HackTheBox - Vintage

Name: HackTheBox - Vintage
Uploaded: 2025-04-26T15:00:01Z
Channel: IppSec
Description: 00:00 - Introduction 01:05 - Start of nmap 05:20 - Running Bloodhound 07:55 - Bloodhound, Shortest Path to Tier 0 shows us two ADM users which can add t...

IppSec · Beginner ·🔐 Cybersecurity ·11mo ago

00:00 - Introduction 01:05 - Start of nmap 05:20 - Running Bloodhound 07:55 - Bloodhound, Shortest Path to Tier 0 shows us two ADM users which can add themselves to Delegated Admins 09:45 - Dumping Password set time of users in bloodhound with JQ to see any passwords set at the same time 13:00 - Discovering the GMSA account, looking at it and discovering it can add themselves to ServiceManagers and that FS01 can ReadGMSAPassword 13:50 - FS01 is a member of the Pre Windows 2000 Compatible Access Group, which sets the password of the account to the hostname of the box 16:30 - NXC failed us, usin…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Introduction

1:05 Start of nmap

5:20 Running Bloodhound

7:55 Bloodhound, Shortest Path to Tier 0 shows us two ADM users which can add thems

9:45 Dumping Password set time of users in bloodhound with JQ to see any passwords

13:00 Discovering the GMSA account, looking at it and discovering it can add themsel

13:50 FS01 is a member of the Pre Windows 2000 Compatible Access Group, which sets t

16:30 NXC failed us, using bloodyAD to read the GMSA Password

18:50 Opening up wireshark to look at why NXC Failed but BloodyAD Worked, quickly mo

23:20 Bloodhound, Looking at what ServiceManagers can do, it has GENERICALL to many

25:40 Using BloodyAD to re-enable the SVC_SQL account and then running TargetedKerbe

36:50 Spraying the password from SVC_SQL with users of the domain, finding c.neri ha

40:30 Using NXC to generate the KRB5 Config File, then using evil-winrm to login to

42:55 Dumping the users encrypted credential blob and dpapi information, then manual

52:50 Bloodhound, c.neri_adm can perform RBCD Attack to impersonate users of the dom

55:30 Using BloodyAD to add FS01 to the DelegatedAdmin group, then getST to imperson

1:04:30 Beyond Root: Exploring the Sensitive Flag in bloodhound to prevent the RBCD At

1:11:10 Protected Users Group did stop it, but Bloodhound didn't set sensitive to true

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →