HackTheBox - Heist

01:05 - Begin of recon 04:25 - Logging into the webpage as guest and viewing attachments 04:45 - Examining the cisco type 7 passwords, using ciscot7 07:00 - Decrypting the MD5Crypt password using Hashcat 10:20 - Using CrackMapExec to perform a SMB password spray with users/credentials we have 11:30 - Using Metasploit to do the same thing (smb_login), to show it keeps tracks of creds. Then doing a WinRM Login 14:10 - WinRM Login was unsuccessful. Lets see if we can enumerate users with Impacket's lookupsid 15:15 - Using RPCClient to replicate how LookupSID did the RID/SID Bruteforce, so we can understand it 19:25 - Doing the Winrm_Login again with new usernames and see Chase can login 20:25 - Using Evil WinRM to login to the box 22:00 - Low Priv shell returned 24:00 - Examining wwwroot, and sourcecode to see if we can get a shell as the IIS User (cannot) 26:45 - See firefox running with Get-Process 29:00 - Upload procdump64.exe to dump firefox's memory 31:00 - Running strings against the binary and finding the administrator password 34:35 - Testing logins with WinRM and CME, to see Administrator could PSEXEC or WinRM