HackTheBox - Puppy
00:00 - Introduction
01:00 - Start of nmap
03:27 - NFS is listening on Windows which is odd, looking into it briefly and not finding anything
05:00 - Using NXC to list shares and running RustHound
08:55 - Adding ourself to developers, which will let us access the develoeprs share
11:45 - Cracking a newer Keepass database (hash alg 4000). Currently not supported in Hashcat, need to use a new version of John
15:00 - Copying credentials out of keepass and doing a password spray to gain access to Ant.Edwards
18:10 - Looking at what Ant can do with Bloodhound, discovering we have GenericAll to Adam.Silver, using BloodyAD to change his password
20:55 - Still can't login to Adam since he is disabled, using BloodyAD to re-enable the account and accessing the box via WinRM
23:00 - Finding a backup. Looking into it to discover another set of credentials
27:30 - Running WinPEAS, finding DPAPI Data
34:30 - Downloading the DPAPI Master Key and Credential Blobs, to download with EvilWINRM need to remove the hidden attribute
36:50 - Using Impacket to decrypt the DPAPI Data and logging in with Steph's ADM account for DA
42:45 - Beyond Root: Setting someones hash via a NTLM Hash for opsec reasons after changing a password, having trouble with Impacket
53:30 - Giving up with impacket, switching to mimikatz to set the password via hash
Watch on YouTube ↗
(saves to browser)
Sign in to unlock AI tutor explanation · ⚡30
Playlist
Uploads from IppSec · IppSec · 0 of 60
← Previous
Next →
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
HHC2016 - Analytics
IppSec
HackTheBox - October
IppSec
HackTheBox - Arctic
IppSec
HackTheBox - Brainfuck
IppSec
HackTheBox - Bank
IppSec
HackTheBox - Joker
IppSec
HackTheBox - Lazy
IppSec
Camp CTF 2015 - Bitterman
IppSec
HackTheBox - Devel
IppSec
Reversing Malicious Office Document (Macro) Emotet(?)
IppSec
HackTheBox - Granny and Grandpa
IppSec
HackTheBox - Pivoting Update: Granny and Grandpa
IppSec
HackTheBox - Optimum
IppSec
HackTheBox - Charon
IppSec
HackTheBox - Sneaky
IppSec
HackTheBox - Holiday
IppSec
HackTheBox - Europa
IppSec
Introduction to tmux
IppSec
HackTheBox - Blocky
IppSec
HackTheBox - Nineveh
IppSec
HackTheBox - Jail
IppSec
HackTheBox - Blue
IppSec
HackTheBox - Calamity
IppSec
HackTheBox - Shrek
IppSec
HackTheBox - Mirai
IppSec
HackTheBox - Shocker
IppSec
HackTheBox - Mantis
IppSec
HackTheBox - Node
IppSec
HackTheBox - Kotarak
IppSec
HackTheBox - Enterprise
IppSec
HackTheBox - Sense
IppSec
HackTheBox - Minion
IppSec
VulnHub - Sokar
IppSec
VulnHub - Pinkys Palace v2
IppSec
HackTheBox - Inception
IppSec
Vulnhub - Trollcave 1.2
IppSec
HackTheBox - Ariekei
IppSec
HackTheBox - Flux Capacitor
IppSec
HackTheBox - Jeeves
IppSec
HackTheBox - Tally
IppSec
HackTheBox - CrimeStoppers
IppSec
HackTheBox - Fulcrum
IppSec
HackTheBox - Chatterbox
IppSec
HackTheBox - Falafel
IppSec
How To Create Empire Modules
IppSec
HackTheBox - Nightmare
IppSec
HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions
IppSec
HackTheBox - Bart
IppSec
HackTheBox - Aragog
IppSec
HackTheBox - Valentine
IppSec
HackTheBox - Silo
IppSec
HackTheBox - Rabbit
IppSec
HackTheBox - Celestial
IppSec
HackTheBox - Stratosphere
IppSec
HackTheBox - Poison
IppSec
HackTheBox - Canape
IppSec
HackTheBox - Olympus
IppSec
HackTheBox - Sunday
IppSec
HackTheBox - Fighter
IppSec
HackTheBox - Bounty
IppSec
Related AI Lessons
⚡
⚡
⚡
⚡
Stop Blindly Disabling CSRF — Dynamic CSRF Configuration in Spring Security 6
Medium · Cybersecurity
Microsoft Reveals Kazuar Malware’s Advanced Modular Design and Peer-to-Peer Botnet Capabilities
Medium · Cybersecurity
The OpenAI Breach Wasn't About OpenAI – It Was About the 84 Packages Above Them
Dev.to · Dimitris Kyrkos
Years of Apple's Best Security Work, Cracked in Five Days — Here's What Developers Should Know
Dev.to · ArshTechPro
Chapters (15)
Introduction
1:00
Start of nmap
3:27
NFS is listening on Windows which is odd, looking into it briefly and not find
5:00
Using NXC to list shares and running RustHound
8:55
Adding ourself to developers, which will let us access the develoeprs share
11:45
Cracking a newer Keepass database (hash alg 4000). Currently not supported in
15:00
Copying credentials out of keepass and doing a password spray to gain access t
18:10
Looking at what Ant can do with Bloodhound, discovering we have GenericAll to
20:55
Still can't login to Adam since he is disabled, using BloodyAD to re-enable th
23:00
Finding a backup. Looking into it to discover another set of credentials
27:30
Running WinPEAS, finding DPAPI Data
34:30
Downloading the DPAPI Master Key and Credential Blobs, to download with EvilWI
36:50
Using Impacket to decrypt the DPAPI Data and logging in with Steph's ADM accou
42:45
Beyond Root: Setting someones hash via a NTLM Hash for opsec reasons after cha
53:30
Giving up with impacket, switching to mimikatz to set the password via hash
🎓
Tutor Explanation
DeepCamp AI