HackTheBox - Sharp

00:00 - Intro 01:00 - Start of nmap 03:10 - Running CrackMapExec to discover null authentication and an open share 05:20 - Running Spider_Plus with CME then JQ to parse the output 07:45 - Looking into KanBan 09:30 - Using smbclient to download files 13:20 - Running Impacket's SMBServer so we can easily copy things between our linux and windows VM 14:45 - Editing the KanBan config to perform a "password reset", log into kanban and then decrypt the passwords. 22:45 - Using DnSpy to decompile KanBan (dotnet) and then extract the Crypto Keys 25:20 - Creating a python script to decrypt items in the KanBan config 31:10 - Using CME to password spray with the credentials from KanBan, running spider plus again then downloading files 37:50 - Using DnSpy yet again to decompile the new executables, discovering dotnet remoting and credentials 42:00 - Looking into exploiting .net remoting to discover ExploitRemotingService and Ysoserial.net 48:30 - Sharing the OpenVPN Connection from Linux with Windows so we can have two boxes connected simultaniously 55:12 - All the commands needed to turn our linux machine into a router with NAT 57:48 - Getting a reverse shell by executing the ExploitRemotingService Binary with the payload from ysoserial .net 59:20 - Using Compress-Archive to zip up the WCF Directory then copy it to our linux and windows machines 1:02:00 - Analyzing the WCF Source in Visual Studio to discover we can execute powershell 1:07:20 - Attempting to run the binary but get login failure, using net use with /netonly to run the binary with the lars creds 1:09:50 - Running the InvokePowerShell method with a reverse shell to get system