HackTheBox - Conceal

Share this & earn $10
IppSec
Published at : 09 Nov 2021
32993 views
465
6

01:15 - Begin of recon
02:54 - Checking SNMP with snmpwalk
03:29 - Discovering a Hashed PSK (MD5) in SNMPWalk, searching the internet for a decrypted value
04:18 - Getting more SNMP Information with snmp-check
07:35 - Going over UDP Ports discovered by snmp-check
10:55 - Running ike-scan
11:55 - Examining ike-scan results to build a IPSEC Config
13:50 - Installing Strongswan (IPSEC/VPN Program)
14:19 - Adding the PSK Found earlier to /etc/ipsec.secrets
15:30 - Begin configuring /etc/ipsec.conf
20:08 - Starting and debugging ipsec
21:55 - Explaining why we add TCP to strongswan config
24:00 - Starting IPSEC, then using NMAP through IPSEC.
(You may want to run WireShark here and see all traffic is encrypted thanks to ipsec)
25:55 - Enumerating SMB Quickly (SMBMap/cme)
26:50 - Enumerating FTP, discovering we can upload files
27:20 - Checking HTTP, hunting for our uploaded file. Then uploading files that may lead to code execution
29:44 - Grabbing an ASP Webshell from Github/tennc/webshell
32:08 - Webshell has been uploaded
32:30 - Explaining a weird MTU Issue you may run into due to the nested VPN’s
35:40 - Back to playing with the web shell, getting a reverse shell with Nishang
38:03 - Explaining RLWRAP
38:40 - whoami /all shows SEImpersonation, so we run JuicyPotato to privesc
44:35 - JuicyPotato fails with the default CLSID, changing it up to get it working.
46:30 - Doing the box again with Windows
47:15 - Setting up the IPSEC Connection through Windows Firewall
50:00 - Installing a DotNet C2 (The Covenant)
54:20 - Covenant/Elite open, starting a Listener then a Powershell Launcher
01:00:10 - Grunt activated. Running Seatbelt, then compiling Watson and reflectively running it
01:05:00 - Grabbing the Sandbox Escaper ALPC Privesc
01:08:03 - Being lazy and compiling a CPP Rev Shell in Linux because it wasn’t installed on Windows
(bunch of flailing, then reverting the machine)
01:25:35 - Box is reverted, trying the ALPC Exploit again

HackTheBoxConceal

What is Canopy University?

What is Canopy University?

Have I Got a Bit More News for You S61 E3. Victoria Coren Mitchell, Josh Widdicombe, Emma Dabiri

Have I Got a Bit More News for You S61 E3. Victoria Coren Mitchell, Josh Widdicombe, Emma Dabiri

KEEP 10 FRAGRANCES FOR LIFE 2021 💥 TOP 10 MENS DESIGNER FRAGRANCES 💥COMPLIMENT GETTERS

KEEP 10 FRAGRANCES FOR LIFE 2021 💥 TOP 10 MENS DESIGNER FRAGRANCES 💥COMPLIMENT GETTERS

Rambutan - Some Thing

Rambutan - Some Thing

|| Importance of Mantras in attaining Turiya State Or Meditative State ! ||

|| Importance of Mantras in attaining Turiya State Or Meditative State ! ||

ADOPTED Girl Meets her Birth Mom for First Time. Surprise Ending. Totally Studios

ADOPTED Girl Meets her Birth Mom for First Time. Surprise Ending. Totally Studios

I HATE THIS STUPID GAME.. | Stick With It | Fan Choice Friday

I HATE THIS STUPID GAME.. | Stick With It | Fan Choice Friday

Box Car Racer - There Is (Official Video)

Box Car Racer - There Is (Official Video)

How to define words

How to define words

THE SONIC POPSICLE IS HORRIFYING

THE SONIC POPSICLE IS HORRIFYING

Capability Brown - BBC Documentary 2016

Capability Brown - BBC Documentary 2016

What Do We Have? (The Monster Song) | Kids Songs | BINGOBONGO Learning

What Do We Have? (The Monster Song) | Kids Songs | BINGOBONGO Learning

Dominic Fike - Come Here (Official Audio)

Dominic Fike - Come Here (Official Audio)

How to draw the variation of tanglepattern Leaflet

How to draw the variation of tanglepattern Leaflet

Observing Young Children

Observing Young Children

Joy Division - Decades (Official Lyric Video)

Joy Division - Decades (Official Lyric Video)

Problems on Ages _ LESSON #1(Intro+Basic Questions)

Problems on Ages _ LESSON #1(Intro+Basic Questions)

Knights And Merchants Soundtrack   In The Marketplace

Knights And Merchants Soundtrack In The Marketplace

Bence Nanay (Antwerp & Cambridge) - “There is No Such Thing as Imagination”

Bence Nanay (Antwerp & Cambridge) - “There is No Such Thing as Imagination”

The simple reason you're always tired

The simple reason you're always tired

Average Credit Score By State....

Average Credit Score By State....

CNN's Chris Cuomo RESIGNING After More Washington Post and New York Times Articles Publicize Misdeed

CNN's Chris Cuomo RESIGNING After More Washington Post and New York Times Articles Publicize Misdeed

Sol Invicto - A Reason For Being [2020 SINGLE HD]

Sol Invicto - A Reason For Being [2020 SINGLE HD]

TSUZUKI INU HIDDEN ADVANTAGE! COPYRIGHT ISSUES! GET INFORMED!

TSUZUKI INU HIDDEN ADVANTAGE! COPYRIGHT ISSUES! GET INFORMED!

Eleni Foureira - Light It Up - Official Music Video

Eleni Foureira - Light It Up - Official Music Video

How to Study, Improve Memory, and Retain Information

How to Study, Improve Memory, and Retain Information

Chorus - Gameplay Preview [4K]

Chorus - Gameplay Preview [4K]

Legado Del Fantasma is the total package: WWE Digital Exclusive, Nov. 2, 2021

Legado Del Fantasma is the total package: WWE Digital Exclusive, Nov. 2, 2021

BEYOND THE TIME ~Over the Moebius skies~

BEYOND THE TIME ~Over the Moebius skies~

🔵 Perchance - Posh English - Perchance Meaning - Perchance Examples - Perchance Definition

🔵 Perchance - Posh English - Perchance Meaning - Perchance Examples - Perchance Definition

Nastya copies dad all day

Nastya copies dad all day

HR Basics: Selection

HR Basics: Selection

Linkin Park - In The End (Live from Red Square)

Linkin Park - In The End (Live from Red Square)

Company Broadway revival starring Raul Esparza Great Performances 2006

Company Broadway revival starring Raul Esparza Great Performances 2006

You Can Count by 1's to 150 | Jack Hartmann

You Can Count by 1's to 150 | Jack Hartmann

John Legend - Preach (Official Video)

John Legend - Preach (Official Video)

TRIMMING OF EXTREMELY THICK RAM’S HORN TOENAILS ***NOT CLICK BAIT***

TRIMMING OF EXTREMELY THICK RAM’S HORN TOENAILS ***NOT CLICK BAIT***

Why is the US Constitution so hard to amend? - Peter Paccone

Why is the US Constitution so hard to amend? - Peter Paccone

1. Introduction, Financial Terms and Concepts

1. Introduction, Financial Terms and Concepts

The Binds - Use Somebody (Kings of Leon Cover) LIVE @ The Black Swan

The Binds - Use Somebody (Kings of Leon Cover) LIVE @ The Black Swan

MY DAD IS BACK - Plodding away and making investments for the future

MY DAD IS BACK - Plodding away and making investments for the future

Pink Panther On A Comic Adventure | 35 Minute Compilation | Pink Panther & Pals

Pink Panther On A Comic Adventure | 35 Minute Compilation | Pink Panther & Pals

Sean Paul - When It Comes To You

Sean Paul - When It Comes To You

MMPRO ALT COIN GEM - IEO LISTING SOON - THIS COULD EXPLODE!

MMPRO ALT COIN GEM - IEO LISTING SOON - THIS COULD EXPLODE!

Immediate implant placement & Immediate restoration

Immediate implant placement & Immediate restoration

Top 10 Ways for Introverts to Avoid People, Ranked

Top 10 Ways for Introverts to Avoid People, Ranked

Seashore

Seashore

Let's imagine...: Eugene Trivizas at TEDxAthens 2013

Let's imagine...: Eugene Trivizas at TEDxAthens 2013

G-Eazy - Well-Known ft. KAM Royal

G-Eazy - Well-Known ft. KAM Royal