Escape HackTheBox (Unintended Method)

0:00 introduction
1:26 Looking at nmap results
2:30 Enumerate msrpc with enum4linux
3:04 enumerate ldap with ldapsearch
4:28 Enumerate SMB using crackmapexec
6:30 using spider_plus to spider SMB share
7:55 using impacket-smbclient to access SMB and download PDF
9:15 Analyzing PDF file and getting some username and credentials
10:20 Using kerbrute to enumerate valid usernames
14:34 Getting MSSQL credentials from PDF
15:28 Using impacket-mssqlclient to login to MSSQL
17:31 using xp_dirtree to leak NetNTLMv2 hash for service account
18:46 cracking the hash with john the ripper
19:55 Logging into MSSQL using sql_svc account
22:15 Using impacket-ticketer to craft a sliver ticker for administrator user
28:31 debugging kerberros authentication
37:28 logging into mssql with crafted silver ticker
38:20 enable xp_cmdshell and getting RCE
38:54 Setting up sliver c2
42:05 generating a sliver beacon
45:54 getting a shell as sql_svc
47:38 Downloading godpotato
51:12 Using execute-assembly to load and execute godpotato
52:26 getting a system shell

[vjxi]

That spider thing on cme is completely new to me..great video as always 💯