00:00 - Intro
01:00 - Start of nmap
04:00 - Viewing the website and discovering kerberos is disabled
07:45 - Using Kerbrute to enumerate valid users and then password spray with username
10:15 - Bad analogy comparing Kerberos works with TGT/TGS and Movie Theater Tickets
11:00 - Using Impacket's GetTGT Script to get Ticket Granting Ticket as Ksimpson and exporting KRB5CCNAME so Impacket uses it
12:30 - Using GetUserSPN to Kerberoast the DC with Kerberos Authentication and cracking to get SqlSVC's Password
16:40 - Both credentials we have cannot access MSSQL
18:15 - Creating a silver ticket to gain access to SQL
19:50 - Using GetPAC to get a Domain SID
20:30 - Showing getting Domain SID with LDAPSearch
24:00 - Creating the Silver Ticket with Impacket's Ticketer
26:30 - Showing Impacket creates the ticket with 10 years instead of 10 hours
27:40 - We now have MSSQL Access to the box, enabling xp_cmdshell and getting a reverse shell
30:00 - Using JuicyPotatoNG to escalate privileges because we have SeImpersonate Privilege
32:00 - Running the JuicyPotatoNG Exploit and getting a shell in the unintended way
34:00 - Enumerating the MSSQL Database and finding credentials
35:40 - Using Evil-WinRM to login with Kerberos Auth
39:40 - Accessing the box as MiscSvc and finding a dotnet Application
43:40 - Setting up our linux host as a router so our Windows host can communicate to the HTB Network through the linux box
47:20 - Sniffing the traffic from the dotnet application and discovering it talks to port 4411
50:20 - Looking at debug logs and seeing a serialized object
52:40 - Using YsoSerial.Net to create a malicious base64 object to send us a reverse shell
55:30 - Sending our payload and getting a reverse shell
Support the originator by clicking the read the rest link below.
