HackTheBox - Rebound

Name: HackTheBox - Rebound
Uploaded: 2024-03-30T15:00:40Z
Channel: IppSec
Description: 00:00 - Introduction 01:07 - Start of nmap then checking SMB Shares 04:05 - Using NetExec to do a RID Brute Force and increase the maximum to 10000 07:0...

IppSec · Beginner ·🔐 Cybersecurity ·2y ago

00:00 - Introduction 01:07 - Start of nmap then checking SMB Shares 04:05 - Using NetExec to do a RID Brute Force and increase the maximum to 10000 07:00 - Using vim g!/{string}/d to delete all lines that do not contain something to build wordlists 10:40 - Using ASREP Roasting to perform a Kerberoast attack without authentication 17:40 - Using NetExec to run Bloodhound as ldap_monitor 25:30 - Discovering Oorend can add themself to the ServiceMgmt group, which can take over the WinRM Account 28:30 - Spraying the password of the ldap_monitor account to discover it shares oorend's password 34:20 …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:07 Start of nmap then checking SMB Shares

4:05 Using NetExec to do a RID Brute Force and increase the maximum to 10000

7:00 Using vim g!/{string}/d to delete all lines that do not contain something to b

10:40 Using ASREP Roasting to perform a Kerberoast attack without authentication

17:40 Using NetExec to run Bloodhound as ldap_monitor

25:30 Discovering Oorend can add themself to the ServiceMgmt group, which can take o

28:30 Spraying the password of the ldap_monitor account to discover it shares oorend

34:20 Showing BloodyAD to add Oorend to ServiceMGMT then abusing the GenericAll to S

40:30 Showing a more opsec friendly way to take over WINRM_SVC by abusing shadow cre

50:00 As WINRM_SVC we cannot run some commands like qwinsta or tasklist. Using Runas

54:10 Performing a Cross Session attack with Remote Potato to steal the NTLMv2 Hash

59:20 Using NetExec to read GMSA Passwords as TBRADY

1:04:00 Using findDelagation.py to show constrained delegation from the GMSA delegator

1:11:20 Using RBCD.py to setup the Resource-Based Constrained Delegation so we can get

1:18:20 Using our ticket that impersonates DC01 and performing secretsdump and then ge

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →