HackTheBox - Signed

Name: HackTheBox - Signed
Uploaded: 2026-02-07T15:01:00Z
Channel: IppSec
Description: 00:00 - Introduction 01:00 - Start of nmap 02:05 - Logging into the SQL Database with the provided credentials, going over basic enumeration 04:00 - Usi...

IppSec · Beginner ·📊 Data Analytics & Business Intelligence ·1mo ago

00:00 - Introduction 01:00 - Start of nmap 02:05 - Logging into the SQL Database with the provided credentials, going over basic enumeration 04:00 - Using XP_DIRTREE to have the SQL Server make a request, sending it to ourself and stealing/cracking the hash 08:50 - Showing RID Brute Forcing with MSSQL to enumerate additional users 10:50 - Explaining how the SUSER_SID command performs a SID Bruteforce, converting the SID from binary to String notation 15:00 - Creating a Silver Ticket with Ticketer.py 23:30 - Impersonating an admin, so we can enable xp_cmdshell to get a shell on the box 27:20 - …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

Introduction

1:00 Start of nmap

2:05 Logging into the SQL Database with the provided credentials, going over basic

4:00 Using XP_DIRTREE to have the SQL Server make a request, sending it to ourself

8:50 Showing RID Brute Forcing with MSSQL to enumerate additional users

10:50 Explaining how the SUSER_SID command performs a SID Bruteforce, converting the

15:00 Creating a Silver Ticket with Ticketer.py

23:30 Impersonating an admin, so we can enable xp_cmdshell to get a shell on the box

27:20 Showing CVE-2025-33073 posts, which explains the attack we will do with NTLM R

28:30 Getting Chisel up and running so we can add DNS Names

31:20 Adding a special DNS Name so we can impersonate DC01, then starting NTLMRelay

37:00 Using NetExec's coerce_plus to force a request to be made to our special DNS N

42:30 Showing if we impersonated the SQL Service itself we could abuse OpenRowSet to

47:10 Reading the powershell history which would get us the administrator password

54:10 Showing yet another cool thing, we can abuse how tokens work to get the origin

1:12:10 Not every attempt is successful showing adding custom functions via CLR wouldn

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →