HackTheBox - Reel

00:42 - Begin of Nmap 04:23 - Examining the anonymous FTP Directory and discovering email addresses in Meta Data 06:50 - Manually enumerating valid email addresses via SMTP 10:50 - Creating a "Canary Document" in Word to ping back to our server when a word document is opened 13:14 - Generating a malicious RTF Document (CVE-2017-0199) 26:28 - Shell Returned. Enumerating the AppLocker Policy 32:53 - Decrypting a PowerShell Secure String to reveal Tom's Password, Testing access with SSH 35:22 - Lets forget we had Tom and run Bloodhound from Nico! 40:30 - First time opening BloodHound on this box. 49:45 - Lets update Bloodhound, looks like some data is missing and there were errors when running it 53:25 - Finding a path from Nico to BACKUP_ADMINS and explaining Active Directory (AD) Security Objects (GenericWrite, WriteOwner,etc) 58:23 - Taking Ownership over Herman then allowing Nico to change his password and examining bloodhound 01:01:40 - Adding Herman to the Backup_Admins group 01:04:30 - Finding the Administrator Password within backup scripts. 01:07:00 - Attempting to run Watson (ends up not working) 01:23:22 - Using Metasploit to do the box 01:25:42 - Since Watson failed, lets just look at last patch times on the box to get an idea whats vulnerable. 01:27:19 - Attempting to do the ALPC Exploit within Metasploit 01:31:00 - That failed - Lets just prove the box is vulnerable, by overwriting a DLL