HackTheBox - Ghost

Name: HackTheBox - Ghost
Uploaded: 2025-04-05T15:00:05Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 05:20 - Taking a look at all the websites 06:45 - Showing why you should be careful when enumerating VHOSTS, also us...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·11mo ago

00:00 - Intro 01:00 - Start of nmap 05:20 - Taking a look at all the websites 06:45 - Showing why you should be careful when enumerating VHOSTS, also using gobuster in DNS mode since there are multiple web services and a DNS Server 12:45 - Discovering LDAP Injection in intranet page 15:40 - Showing how our LDAP Injection is boolean injection which lets us enumerate data in LDAP 21:30 - Creating a python program to perform the boolean injection 33:15 - Got the password for gitea_temp_principal 35:00 - Looking at the Intranet Backend code that was in Gitea which is written in Rust using the Rock…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Intro

1:00 Start of nmap

5:20 Taking a look at all the websites

6:45 Showing why you should be careful when enumerating VHOSTS, also using gobuster

12:45 Discovering LDAP Injection in intranet page

15:40 Showing how our LDAP Injection is boolean injection which lets us enumerate da

21:30 Creating a python program to perform the boolean injection

33:15 Got the password for gitea_temp_principal

35:00 Looking at the Intranet Backend code that was in Gitea which is written in Rus

41:00 Looking at the Blog project in Gitea, that shows there is a modification to th

45:30 Exploiting the File Disclosure in the blog, downloading the SQL Lite Database,

50:00 Shell returned on intranet container, discovering a SSH Control Master socket,

56:00 On the workstation, Florence.Ramirez has a KRB Ticket, downloading it and then

58:30 Running bloodhound, which is giving us trouble because of some weird connectio

1:09:20 Editing our bloodhound to hardcode the IP Address, which is a really hacky thi

1:17:20 Using dnstool to create a DNS Record on the domain controller, then responder

1:21:00 Got Justin.Bradley's password, who can grab dump the GMSA Password, getting th

1:27:15 Dumping the ADFS Data (ADFSDump), then using ADFSpoof to perform the Golden SA

1:42:00 Logged into core as adminis

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →