HackTheBox - Scepter

Name: HackTheBox - Scepter
Uploaded: 2025-07-19T15:00:31Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 03:20 - Looking at the NFS Mount on Windows, then downloading the certificates 06:00 - Examining the certific...

IppSec · Beginner ·🔐 Cybersecurity ·8mo ago

00:00 - Introduction 01:00 - Start of nmap 03:20 - Looking at the NFS Mount on Windows, then downloading the certificates 06:00 - Examining the certificates, dumping information to look at username and expiration. Then cracking PEM and PFX 13:50 - Using certipy to auth with the certificate, discovering some accounts are locked out 17:30 - Building a PFX File from the key and pem, then logging in and running RustHound with Kerberos since we only have NTLM Hash 24:40 - Looking at Bloodhound Data and seeing D.Baker can reset A.Carter's password who can take over D.Baker 27:50 - Running Certipy to…

Watch on YouTube ↗ (saves to browser)

Chapters (15)

Introduction

1:00 Start of nmap

3:20 Looking at the NFS Mount on Windows, then downloading the certificates

6:00 Examining the certificates, dumping information to look at username and expira

13:50 Using certipy to auth with the certificate, discovering some accounts are lock

17:30 Building a PFX File from the key and pem, then logging in and running RustHoun

24:40 Looking at Bloodhound Data and seeing D.Baker can reset A.Carter's password wh

27:50 Running Certipy to look at certificates as D.Baker

30:45 Examining LDAP to discover H.Brown has an Alternate Security Identity set

32:30 Performing ESC14 by exploiting a chain to give ourself GenericAll then setting

41:30 Using WinRM with Kerberos to login as h.brown

42:40 Using BloodyAD to show writable objects as h.brown to see they can write somet

43:58 Running DSACLS to discover exactly what h.brown can write to see it is the Alt

52:15 Running SecretsDump to become administrator and grab the flag

53:24 Beyond Root, enabling Remote Desktop so we can look at the Certificate Configu

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →