Description
00:00 - Introduction
00:45 - Start of nmap
02:20 - Taking a look at the page, manually decoding the Flask Cookie
06:15 - Running NetExec with MSSQL Priv module which lets us know we can impersonate, switching to mssqlclient
09:30 - Impersonating appdev, which can read the financial_planner table
12:25 - Converting the PBKDF2 hash to the Django format so we can try to crack it
16:20 - Using NXC to run RID BRUTE through MSSQL and get other users to spray the password with
20:50 - Using Evil-WinRM to access the box as Adam.Scott then poke at the webserver files, nothing here
22:45 - Getting the Windows Patch Level, noticing windows 2025 and searching exploits to find BadSuccessor
30:00 - Setting up Chisel so we can tunnel back to our box to run the badsuccessor module with nxc
32:50 - Looking at NXC Issues to see the support for BadSuccessor is still a PR, installing the special branch with uv
39:15 - Setting our system time to the time on the webserver based upon the Date Header from Curl
40:15 - Running BadSuccessor getting the NTLM hash of administrator and using psexec to get on the box