HackTheBox - Conceal

Share
IppSec
Published at : 13 Nov 2021
33062 views
465
6

01:15 - Begin of recon
02:54 - Checking SNMP with snmpwalk
03:29 - Discovering a Hashed PSK (MD5) in SNMPWalk, searching the internet for a decrypted value
04:18 - Getting more SNMP Information with snmp-check
07:35 - Going over UDP Ports discovered by snmp-check
10:55 - Running ike-scan
11:55 - Examining ike-scan results to build a IPSEC Config
13:50 - Installing Strongswan (IPSEC/VPN Program)
14:19 - Adding the PSK Found earlier to /etc/ipsec.secrets
15:30 - Begin configuring /etc/ipsec.conf
20:08 - Starting and debugging ipsec
21:55 - Explaining why we add TCP to strongswan config
24:00 - Starting IPSEC, then using NMAP through IPSEC.
(You may want to run WireShark here and see all traffic is encrypted thanks to ipsec)
25:55 - Enumerating SMB Quickly (SMBMap/cme)
26:50 - Enumerating FTP, discovering we can upload files
27:20 - Checking HTTP, hunting for our uploaded file. Then uploading files that may lead to code execution
29:44 - Grabbing an ASP Webshell from Github/tennc/webshell
32:08 - Webshell has been uploaded
32:30 - Explaining a weird MTU Issue you may run into due to the nested VPN’s
35:40 - Back to playing with the web shell, getting a reverse shell with Nishang
38:03 - Explaining RLWRAP
38:40 - whoami /all shows SEImpersonation, so we run JuicyPotato to privesc
44:35 - JuicyPotato fails with the default CLSID, changing it up to get it working.
46:30 - Doing the box again with Windows
47:15 - Setting up the IPSEC Connection through Windows Firewall
50:00 - Installing a DotNet C2 (The Covenant)
54:20 - Covenant/Elite open, starting a Listener then a Powershell Launcher
01:00:10 - Grunt activated. Running Seatbelt, then compiling Watson and reflectively running it
01:05:00 - Grabbing the Sandbox Escaper ALPC Privesc
01:08:03 - Being lazy and compiling a CPP Rev Shell in Linux because it wasn’t installed on Windows
(bunch of flailing, then reverting the machine)
01:25:35 - Box is reverted, trying the ALPC Exploit again

HackTheBoxConceal

Shortly - "Dancer" (Official Video)

Shortly - "Dancer" (Official Video)

HOW TO decorate in a BLACK COLOUR Palette | Our Top Interior Styling Tips

HOW TO decorate in a BLACK COLOUR Palette | Our Top Interior Styling Tips

ವಿಚ್ಛೇದನ..!! || It could also be a reason for DIVORCE ||

ವಿಚ್ಛೇದನ..!! || It could also be a reason for DIVORCE ||

10 Animals That Can Defeat A Lion - Lion VS Prey - Lion VS Predator - Askal

10 Animals That Can Defeat A Lion - Lion VS Prey - Lion VS Predator - Askal

Pink Sweat$ - At My Worst (Lyrics)

Pink Sweat$ - At My Worst (Lyrics)

"WE'RE RELYING ON ROOT TO SCORE A RIDICULOUS AMOUNT!" 🔥 Goughie previews England's Ashes chances!

"WE'RE RELYING ON ROOT TO SCORE A RIDICULOUS AMOUNT!" 🔥 Goughie previews England's Ashes chances!

От чего умирают россияне

От чего умирают россияне

Comparison: Living In A Maximum Security Prison

Comparison: Living In A Maximum Security Prison

The Evolution of Mike "The Situation" Sorrentino | Jersey Shore

The Evolution of Mike "The Situation" Sorrentino | Jersey Shore

99.5%  PEOPLE FAIL TO SPOT THE DIFFERENCE???

99.5% PEOPLE FAIL TO SPOT THE DIFFERENCE???

How to Get Your Render to Stay on the Wall - KB#8

How to Get Your Render to Stay on the Wall - KB#8

At least 800 year-old mummy found in Peru

At least 800 year-old mummy found in Peru

Pomegranates…May Help Prevent Many Breast Cancers! Dr. Mandell

Pomegranates…May Help Prevent Many Breast Cancers! Dr. Mandell

Woodworking Ideas Extremely Creative // Making A Rustic And Sturdy Table

Woodworking Ideas Extremely Creative // Making A Rustic And Sturdy Table

Monkey Ni holds a Lid bottle of milk and gives it to his father, very funny and smart

Monkey Ni holds a Lid bottle of milk and gives it to his father, very funny and smart

Queen "irritated" by lack of action on climate change ahead of COP26

Queen "irritated" by lack of action on climate change ahead of COP26

Why BRPM (Faze) could be the next big SPAC

Why BRPM (Faze) could be the next big SPAC

IELTS Writing task 2: Advantages and disadvantages essay

IELTS Writing task 2: Advantages and disadvantages essay

#178 Do You Want to Finally Be Free? How To Unravel From The Debt Slave System and Become Sovereign

#178 Do You Want to Finally Be Free? How To Unravel From The Debt Slave System and Become Sovereign

BOTH

BOTH

'He seemed nervous,' witness Koerri Washington testifies on Kyle Rittenhouse

'He seemed nervous,' witness Koerri Washington testifies on Kyle Rittenhouse

Courageous

Courageous

Jamie Woon - Shoulda

Jamie Woon - Shoulda

Surely but Slowly

Surely but Slowly

Nigel Farage: How many people in the British Muslim community have been radicalised?

Nigel Farage: How many people in the British Muslim community have been radicalised?

Britney Spears' conservatorship brought to an end

Britney Spears' conservatorship brought to an end

The Nexalin Device...The Hypothalamus...and How Nexalin Achieves It's Many Excellent Results

The Nexalin Device...The Hypothalamus...and How Nexalin Achieves It's Many Excellent Results

Sona Has A Bone To Pick With Conan | Conan O’Brien Needs a Friend

Sona Has A Bone To Pick With Conan | Conan O’Brien Needs a Friend

7 fairly uninteresting projects I've built

7 fairly uninteresting projects I've built

DESIRE - Best Motivational Video Speeches Compilation - Listen Every Day! MORNING MOTIVATION

DESIRE - Best Motivational Video Speeches Compilation - Listen Every Day! MORNING MOTIVATION

drunk you' may actually be the real you!

drunk you' may actually be the real you!

Rank Score 4300+ Pro Lobby Duo Vs Squad Ajjubhai and Munnabhai Op Gameplay - Garena Free Fire

Rank Score 4300+ Pro Lobby Duo Vs Squad Ajjubhai and Munnabhai Op Gameplay - Garena Free Fire

Tamino - Sun May Shine

Tamino - Sun May Shine

Je deviens UN VIP dans ROBLOX SQUID GAME

Je deviens UN VIP dans ROBLOX SQUID GAME

How Far I ACTUALLY Hit my Clubs | Range Session

How Far I ACTUALLY Hit my Clubs | Range Session

Spoke of soul

Spoke of soul

'We Need To Leave This Practice To Dictatorships': GOP Senator Assails Expanding Supreme Court

'We Need To Leave This Practice To Dictatorships': GOP Senator Assails Expanding Supreme Court

Rode Wireless Go II Review | Incredible Wireless Mic/Lavalier! ...But not quite Perfect

Rode Wireless Go II Review | Incredible Wireless Mic/Lavalier! ...But not quite Perfect

Alanis Morrissette - You Ought To Know   REACTION

Alanis Morrissette - You Ought To Know REACTION

What Does Predisposition Mean?

What Does Predisposition Mean?

Commercial Law - Sale of Goods: Introduction

Commercial Law - Sale of Goods: Introduction

Gunna & Future - Too Easy [Official Audio]

Gunna & Future - Too Easy [Official Audio]

GIORGIO ARMANI Fashion Music Playlist (1 Hour)

GIORGIO ARMANI Fashion Music Playlist (1 Hour)

Jankos, Sneaky and IWillDominate predict who’ll WIN WORLDS 2021??? | Pick ‘Em

Jankos, Sneaky and IWillDominate predict who’ll WIN WORLDS 2021??? | Pick ‘Em

FAMOUS YOUTUBER SCAMMED 2 RAINBOW HUGE CATS! $10000 DOLLARS SCAMMED? (Roblox Pet Simulator X)

FAMOUS YOUTUBER SCAMMED 2 RAINBOW HUGE CATS! $10000 DOLLARS SCAMMED? (Roblox Pet Simulator X)

Bubble of Pretend

Bubble of Pretend

Comment faire un barbecue américain

Comment faire un barbecue américain

I'm Here Even Though I Hate Myself

I'm Here Even Though I Hate Myself

Doing gacha trends/memes that I know Part 2

Doing gacha trends/memes that I know Part 2