HackTheBox - Ypuffy

Want the WireShark Sticker? http://weirdstuffis.online

01:30 - Begin of Recon
02:25 - Enumerating OpenBSD Patch Date via SSH Version
04:00 - Examining port 80... Use Wireshark to see why NMAP gets a response but firefox does not
06:30 - Invalid Requests, will cause HTTP Service to send error message
07:00 - Using ldapsearch to enumerate ldap, use wireshark to see how the nmap script works
21:30 - Using SMBMap to PassTheHash and enumerate fileshares and download Putty Key
23:20 - Using PuttyGen to convert Putty Key to an RSA Key
24:55 - Testing out ssh_enumusers to see if that would have worked to get valid usernames
26:30 - Logged in as Alice, use LinEnum
28:40 - Examining doas configuration (like Sudo -l)
30:00 - Examining HTTPD Configuration to see why we couldn't hit the webserver earlier
32:30 - Examining SSHD Configuration to see SSH is configured to allow CA Signed Keys
34:40 - Getting hashes from SSH Keys to know what publics go to which privates
37:00 - Playing with the SSHAUTH webservice to enumerate what principals go to which users
41:45 - Signing a SSH Key using DoAs to sign a key with the root Principal
45:30 - Testing the key, explaining how this all works
47:30 - Unintended privesc, Xorg exploit