HackTheBox - Scrambled - Attacking a Windows box with NTLM Disabled, MSSQL, and JuicyPotatoNG

00:00 - Intro 01:00 - Start of nmap 04:00 - Viewing the website and discovering kerberos is disabled 07:45 - Using Kerbrute to enumerate valid users and then password spray with username 10:15 - Bad analogy comparing Kerberos works with TGT/TGS and Movie Theater Tickets 11:00 - Using Impacket’s GetTGT Script to get Ticket Granting Ticket as Ksimpson and exporting KRB5CCNAME so Impacket uses it 12:30 - Using GetUserSPN to Kerberoast the DC with Kerberos Authentication and cracking to get SqlSVC’s Password 16:40 - Both credentials we have cannot access MSSQL 18:15 - Creating a silver ticket to gain access to SQL 19:50 - Using GetPAC to get a Domain SID 20:30 - Showing getting Domain SID with LDAPSearch 24:00 - Creating the Silver Ticket with Impacket’s Ticketer 26:30 - Showing Impacket creates the ticket with 10 years instead of 10 hours 27:40 - We now have MSSQL Access to the box, enabling xp_cmdshell and getting a reverse shell 30:00 - Using JuicyPotatoNG