HackTheBox - Silo

01:30 - Begin of recon 03:15 - Begin of installing SQLPlus and ODAT (Oracle Database Attack Tool) 08:45 - Bruteforcing the SID with ODAT 10:15 - Holy crap, this is slow lets also do it with Metasploit 13:00 - Bruteforcing valid logins with ODAT 16:00 - Credentials returned, logging into Oracle with SQLPlus as SysDBA 19:00 - Reading files from disk via Oracle 23:20 - Writing files to disk from Oracle. Testing it in WebRoot Directory 25:52 - File Written, lets write an ASPX WebShell to the Server 29:10 - WebShell Working! Lets get a Reverse Shell 31:28 - Reverse Shell Returned 32:24 - Finding a DropBox link, but password doesn't display well. 33:55 - Attempting to copy file via SMB to view UTF8 Text 35:18 - That didn't work, lets transfer the file by encoding it in Base64. 36:55 - Got the password lets download the dump! 39:10 - Begin of Volatility 45:20 - Running the HashDump plugin from volatilty then PassTheHash with Administrator's NTLM! ### Box Done 47:35 - Begin of unintended way, examining odat and uploading an meterpreter exe 50:30 - Using odat externaltable to execute meterpreter and get a system shell! 52:20 - Examining odat verbosity flag to see what commands it runs and try to learn.