HackTheBox - Coder

00:00 - Introduction
01:00 - Start of nmap
03:30 - Exploring the file share
07:15 - Finding Encrypter.exe, which is a dotnet encrypter. Discovering the seed is based upon time, modifying it to decrypt using metadata from the encrypted file to get the seed.
15:30 - The encrypted file was a Keepass Database, looking into it and seeing credentials and a uthenticator backup
19:45 - Installing the "Authenticator" app and seeing the backup format is the same
21:30 - Explaining why we want to just bruteforce AES vs Argon2id
25:50 - Creating a program in javascript to bruteforce the AES by decrypting and examining the contents of what was decrypted
40:40 - Cracking program done, then logging into TeamCity
45:45 - We can't modify the files on TeamCity but we can use the personal build, supply a dif and get it to execute code that way
49:50 - Defender blocked nishang reverse shell, doing some quick obfuscation to bypass defender and get a shell
55:50 - Discovering Teamcity keeps track of personal builds, looking at old ones and discovering powershell credentials. Decrypting the Secure String to get e.black's password
1:08:00 - Running the bloodhound python collector in a Docker
1:17:40 - Writing a bloodhound query to show Organization Units in active directory, then using Get-ACL to see unique privileges to each OU
1:24:15 - Explaining the attack path, e.blake can manipulate ADCS, s.blade can add machines to a specific OU. We can create a vulnerable ADCS Template and exploit this with Certifried
1:31:30 - Creating and publishing the Vulnerable Certificate. Cloning computer, then modifying msPKI-Enrollment-Flag
1:53:30 - Doing an easier vulnerable template, to make this box vulnerable to ESC1. Set msPKI-Enrollment-Flag, msPKI-Certificate-Name-Flag,

[@Darquirrin]

Love the video and how Ipp kept jumping between Black and Blake ;) So cool, keep up the great work.

[@AUBCodeII]

Maybe the real Ipp was the friends we made along the way

[@SimonHuenecke]

love how this video makes it seem, that programming javascript was the main reason for the box to be ranked "insane"

[@AUBCodeII]

Merry Christmas, Ippy

[@ahmedmoustafa3186]

Amazing ❤

[@dadamnmayne]

3:46 Anonymous logon. Anonymous logon is common in enterprise setups. Otherwise, users would need to reauthenticate everytime they access a file share. The best approach for smb is File Based Access controls.

[@dadamnmayne]

@@turningaround7842 💯

[@AUBCodeII]

1:04:53 you don't have to upload enc.txt and key.key to the target to get e.black's password. I corrected the enc.txt file and ran the exact same lines of code you did on my machine and it worked just fine. But it was nice to learn some Git commands :)

[@kalidsherefuddin]

The great course

[@mutabixherbert6197]

Nice work

[@Nobody2day553]

Do you have a video showing how to setup a "kraken" machine?

[@allurbase]

Leaving the wrong code in makes it more likely that copilot would hallucinate, for future reference.

[@pugglecorn1085]

Sonya Blade, Erron Black, Jax :) _Mortal Kombat!!!_

[@user-cb5yk4gk9u]

love your content ! can you see how many language you learned

[@BroodPitt]

Wasn't it called a smb null session? 😅

[@ippsec]

Null session is no username too

[@BroodPitt]

@@ippsec 😞

[@ClinicalDepression420]

Does anyone else hear the 'Um hmm' in the background?

[@tg7943]

Push!

[@eyephpmyadmin6988]

You should do a video on doing a bug bounty whwre the scope is so big, its hard finding a place to consider going deep on

[@ippsec]

I would not go deep in bug bounty, it’s rarely profitable. Look for shallow, automated it and scan

[@RISE_BEFORE_YOU_DIE]

Its Illegal On KZbin.. "HACKING REASON" Bcuz Attacking Real Host

[@6locc6a6y_fps]

30:00 😂

[@sotecluxan4221]

Have a great Xmas and a happy '24!