Baneador

Baneador

Pentester, CTF player and more

Posts by Tag

password spray

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

kerberoasting

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

keccak

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

sqli

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

winrm

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

powerview

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

vs code

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

chisel

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

server operators

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

backup operators

Multimaster - Hack The Box

 

Multimaster was a challenging Windows machine that starts with an SQL injection so we can get a list of hashes. The box author threw a little curve ball here and it took me a while to figure that the hash type was Keccak-384, and not SHA-384. After successfully spraying the cracked password, we exploit a local command execution vulnerability in VS Code, then find a password in a DLL file, perform a targeted Kerberoasting attack and finally use our Server Operators group membership to get the flag.

Back to Top ↑

llave ssh

Back to Top ↑

github

Back to Top ↑

ftp

Devel - Hack The Box

 

Devel es una maquina windows que se explota mediante un servicio FTP que tiene subida arbitraria de archivos, por medio de esta debilidad, se logra establecer una conexión al equipo victima y ejecutar comandos, luego se logra escalar privilegios por medio de un exploit conocido basado en la versión del sistema operativo.

Back to Top ↑

windows

Devel - Hack The Box

 

Devel es una maquina windows que se explota mediante un servicio FTP que tiene subida arbitraria de archivos, por medio de esta debilidad, se logra establecer una conexión al equipo victima y ejecutar comandos, luego se logra escalar privilegios por medio de un exploit conocido basado en la versión del sistema operativo.

Back to Top ↑

arbitrary file upload

Devel - Hack The Box

 

Devel es una maquina windows que se explota mediante un servicio FTP que tiene subida arbitraria de archivos, por medio de esta debilidad, se logra establecer una conexión al equipo victima y ejecutar comandos, luego se logra escalar privilegios por medio de un exploit conocido basado en la versión del sistema operativo.

Back to Top ↑