HackTheBox - Resolute

00:00 - Intro 01:08 - Talking about my switch to Parrot 02:00 - Begin of nmap, discovering it is likely a Windows Domain Controller 04:30 - Checking if there are any open file shares 06:11 - Using RPCClient to enumerate domain users (enumdomusers) 07:55 - Using CrackMapExec to dump the PasswordPolicy 08:45 - Using RPCClient to dump Active Directory information (querydispinfo) 10:45 - Bruteforcing accounts via CrackMapExec with password of Welcome123! 14:30 - Using Evil-WinRM to remote into the server as Melanie 15:40 - Building the latest version of Seatbelt on CommandoVM (The DotNet version is incompatible) 17:40 - Explaining some cool bash one line tricks, then linking Egypt's "One liners to rule them all" talk 24:40 - Changing Seatbelt to compile to Version 4.0 then trying again. 26:30 - Finally examining the Seatbelt output, see the PSTranscript Directory and a Custom group in DNSAdmins 29:50 - Using RPCClient to Enumerate members of the Contractors group (enumdomgroups/querygroupmem) 35:30 - Running WinPEAS to compare the differences 38:30 - Exploring hidden directories to see PSTranscripts, then finding credentials in a powershell log 44:20 - Using Evil-WinRM with the password from a PSTranscript File to get shell as Ryan 45:40 - Quickly going over how to execute code on a Domain Controller as a DNS Admin 46:10 - Using MSFVenom to create a Reverse Shell DLL (we'll do this better at end of the video) 49:10 - Using DNSCMD to have the DNS Server execute our MSFVenom created DLL from a SMB Network Path... Works but hangs the DNS Server 52:50 - Using the DNS-EXE-Persistance to help us create a better to do the Reverse Shell 53:03 - Explaining the DNSCMD Exploit path on how it can be used both foor lateral movement and privesc 54:50 - Start of creating the DLL to use with this DNS Exploit 56:45 - Grabbing a C++ Reverse Shell program from github to add to our DNS Exploit Project, then modify it to execute as a thread 01:02:20 - Showing that we get a Reverse shell and DNS Keeps running 01:03:52 - Removing the "CreateThread" portion of our code to show that was needed, without CreateThread the DNS Server hangs because it stops on the RevShell code