HackTheBox - Sauna

00:00 - Intro
01:05 - Running Nmap
02:07 - Poking at SMB with CrackMapExec, SMBMap, and RPCClient to get nothing
04:15 - Checking out the web page
06:00 - Playing with user input in the website and getting an error "HTTP VERB used is not allowed"
08:20 - Copying names from the website
10:50 - Using some VIM/VI Magic (macro) to convert names into potential usernames
12:40 - Identifying valid usernames by using KerBrute which can enumerate valid usernames
16:00 - Running some Impacket scripts and performing an ASREP Roast to extract password hash from Active Directory
18:20 - Running GetNPUsers to get the hash for a user and then using hashcat to crack ASREP$23
20:50 - Seeing a RICOH printer share, pulling EXIF data off website to get an idea if it may be exploitable
23:10 - Using Evil-WinRM to log into the box with FSMITH and run WinPEAS to get saved credentials
29:00 - Running BloodHound
34:25 - Identifying that svc_loanmgr can perform a DCSYNC
35:40 - Running SecretsDump with svc_loanmgr to perform a DCSYNC
37:45 - Performing a Pass The Hash with the administrator user using PSExec

[ExploitSecurity]

Huge fan. I'm a Army veteran now in InfoSec and studying towards PenTesting. Watching your speed and efficiency is mesmerizing.

[yunietpiloto]

This channel is so underrated...damn, another awesome video man...keep the knowledge flowing :)

[yannickpeter]

That vim magic was sweet! Gonna give me wet dreams tonight

[patthetech]

hashcat + multiple nvidia + rockyou is a deadly combo.

[mustafaismail]

whenever I see how professionals like you use their tricks it motivates me but how to ever get that good with such all these information ?
that's the trick, BTW it was a piece of art how you solved this box

[AnlStarDestroyer]

Your walkthroughs have really helped me out. I’ve been trying to do more CTFs and I’ve yet to finish one without some form of a hint and I feel so dumb every time I watch you fly through these lol. Only way to learn is to fail though I suppose

[MichaelJohnson-brzz]

Really great to see how the pieces come together. Very interesting video to watch. Thank you IppSec

[satryamahardhika]

Always enjoy seeing Ippsec videos ! One of the most interesting part for me is the Vim Magic part! Its absolutely cool ! Also, this box is one of the AD 101 Path on HTB, good to prepare for new format of OSCP Exam (With AD machines Included)

[westernvibes]

GetNPUser does the asreproast thing, GetUserSPN is kerberoasting, it request service tickets for accounts(usually service accounts) that has SPN set. There's actually no good reason when to run the GetNPUser script cuz we usually don't have enough privilege before an initial foothold to see which users have "do not require Kerberos pre auth" option enabled ( this is not practical in real world as a sysadmin would never do it ) so in ctfs if you have a list of usernames and password spraying didn't work always give it a try and GetUserSPNs usually work with service accounts, it's more of a post Exploitation script.

[ethicalhackosa]

Amazing guide, thank you. Is there a specific reason psexec is used at the end to pass the hash for the administrator user? Can evil-winrm be used to perform the same thing? ie get shell access to the administrator user. Just trying to understand everything and the tools used for different use cases. Cheers !

[yusufanything]

hahahaha man that VIM magic was so good that I started laughing! Will I ever get this good?

[lazarvukasinovic]

When firefox detects a potential virus in a download you can simply right click on the file and select "Allow Download"

[Deaple]

Hey ippsec, you only use this kracken machine to CTFs like HTB or in real world pentests? Also, it's a GPU based machine in some cloud provider like amazon/GC/azure?

[dayton]

At this point I just added the impacket directory to the terminal's path since it's nice to just type the name of the python script without having to locate that path every time.

[omaroobaniessa]

I hope you're gonna reach 100k by the next week

[cxdva]

winpeas can't finds autologon anymore, i was stuck at privilege escalation part and watched this video.
Maybe i should also manuially check everything from now on...

[eebba]

another great video, great job
can you on next video in the end show how would you write report for that box? or make video about reporting for OSCP(what to put in, what dont put in, etc)?

[alexzander]

Are you doing this box without any prep-work?

[werdna_sir]

Frigging Kerbrute dumps the hash in a $18$ format that Hashcat can't handle.

[pauliehorgan]

This should be added to the oscp like boxes