HackTheBox - Absolute

00:00 - Intro
01:00 - Start of nmap discovering Active Directory (AD)
04:15 - Using wget to mirror the website, then a find command with exec to run exiftool and extract all user names in metadata
06:45 - Using Username Anarchy to build a wordlist of users from our dump and then Kerbrute to enumerate valid ones
13:55 - Building Kerbrute from source to get the latest feature of auto ASREP Roasting
16:20 - Kerbrute pulled the wrong type of hash, using the downgrade to pull etype 18 of the hash
21:30 - Running Bloodhound with D.Klay, using Kerberos authentication
24:50 - Going over the bloodhound data and finding some attack paths
31:13 - Manually parsing the Bloodhound with JQ to show descriptions for all users and finding the SVC_SMB password in the Description
34:45 - EDIT: Don't want to use Blodhound? Showing LdapSearch with Kerberos, and why the FQDN has to be first in the /etc/hosts file
40:30 - End of edit: Using SMBClient with SVC_SMB and Kerberos to download files
46:22 - Sharing my internet connection from Linux to Windows, so I can run test.exe on Windows
53:45 - Running test.exe and getting m.lovegod's password from LDAP
56:30 - Going back to Bloodhound, and now we can perform the attack of adding a member to a group then creating shadow credentials for winrm_user
57:30 - Pulling a version of Impacket that has DACLEDIT and building it
1:01:00 - Running DaclEdit to give m.lovegod permission to add users to a group and then net rpc to add him
1:08:20 - Running Certipy to add shadow credentials to winrm_user so we can login
1:12:00 - Using WinRM to login to the box with our shadow credential
1:15:30 - Start of fumbling around with KRBRelay to privesc
1:18:40 - Using RunasCS to change our LoginType which may allow us to run KRBRelay
1:27:40 - Pulling the CLSID of TrustedInstaller which works and allows us to add ourselves to the administrator group

[@Ghislo]

"by the end of this box you'll be a kerberos expert, well... no one is a kerberos expert" 😭

[@Ms.Robot.]

This is very well thought out. Thank You. Wow❗

[@user-cx5jj3zq1r]

that single quotes really got on my nerves, good job for the walkthrough on this box

[@kittu_nim9863]

I've waited for this one 😂

[@spencerclark8430]

Great job!

[@lucilifer]

Great video as always. At 55:13 you can see on Wireshark LDAP request resultCode is invalidCredentials. So periods do matter for LDAP as well it's just test.exe is missing it probably deliberately.

[@djehamohamed6655]

i play weekly your new video in my tv like a watch a movie

[@dojoku88]

Geges pak ippsec ❤

[@Indic4Zone]

awesome!!

[@alanisam6220]

awesome ippsec!

[@simonemarra10]

Does anybody facing an error with Certipy or pywhisker (Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)?

[@M1k3y_Idecision]

Hi Ippsec how do u split the terminal in parrot os and those tabs? Is it another terminal u use? + how did u integrate ur vpn connection status in the terminal box?

[@ahmadmaulana3622]

He uses tmux. There's a video explaining about it in this channel.

[@tg7943]

Push!

[@leon1985ist]

hi how are you ippsec question what are the specs on the Kracken -pc 14:37 if you dont mind me asking

[@behindYOUR6]

look at the details when he running hashcat. its tells about the CPU details and more.

[@osmandagdelen9575]

Best you tube channel at the world second is mines

[@maxali6591]

When you sudo echo, the redirect (>> or >) isn't executed by privileged user even with sudo, so you couldn't edit proc sys taht way. You could by sudo vi or sudo - s then echo By the way your content is still amazing and even better passing years (I flook at you videos you since you begun and it's a great pleasure to see you performing 😊)

[@ippsec]

Ah yes. Thanks!

[@hyderali9735]

Hello Ippsec!

[@vijayvj3976]

Hey IppSec .....❤

[@ak1ra492]

There is a new BloodHound release that now shows linux abuse on help 😅

[@ippsec]

Oh that would have been handy.

[@karkantas]

INSANE BOX , I wasted 1 week of my life on this box.

[@damuffinman6895]

Not a great attitude. Take everything as a learning opportunity.

[@samu5167]

"wasted" it's not that deep

[@surplus2720]

Sincerly i LOVED doing this box i thing is in the top 10 of the box i loved and learned more from it ... if u cant handle the frustration , repeated faliure ,infinite reaserch tests and all ... maybe that stuff isnt for u ...

[@G0rlami]

39:36 I wonder now if this the order still matters if you put the realm information in the /etc/krb5.conf file