HackTheBox HTB Sauna - AS-REP Roastable kerbrute && DCsync Attack

00:00 - Intro
00:47 - Start of the nmap scan and looking at the Ports
02:14 - Adding Domain in the host file and looking at the website
03:39 - Trying to Create a username dictionary and kerbrute to do username bruteforce
11:12 - Doing AS-Rep Roastable Attack on fsmith user
13:00 - Cracking the hash with john to get plaintext password
13:31 - Crackmapexec to password spray with smb and winrm and logging in as evil-winrm to get thee flag
16:22 - Upload winpeas and finding the credentials of svc_loanmgr and logging in as svc_loanmgr
21:42 - Uploading shraphound and analyzing the results in bloodhound
25:40 - Found we have DCSync rights so we can dump the credentials for the complete domain using impacket-secretsdump and get administrator
28:18 - Learning wmiexec , smbexec and psexec from impacket

Видео HackTheBox HTB Sauna - AS-REP Roastable kerbrute && DCsync Attack канала Programmer Security LTD