HackTheBox - Napper

Name: HackTheBox - Napper
Uploaded: 2024-05-04T15:00:09Z
Channel: IppSec
Description: 00:00 - Introduction 00:55 - Start of nmap, showing -vv will cause the output to contain TTL 04:40 - Checking out the website 05:23 - Doing a VHOST Brut...

IppSec · Beginner ·🔐 Cybersecurity ·1y ago

00:00 - Introduction 00:55 - Start of nmap, showing -vv will cause the output to contain TTL 04:40 - Checking out the website 05:23 - Doing a VHOST Bruteforce to discover the internal domain and discovering credentials on a blog post 07:30 - Checking out the NAPListener blog post, which gives us a way to enumerate for the NAPLISTENER Implant 10:30 - Showing the Backdoor code to discover how it works 12:30 - Building a DotNet Reverse Shell and renaming the method to Run, then using Mono (mcs) to compile 14:45 - Converting the DLL to base64 and getting NAPLISTENER to execute it 19:20 - Discoveri…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

Introduction

0:55 Start of nmap, showing -vv will cause the output to contain TTL

4:40 Checking out the website

5:23 Doing a VHOST Bruteforce to discover the internal domain and discovering crede

7:30 Checking out the NAPListener blog post, which gives us a way to enumerate for

10:30 Showing the Backdoor code to discover how it works

12:30 Building a DotNet Reverse Shell and renaming the method to Run, then using Mon

14:45 Converting the DLL to base64 and getting NAPLISTENER to execute it

19:20 Discovering a draft blog post talking about them getting rid of laps and build

24:00 Setting up a tunnel with Chisel so we can talk to Elastic

25:55 Using curl to enumerate Elastic

30:20 Reversing the Golang binary with Ghidra

42:30 Creating a Golang Binary to grab a document (seed), then using search to grab

47:30 Connecting to Elastic, using a Proxy

56:00 Grabbing the Seed with the Golang Elastic Library

1:03:00 Grabbing the Blob with Golang Elastic Library

1:09:45 Using the Seed to generate our 16 byte key

1:13:53 Creating a decrypt function

1:16:30 Getting the PlainText then using RunasCS to get a reverse shell as the Backup

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →