HackTheBox - FormulaX @ippsec

Uploaded August 2024 | Updated September 2026, 2 weeks ago

00:00 - Introduction
01:00 - Start of nmap
04:30 - Examining the Change Password functionality
06:20 - Discovering XSS In the Contact Form
11:15 - Building an XSS Cradle that manipulates the DOM to load an external JS file
18:35 - Creating an XSS that will send interact with the webchat and exfil messages back to us
26:30 - Discovering a new subdomain from the Online Chat
30:15 - Showing why we could not use Script SRC with our XSS Attack and why we used the DOM Technique
37:34 - Looking at the Git Auto Report Generating and discovering it uses simple-git v3.14 which has an RCE Vulnerability
44:40 - Shell on the box, dumping the mongo database
52:00 - Shell as Frank_Dorky
52:30 - Looking at the services running on the box to enumerate what each port is
55:30 - Showing bad permissions on the LibreNMS Directory which allows us to read and execute files in /opt/librenms
59:30 - Using the Templates in LibreNMS to get code execution
01:04:00 - Showing the intended way to exploit LibreNMS which is using a malicious SNMP Trap to attack an admin via XSS
1:17:30 - Exploiting the OpenOffice network port

Analyzing Event Logs and MFT Dump with Chainsaw - HTB Sherlocks - CrownJewel-1

Automating Boolean SQL Injection and Evading Filters

$HackTheBox - Rebound 00:00 - Introduction 01:07 - Start of nmap then checking SMB Shares 04:05 - Using NetExec to do a RID Brute Force and increase the maximum to 10000 07:00 - Using vim g!/{string}/d to delete all lines that do not contain something to build wordlists 10:40 - Using ASREP Roasting to perform a Kerberoast attack without authentication 17:40 - Using NetExec to run Bloodhound as ldap_monitor 25:30 - Discovering Oorend can add themself to the ServiceMgmt group, which can take over the WinRM Account 28:30 - Spraying the password of the ldap_monitor account to discover it shares oorends password 34:20 - Showing BloodyAD to add Oorend to ServiceMGMT then abusing the GenericAll to Service Users, so we can reset WinRM_SVCs password 40:30 - Showing a more opsec friendly way to take over WINRM_SVC by abusing shadow credentials so we dont change the accounts password 50:00 - As WINRM_SVC we cannot run some commands like qwinsta or tasklist. Using RunasCS, to switch our login to a non-remote login which will let us run these commands 54:10 - Performing a Cross Session attack with Remote Potato to steal the NTLMv2 Hash of another user logged into the same box we are 59:20 - Using NetExec to read GMSA Passwords as TBRADY 1:04:00 - Using findDelagation.py to show constrained delegation from the GMSA delegator account 1:11:20 - Using RBCD.py to setup the Resource-Based Constrained Delegation so we can get a forwardable ticket to abuse delegators delegation and impersonate users 1:18:20 - Using our ticket that impersonates DC01 and performing secretsdump and then getting Adminsitrators hash so we can login$