HackTheBox - TheFrizz

00:00 - Introduction 00:32 - Start of nmap 03:20 - Discovering Gibbon LMS is running and enumerating the version 04:45 - Using CVEDetails to look at CVE's for Gibbon, then discovering an unauth file upload 07:00 - Getting a shell by uploading a malicious PHP Script 11:30 - Using the MySQL binary to dump the database to get the password hash 15:55 - The password is salted, searching Gibbon Source Code for how the salt is used so we know which hashcat ruleset to use 19:55 - Running RustHound, doesn't really tell us too much 23:00 - Using SSH with Kerberos to login to the box, showing the hostfile needs to have the box name as the first item 26:30 - Going into the recycle bin, discovering a deleted file and then copying it to our box and discovering a zip which has a password 34:00 - Using our bloodhound data to build a userlist then spray the password 36:56 - Logging in with m.schoolbus then running SharpGPOAbuse to get the domain controllers to run a command