HackTheBox - Hathor

00:00 - Intro
00:50 - Start of nmap
04:00 - Navigating to the page
05:00 - Discovering the forgot password feature enables people to enumerate valid users
06:45 - Finding the default credentials for mojo portal and then logging in as admin
07:50 - Uploading an ASPX Webshell but finding out the aspx extension is blacklisted
10:30 - Looking at the GitHub issues for MojoPortal
12:00 - Copying a file to bypass the bad extension filter of uploaded material and getting our webshell
12:50 - Showing the importance of redirecting STDERR to STDOUT on web shells to discover why some commands fail
15:00 - Failing to run a Powershell Reverse Shell bypassing AV, only to find out it is in ConstrainedLanguage Mode
18:30 - Attempting to upload netcat to find out its blocked via group policy
20:30 - Enumerating Applocker with Powershell Get-AppLockerPolicy -Effective -xml
26:50 - Looking at the Get-BadPasswords directory, finding an NTLM Hash
31:30 - Logging into the box via kerberos because NTLM is Disabled
38:40 - Using CrackMapExec's Spider_Plus module to enumerate all the files on the share
43:20 - Enumerating the Windows Firewall to discover only bginfo64 will be able to communicate out
47:00 - Creating a DLL to use with DLL Injection to 7zip
53:45 - Running a bunch of icacls commands with our DLL to identify permissions
57:00 - We have WriteOwner to BGInfo64.exe, which was allowed through the firewall. We can change the owner and then write our netcat on it!
1:09:00 - Shell returned as GinaWild, finding an encrypted pfx file in the Recycle Bin
1:15:30 - Cracking the PFX File with CrackPkcs12 to discover it is a code signing certificate
1:22:30 - Importing the code-signing certificate so we can sign powershell scripts letting us bypass applocker
1:26:50 - Telling the Get-BadPasswords program to run, and getting a shell as BPassRunner
1:27:30 - Identifying how Get-BadPasswords pulls the NTLM Hashes and then getting Administrators hash
1:29:50 - Using Impacket's GetTGT to get a ticket as administrator

[@WyldeZk]

Just passed OSCP. I wanted to thank you so much for the awesome work you’ve done in these years. Your weekly HTB video were key to my success. Thank you!

[@sefterm-zade9744]

Im happy for youuuuuuuuuuuuuuuuuuuuu.💪🏼💪🏼💪🏼💪🏼

[@TheSozeone]

I'm in the middle of doing mine, and tips? How hard are the exam boxes compared to these htb boxes?

[@WyldeZk]

@@sefterm-zade9744 I would say htb boxes are a good prep. Clearly oscp exam is more straight forward and less ctf then htb

[@benhays6488]

You mention that this box has a bunch of defense-in-depth techniques. I think that'd make a great video about configuring some of those techniques from both a blue team and red team perspective. As always tho, great video!

[@lonelyorphan9788]

Another amazing video 🙂 thanks ippsec!

[@SilentTrinity7]

Great video. Really learned a lot by watching. So thanks for this. A nice technical box.

[@ItsMeooooooo]

I miss the old times where you took notes at length

[@atthaphonrattanarueanphet1362]

Therei s one chef he actually loved all the food offered

[@JOJO-no8rb]

Thank you brother 😊😊

[@FMisi]

It is a miracle that I could root this box. Getting root privileges was a very-very happy moment. The other Insane machines seem even harder which is good for more practice

[@y.vinitsky6452]

I love this please do more windows boxs. Can do another video on how this box was hardened?

[@ryuzaky1395]

what kind of smbclient are you using? the versions i found dont have the parameter "-L" or "-k"

[@Zed0086]

The hacking community is the best community!!!

[@tg7943]

Push!

[@user-uk8ix8mp2c]

Heyy Ippsec great video to watch! I wanted to ask why didn't you use the administrator certificate for authentication via evil-winrm?

[@ippsec]

I believe I say Evil-WinRM would work. Really no reason, just showing different methods.

[@aminehero9948]

@@ippsec i finish htb modules and i cant do such things like some advices pleaase

[@axelschweiss7066]

When you know who Gina Wild was... ;-)

[@AP-rv6kk]

Hi Ippsec, thank you for the video. Can you do one on different types of certificates and how to convert one into another?

[@ippsec]

You can't really convert certificates -- What we did here was extract, pfx is like a zip of multiple certificates. You provision a certificate that has specific properties (Code Signing, User Authentication, etc). Then when the CA Signs it, there is no changing it.

[@sand3epyadav]

I miss ippsec always, spider plus is good

[@scall0p]

owo

[@pepega5560]

is he haxing?

[@sotecluxan4221]

[@h4gg497]

User web had SeAssignPrimaryTokenPrivilege so I think that can be leveraged the same way as SeImpersonate to impersonate tokens and get code exec as beatricemill. Also since we could write DLLs to the share, could we not just sideload/DLL proxy a DLL loaded by bginfo64.exe and skip all the 7-zip/changing permissions/overwriting bginfo64.exe stuff?