HackTheBox - Anubis

00:00 - Intro
01:00 - Start of nmap, getting hostname and
05:20 - Discovering the Server Header changes for virtualhost, probably navigating to a different box/container/etc [MasterRecon]
10:50 - Getting a good SSTI Fuzz String then identifying this string causes an error on the webserver. Removing parts of the string until we see the type of SSTI
13:40 - Playing with ASP Code in this SSTI or ASP Code Injection... Not sure what the vulnerability is
15:30 - Getting a VBScript One Liner to execute code and then getting a reverse shell
24:30 - Discovering a x509 certificate, decoding it with openssl, and discovering a second hostname
29:00 - Downloading and running chisel to setup a reverse socks proxy so we can attempt to pivot through this container
31:54 - Running nmap through the chisel socks proxy with proxychains
34:20 - Setting FoxyProxy to only send specific domains through our proxy
36:30 - Discovering the softwareportal.windcorp.htb attempts to install software on machines, set it to our machine and wireshark to see how 3it connects back to us
38:30 - Using responder to intercept the WinRM Connection and then use hashcat to crack the credentials
42:40 - Using CrackMapExec with our cracked credentials discovering we can access a file share that has Jamovi Files
45:00 - Installing Jamovi then finding out the XSS and proving RCE with Calc. Setting it to execute javascripts off of our webserver
53:20 - Creating a web cradle to execute a reverse shell, in typical ippsec fashion have a typo that we will fix later
56:20 - Fixed up the web cradle, reverse shell returned. Some light enumeration and talking about honey pots that have logon hours set to never
1:00:00 - Start of certificate exploit, downloading tools certify, rubeus, ADCS, PowerView
1:04:45 - Running Certify to find vulnerable certificates, we can edit the certificate template which enables us to enroll a smart card
1:08:00 - Running Get-SmartCardCertificate and then checking certificate store to see we didn't have anything. Showing we need to change the script because a weird thing with UPN's on this box
1:10:50 - Running Get-SmartCardCertificate again with our fix, then getting the certificate thumbprint and using Rubeus to get the credential
1:14:30 - Enabling RDP on the box so we can visually see the certificate
1:19:10 - Opening up MMC to see the certificate
1:23:20 - Doing the Certificate Exploit again but stepping through it all manually using Linux instead of Windows when possible
1:24:20 - Showing the vulnerable certificate template before modifying and what the certificate usage is
1:26:30 - Showing the certificate template after using Set-ADObject to modify the template
1:27:25 - Generating a Certificate Request
1:29:40 - Using CertReq to sign the certificate we generated
1:31:30 - Showing my Kerberos Configuration
1:32:50 - Using CertUtil to output the CA Certificate
1:33:50 - Setting up our port forwards so we can communicate with Kerberos
1:37:45 - Running kinit to login with our X509 Smart Card Certificate, get error show how to debug KINIT with trace
1:39:40 - Changing our time to match the DC and then running KINIT again and getting a session
1:40:50 - Using Evil-WinRM to get a shell with our kerberos certificate

[@skudddle]

Watching this with absolute no clue as to what he is doing, but fully captivated.

[@SuperNGLP]

I'm not sure what I'm more impressed by. It's either, that he's talking on 1.5x speed by default, without a single mistake or that he's hacking the machine with the same kind of routine and ease as I tie my shoelaces.

[@LuisMorales-bl7fc]

Master piece!! I was looking for something like this in order to understand Certified Pre-Owned, outstanding explanation.

[@khurramwzd]

Another wonderful walkthrough

[@socat9311]

Would love to see an active directory cloud setup and attack vid. There are some out there, I just really like your style. Regardless, thanks for all the great vids

[@pythonxsecurity8287]

bro you soooooo gooood respect

[@lukbie_]

I was expecting a fire mixtape when i clicked this and stayed because of your calming voice. Thanks i guess :D

[@DyLexia21]

ahhahaha holy shit I was feeling the same :d

[@Ms.Robot.]

I had to watch this. It was so hypnotic.

[@chiragartani]

Gonna watch tonight. 🙌 Ippsec rocks! 🔥

[@teodorilie963]

Thank you for this video! I learned so much from it

[@saketsrv9068]

yay.... finally long video

[@SS-SoranWaffen]

Good video!

[@darshacharya1102]

From which playlist of you i can start for ctf plz answer

[@huuloc8719]

Nice.

[@aaryanbhagat4852]

Great explanation! I just missed the part where you found out the username to be "localadmin" of the smb share?

[@road6915]

He got the hash of that password with responder, and the hashes have the name:domain:hash structure

[@LuisMorales-bl7fc]

NetNTLMv2 hash captured by responder.

[@BlackHermit]

responder is such a great tool!

[@robbie2044]

Very nice video. I had an issue though. When I applied the cert vuln and running Certify again, "Server Authentication" was not there. Client and SmartCard were. Dunno why since I copied the same thing from the blogpost.

[@dusktime]

What operating system are you using

[@ca7986]

❤️

[@piotrpytkowski1542]

What is your linux distribution? or you working on mac?

[@zwwx2142]

what is the name of this theme programming, I do not understand

[@pampipipi8254]

It's me your fan

[@h1dvy]

Hi IppSec, great video btw! Can you please share the contents of your /opt/ directory (Assuming it only contains open-source utilities). Thx in advance!

[@ippsec]

Sorry, nope. There’s potentially sensitive things created by the tools in there. For example responder stores hashes in responder.db

[@h1dvy]

@@ippsec I appreciate your prompt response! I was just wondering if there was some sort of a list of tools that you commonly use for such exercises; It can be quite annoying to do all the things manually, only to find in the end that there is already a handy utility made for the same thing.

[@h1dvy]

​@@ippsec Sorry, I just realised that my initial comment was not phrased correctly; I was not looking for the actual contents of your /opt/ directory xD I was wondering if you can share the tool names that you use (From what I've seen in your videos, the parent folders are named the same, so something like an "ls" output would do).

[@k_xx]

Watch some 10-15 videos and take notes as you go. You'll quickly figure out which tools are essential and which are added "as you go".

[@vadik1001]

damn it, i was hoping that intended way is not through cert

[@ibrahim3690]

Where and how can I learn the prerequisites for this info

[@inakitedo475]

How is it possible that this box was rooted in 26 minutes? A zero day that we don't know?

[@ippsec]

The creator had set the admin password of the docker to the same thing as the host. So there was an unintended where you could pass the hash

[@k1nz30]

Grate to watch Kermit the frog doing this

[@tthtlc]

first, what is the terminal he used, so that it can be split into multiple screen when necessary?

[@Bob737]

tmux

[@el3man]

damn for a sec i thought u figured out how to hack rekordbox because of ur logo

[@skyone9237]

This box I had no clue how to exploit it

[@nooblolxd3919]

Where can I learn it?

[@msi6684]

👏🏻👏🏻👏🏻👏🏻👏🏻

[@Wthisthisx]

What is this?? I'm lost but also interested.

[@MrM4rcYT]

I have no Iddea of hacking and coding, but sat through th whole video. still have no idea, what u did. but likd it anyway.

[@ratapubimi]

Where did my comment about chisel go?

[@ippsec]

No idea, I never saw a comment about chisel and don't see one in the "held for review" section.

[@ratapubimi]

@@ippsec YT is deleting my comments! Seems i Have a buzzword in it.

[@saranshsarafmr23r06]

Amazing Sir, I've learnt a lot from you. Can you please cover the new IIS dos & rce cve?

[@tntxqx8281]

Are you trying ssti on KZbin username filled 😂😂😂😂

[@democsrf2793]

49

[@saranshsarafmr23r06]

@@tntxqx8281 yes I was 🐒

[@saranshsarafmr23r06]

@@democsrf2793 thanks for showing interest 😝

[@kommie27]

Having Smartcard login is just a open door sign.

[@chemicalzxd]

This is the longest thing ive watched that i dont understand

[@newlineschannel]

GD ANUBIS??

[@krishnasoni4427]

Sir please solve Active Directory labs related to oscp ❤️❤️❤️🙏

[@ippsec]

No way for me to know what’s on that exam.

[@skyone9237]

He should rather do a live stream of exam itself.. 😂😂😂

[@xcat4775]

YOU SAID ANUBIS WRONG

[@Ladas552]

Bro, U hacked my youtube recommendations , not box.

[@AsadAli-ye8ns]

bro slow down a little bit and explains a little bit what are you doing and why are you doing and steps please....

[@VivaLyaLibertyBibaLyaLiberty]

Realy insane

[@anamariedevera8635]

Hello I have tried the Rubeus and reset multiple times; however, I keep getting this error KDC_ERR_PADATA_TYPE_NOSUPP

[@vonniehudson]

Proof @ippsec is leet: check the tmux time in the bottom right of his terminal @52:34

[@ayushprajapati9486]

after running rubeus i am getting error KDC_ERR_INCONSISTENT_KEY_PURPOSE