HackTheBox - Puppy

Name: HackTheBox - Puppy
Uploaded: 2025-09-27T15:00:54Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:27 - NFS is listening on Windows which is odd, looking into it briefly and not finding anything 05:00 - Us...

IppSec · Beginner ·🔐 Cybersecurity ·6mo ago

00:00 - Introduction 01:00 - Start of nmap 03:27 - NFS is listening on Windows which is odd, looking into it briefly and not finding anything 05:00 - Using NXC to list shares and running RustHound 08:55 - Adding ourself to developers, which will let us access the develoeprs share 11:45 - Cracking a newer Keepass database (hash alg 4000). Currently not supported in Hashcat, need to use a new version of John 15:00 - Copying credentials out of keepass and doing a password spray to gain access to Ant.Edwards 18:10 - Looking at what Ant can do with Bloodhound, discovering we have GenericAll to Adam…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

1:00 Start of nmap

3:27 NFS is listening on Windows which is odd, looking into it briefly and not find

5:00 Using NXC to list shares and running RustHound

8:55 Adding ourself to developers, which will let us access the develoeprs share

11:45 Cracking a newer Keepass database (hash alg 4000). Currently not supported in

15:00 Copying credentials out of keepass and doing a password spray to gain access t

18:10 Looking at what Ant can do with Bloodhound, discovering we have GenericAll to

20:55 Still can't login to Adam since he is disabled, using BloodyAD to re-enable th

23:00 Finding a backup. Looking into it to discover another set of credentials

27:30 Running WinPEAS, finding DPAPI Data

34:30 Downloading the DPAPI Master Key and Credential Blobs, to download with EvilWI

36:50 Using Impacket to decrypt the DPAPI Data and logging in with Steph's ADM accou

42:45 Beyond Root: Setting someones hash via a NTLM Hash for opsec reasons after cha

53:30 Giving up with impacket, switching to mimikatz to set the password via hash

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →