HackTheBox - Tally

Name: HackTheBox - Tally
Uploaded: 2018-05-29T02:45:29Z
Channel: IppSec
Description: 01:45 - Start of NMAP 04:17 - Begin of Sharepoint/GoBuster (Special Sharepoint List) 06:32 - Manually browsing to Sitecontent (Get FTP Creds) 10:18 - Mi...

IppSec · Beginner ·🔐 Cybersecurity ·7y ago

01:45 - Start of NMAP 04:17 - Begin of Sharepoint/GoBuster (Special Sharepoint List) 06:32 - Manually browsing to Sitecontent (Get FTP Creds) 10:18 - Mirror FTP + Pillage for information, Find keypass in Tim's directory and crack it. 18:22 - Mounting/Mirroring ACCT Share with found Creds and finding hardcoded SQL Creds 25:24 - Logging into MSSQL with SQSH, enabling xp_cmdshell and getting a Nishang Rev Shell 34:35 - Finding SPBestWarmUp.ps1 Scheduled Task that runs as Administrator 40:00 - Begin of RottenPotato without MSF (Decoder's Lonely Potato) 45:56 - Using Ebowla Encoding for AV Evasion …

Watch on YouTube ↗ (saves to browser)

Chapters (16)

1:45 Start of NMAP

4:17 Begin of Sharepoint/GoBuster (Special Sharepoint List)

6:32 Manually browsing to Sitecontent (Get FTP Creds)

10:18 Mirror FTP + Pillage for information, Find keypass in Tim's directory and crac

18:22 Mounting/Mirroring ACCT Share with found Creds and finding hardcoded SQL Creds

25:24 Logging into MSSQL with SQSH, enabling xp_cmdshell and getting a Nishang Rev S

34:35 Finding SPBestWarmUp.ps1 Scheduled Task that runs as Administrator

40:00 Begin of RottenPotato without MSF (Decoder's Lonely Potato)

45:56 Using Ebowla Encoding for AV Evasion to create an exe for use with Lonely Pota

58:00 Lonely Potato Running to return a Admin Shell

1:04:22 Finding CVE-2017-0213

1:08:33 Installing Visual Studio 2015 && Compiling the exploit

1:15:50 Exploit Compiled, trying to get it to work....

1:18:11 Just noticed the SPBestWarmUp.ps1 executed and gave us a shell!

1:28:37 Found the issue, exploit seems to require interactive process

1:30:00 Begin of Firefox Exploit Cluster (Not recommended to watch lol). It's a secon

Playlist

Uploads from IppSec · IppSec · 55 of 60

← Previous Next →