HackTheBox - Infiltrator

Name: HackTheBox - Infiltrator
Uploaded: 2025-06-14T15:05:17Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 04:10 - Using grep against a HTML Page to extract usernames, then username anarchy to build a userlist and ke...

IppSec · Beginner ·🔐 Cybersecurity ·9mo ago

00:00 - Introduction 01:00 - Start of nmap 04:10 - Using grep against a HTML Page to extract usernames, then username anarchy to build a userlist and kerbrute to find valid users 07:50 - Kerbrute automatically will ASREP Roast but outputs in the stronger hash that hashcat doesn't crack. Using downgrade to get the weaker hash 11:10 - Using NXC with our creds to dump a list of users and see a password in the description 13:34 - Using Rusthound stead of the python version of Bloodhound because it gets certificate information too 17:30 - Showing a couple paths in Bloodhound 22:00 - Explaining and …

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:00 Start of nmap

4:10 Using grep against a HTML Page to extract usernames, then username anarchy to

7:50 Kerbrute automatically will ASREP Roast but outputs in the stronger hash that

11:10 Using NXC with our creds to dump a list of users and see a password in the des

13:34 Using Rusthound stead of the python version of Bloodhound because it gets cert

17:30 Showing a couple paths in Bloodhound

22:00 Explaining and performing the attack (dacledit, shadow credential, force passw

32:50 Discovering Output Messenger running, using chisel to forward ports

38:15 Having trouble with the Linux client of Output Messenger, cannot download a fi

44:30 Switching to Windows, using a regular portforward on chisel so our windows box

52:30 Using ilSpy n the dotnet binary and decrypting a static string which is anothe

1:00:00 Discovering the API Key in the notes, and exploring the API to dump chatroom m

1:12:30 Setting an event on Olivia's Output Messenger Calendar to send a shell

1:22:48 Discovering a PCAP in Olivias downloaded files, using wireshark to extract obj

1:32:40 Accessing the box over RDP, decrypting the bitlocker drive, and then downloadi

1:40:40 Using NTDISSECTOR to parse the NTDS.DIT which extracts a lot more data than se

1:45:45 Doing AD ESC4 and then AD ESC 1 to get root

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →