HackTheBox - Puppy

00:00 - Introduction 01:00 - Start of nmap 03:27 - NFS is listening on Windows which is odd, looking into it briefly and not finding anything 05:00 - Using NXC to list shares and running RustHound 08:55 - Adding ourself to developers, which will let us access the develoeprs share 11:45 - Cracking a newer Keepass database (hash alg 4000). Currently not supported in Hashcat, need to use a new version of John 15:00 - Copying credentials out of keepass and doing a password spray to gain access to Ant.Edwards 18:10 - Looking at what Ant can do with Bloodhound, discovering we have GenericAll to Adam.Silver, using BloodyAD to change his password 20:55 - Still can't login to Adam since he is disabled, using BloodyAD to re-enable the account and accessing the box via WinRM 23:00 - Finding a backup. Looking into it to discover another set of credentials 27:30 - Running WinPEAS, finding DPAPI Data 34:30 - Downloading the DPAPI Master Key and Credential Blobs, to download with EvilWINRM need to remove the hidden attribute 36:50 - Using Impacket to decrypt the DPAPI Data and logging in with Steph's ADM account for DA 42:45 - Beyond Root: Setting someones hash via a NTLM Hash for opsec reasons after changing a password, having trouble with Impacket 53:30 - Giving up with impacket, switching to mimikatz to set the password via hash