HackTheBox - Sharp

Name: HackTheBox - Sharp
Uploaded: 2021-05-01T15:01:07Z
Channel: IppSec
Description: 00:00 - Intro 01:00 - Start of nmap 03:10 - Running CrackMapExec to discover null authentication and an open share 05:20 - Running Spider_Plus with CME ...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro 01:00 - Start of nmap 03:10 - Running CrackMapExec to discover null authentication and an open share 05:20 - Running Spider_Plus with CME then JQ to parse the output 07:45 - Looking into KanBan 09:30 - Using smbclient to download files 13:20 - Running Impacket's SMBServer so we can easily copy things between our linux and windows VM 14:45 - Editing the KanBan config to perform a "password reset", log into kanban and then decrypt the passwords. 22:45 - Using DnSpy to decompile KanBan (dotnet) and then extract the Crypto Keys 25:20 - Creating a python script to decrypt items in the…

Watch on YouTube ↗ (saves to browser)

Chapters (20)

Intro

1:00 Start of nmap

3:10 Running CrackMapExec to discover null authentication and an open share

5:20 Running Spider_Plus with CME then JQ to parse the output

7:45 Looking into KanBan

9:30 Using smbclient to download files

13:20 Running Impacket's SMBServer so we can easily copy things between our linux an

14:45 Editing the KanBan config to perform a "password reset", log into kanban and t

22:45 Using DnSpy to decompile KanBan (dotnet) and then extract the Crypto Keys

25:20 Creating a python script to decrypt items in the KanBan config

31:10 Using CME to password spray with the credentials from KanBan, running spider p

37:50 Using DnSpy yet again to decompile the new executables, discovering dotnet rem

42:00 Looking into exploiting .net remoting to discover ExploitRemotingService and Y

48:30 Sharing the OpenVPN Connection from Linux with Windows so we can have two boxe

55:12 All the commands needed to turn our linux machine into a router with NAT

57:48 Getting a reverse shell by executing the ExploitRemotingService Binary with th

59:20 Using Compress-Archive to zip up the WCF Directory then copy it to our linux a

1:02:00 Analyzing the WCF Source in Visual Studio to discover we can execute powershel

1:07:20 Attempting to run the binary but get login failure, using net use with /netonl

1:09:50 Running the InvokePowerShell method with a reverse shell to get system

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →