HackTheBox - Heist

Name: HackTheBox - Heist
Uploaded: 2019-11-30T15:00:09Z
Channel: IppSec
Description: 01:05 - Begin of recon 04:25 - Logging into the webpage as guest and viewing attachments 04:45 - Examining the cisco type 7 passwords, using ciscot7 0...

IppSec · Intermediate ·🔐 Cybersecurity ·6y ago

01:05 - Begin of recon 04:25 - Logging into the webpage as guest and viewing attachments 04:45 - Examining the cisco type 7 passwords, using ciscot7 07:00 - Decrypting the MD5Crypt password using Hashcat 10:20 - Using CrackMapExec to perform a SMB password spray with users/credentials we have 11:30 - Using Metasploit to do the same thing (smb_login), to show it keeps tracks of creds. Then doing a WinRM Login 14:10 - WinRM Login was unsuccessful. Lets see if we can enumerate users with Impacket's lookupsid 15:15 - Using RPCClient to replicate how LookupSID did the RID/SID Bruteforce, so we c…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

1:05 Begin of recon

4:25 Logging into the webpage as guest and viewing attachments

4:45 Examining the cisco type 7 passwords, using ciscot7

7:00 Decrypting the MD5Crypt password using Hashcat

10:20 Using CrackMapExec to perform a SMB password spray with users/credentials we h

11:30 Using Metasploit to do the same thing (smb_login), to show it keeps tracks of

14:10 WinRM Login was unsuccessful. Lets see if we can enumerate users with Impacke

15:15 Using RPCClient to replicate how LookupSID did the RID/SID Bruteforce, so we c

19:25 Doing the Winrm_Login again with new usernames and see Chase can login

20:25 Using Evil WinRM to login to the box

22:00 Low Priv shell returned

24:00 Examining wwwroot, and sourcecode to see if we can get a shell as the IIS User

26:45 See firefox running with Get-Process

29:00 Upload procdump64.exe to dump firefox's memory

31:00 Running strings against the binary and finding the administrator password

34:35 Testing logins with WinRM and CME, to see Administrator could PSEXEC or WinRM

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →