Uploads from IppSec

Currently Playing: HackTheBox - Tombwatcher

00:00 - Introduction 00:45 - Start of nmap 03:50 - Running RustHound with the credentials we were given 06:40 - Clicking outbound control a few times from Henry to see an obvious (but long) attack path 09:30 - Using BloodyAD to perform the Targeted Kerberoast attack 13:20 - Using BloodyAD to add ourself to a group then NetExec to reaed GMSA Passwords 15:50 - Using BloodyAD to change the password of a user and then use Certipy to create a Shadow Credential for the next user 19:30 - Looking at certificates in Bloodhound and Certipy to see one certificate has a SID under Enrollers 21:30 - Using powershell to show and restore deleted objects 25:15 - Running Certipy with Cert_Admin to see it is vulnerable to ESC15 32:55 - Performing ESC15 by generating a certificate with Certificate Request Agent property, which then lets us generate an administrator certificate to get root 35:20 - Beyond Root: Fixing the CA_MD_TOO_WEAK error by creating a new OpenSSL Config and not using UV to run certipy