File Retrieval Working 24:30 - Lets Code a Python WebServer to Aid in XXE Exploitation 39:45 - Combining XXE + SSRF (Server Side Request Forgery) to gain Code Execution 47:28 - Shell Returned + Go Over LinEnum 56:49 - Finding WebUser's Password and using WinRM to pivot 01:06:00 - Getting Shell via WinRM, finding LDAP Credentials 01:14:00 - Using PowerView to Enumerate AD Users 01:27:06 - Start of getting a Shell on FILE (TroubleShooting FW) 01:35:35 - Getting shell over TCP/53 on FILE 01:37:58 - Findi…

Watch on YouTube ↗ (saves to browser)

Chapters (17)

2:08 Begin of Recon

14:00 XXE Detection on Fulcrum API

17:40 XXE Get Files

23:40 XXE File Retrieval Working

24:30 Lets Code a Python WebServer to Aid in XXE Exploitation

39:45 Combining XXE + SSRF (Server Side Request Forgery) to gain Code Execution

47:28 Shell Returned + Go Over LinEnum

56:49 Finding WebUser's Password and using WinRM to pivot

1:06:00 Getting Shell via WinRM, finding LDAP Credentials

1:14:00 Using PowerView to Enumerate AD Users

1:27:06 Start of getting a Shell on FILE (TroubleShooting FW)

1:35:35 Getting shell over TCP/53 on FILE

1:37:58 Finding credentials on scripts in Active Directories NetLogon Share, then find

1:58:10 Troubleshooting the error correctly and getting Domain Admin!

2:03:54 Begin of unintended method (Rooting the initial Linux Hop)

2:09:54 Root Exploit Found

2:12:25 Mounting the VMDK Files and accessing AD.

Playlist

Uploads from IppSec · IppSec · 57 of 60

← Previous Next →