HackTheBox - Reel

Name: HackTheBox - Reel
Uploaded: 2018-11-10T14:58:35Z
Channel: IppSec
Description: 00:42 - Begin of Nmap 04:23 - Examining the anonymous FTP Directory and discovering email addresses in Meta Data 06:50 - Manually enumerating valid emai...

IppSec · Beginner ·🔐 Cybersecurity ·7y ago

00:42 - Begin of Nmap 04:23 - Examining the anonymous FTP Directory and discovering email addresses in Meta Data 06:50 - Manually enumerating valid email addresses via SMTP 10:50 - Creating a "Canary Document" in Word to ping back to our server when a word document is opened 13:14 - Generating a malicious RTF Document (CVE-2017-0199) 26:28 - Shell Returned. Enumerating the AppLocker Policy 32:53 - Decrypting a PowerShell Secure String to reveal Tom's Password, Testing access with SSH 35:22 - Lets forget we had Tom and run Bloodhound from Nico! 40:30 - First time opening BloodHound on this box…

Watch on YouTube ↗ (saves to browser)

Chapters (19)

0:42 Begin of Nmap

4:23 Examining the anonymous FTP Directory and discovering email addresses in Meta

6:50 Manually enumerating valid email addresses via SMTP

10:50 Creating a "Canary Document" in Word to ping back to our server when a word do

13:14 Generating a malicious RTF Document (CVE-2017-0199)

26:28 Shell Returned. Enumerating the AppLocker Policy

32:53 Decrypting a PowerShell Secure String to reveal Tom's Password, Testing access

35:22 Lets forget we had Tom and run Bloodhound from Nico!

40:30 First time opening BloodHound on this box.

49:45 Lets update Bloodhound, looks like some data is missing and there were errors

53:25 Finding a path from Nico to BACKUP_ADMINS and explaining Active Directory (AD)

58:23 Taking Ownership over Herman then allowing Nico to change his password and exa

1:01:40 Adding Herman to the Backup_Admins group

1:04:30 Finding the Administrator Password within backup scripts.

1:07:00 Attempting to run Watson (ends up not working)

1:23:22 Using Metasploit to do the box

1:25:42 Since Watson failed, lets just look at last patch times on the box to get an i

1:27:19 Attempting to do the ALPC Exploit within Metasploit

1:31:00 That failed - Lets just prove the box is vulnerable, by overwriting a DLL

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →