HackTheBox - Absolute

00:00 - Intro 01:00 - Start of nmap discovering Active Directory (AD) 04:15 - Using wget to mirror the website, then a find command with exec to run exiftool and extract all user names in metadata 06:45 - Using Username Anarchy to build a wordlist of users from our dump and then Kerbrute to enumerate valid ones 13:55 - Building Kerbrute from source to get the latest feature of auto ASREP Roasting 16:20 - Kerbrute pulled the wrong type of hash, using the downgrade to pull etype 18 of the hash 21:30 - Running Bloodhound with , using Kerberos authentication 24:50 - Going over the bloodhound data and finding some attack paths 31:13 - Manually parsing the Bloodhound with JQ to show descriptions for all users and finding the SVC_SMB password in the Description 34:45 - EDIT: Don’t want to use Blodhound? Showing LdapSearch with Kerberos, and why the FQDN has to be first in the /etc/hosts file 40:30 - End of edit: Using SMBClient with SVC_SMB and Kerberos to download files 46