HackTheBox - RustyKey

Name: HackTheBox - RustyKey
Uploaded: 2025-11-08T15:02:15Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 05:00 - Syncing our time with the DC via NTPDate 10:12 - Writing a custom Cypher Query in Bloodhound to show ...

IppSec · Beginner ·🔐 Cybersecurity ·4mo ago

00:00 - Introduction 01:00 - Start of nmap 05:00 - Syncing our time with the DC via NTPDate 10:12 - Writing a custom Cypher Query in Bloodhound to show everything that users and computers can directly do, except for group memberships. Discover an oddity around IT-COMPUTER3 and seeing its password set date is also odd 14:00 - Using NetExec to perform a TimeRoast attack and then cracking the computer password 18:15 - Back in Bloodhound, we can see IT-Computer3 has a path to take over several users 22:45 - Using BloodyAD to add ourself to the helpdesk group and then reset BB.MORGAN's password 25…

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Start of nmap

5:00 Syncing our time with the DC via NTPDate

10:12 Writing a custom Cypher Query in Bloodhound to show everything that users and

14:00 Using NetExec to perform a TimeRoast attack and then cracking the computer pas

18:15 Back in Bloodhound, we can see IT-Computer3 has a path to take over several us

22:45 Using BloodyAD to add ourself to the helpdesk group and then reset BB.MORGAN's

25:00 Still cannot log in, discovering BB.MORGAN is a member of the Protected Users/

29:30 Using BloodyAD to remove the user from the Protected Objects group, the loggin

35:30 Find a PDF and it talks about Context Menus and COM Objects with Zip programs

39:10 Using Req Query to show CLSID's then identifying support can modify the one th

44:00 Using RunAsCS to switch to the support user (ee.reed) as remote logins appeare

46:00 Performing the COM Hijack on 7-zip and getting a reverse shell as mm.turner.

49:55 Shell returned as mm.turner, who has the AllowedToAct on the DC

53:30 Using Set-ADComputer to set the delegation permission, then getST to impersona

1:05:05 Showing why EE.REED could not login, diving into looking at the secpol command

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →