HackTheBox | Scrambled [OSCP Style] (TWITCH LIVE)

Storyline / Setting

This walkthrough follows the Hack The Box machine “Scrambled”, focusing on Active Directory (AD) exploitation centered on Kerberos.

The “story” follows a typical intrusion chain:

1. Discover the target and its open services.
2. Identify it as an AD Domain Controller (DC) (e.g., scrm.local / dc1.scrm.local).
3. Attempt authentication/enumeration, then escalate by abusing Kerberos attack paths—including Kerberoasting-style handling of TGS tickets and the Silver Ticket concept.
4. Gain code execution and pivot toward the real compromise of internal services.
5. Perform further privilege escalation to SYSTEM, then finally collect flags (user/system and more).

Gameplay / Gameplay Highlights (What the Host Demonstrates)

1) Setup & Initial Machine Recon

• Creates working folders (e.g., nmap/, exploits/).
• Runs ping to confirm the host is responsive.
• Uses TTL heuristics to guess the OS class (Windows vs Linux-ish expectations).
• Runs nmap primarily for TCP discovery, emphasizing speed/stealth:
  • Avoids DNS resolution during fast scanning to reduce delays.
  • Exports results in grepable format for easier later parsing/filtering.

2) Service Identification & AD Recognition

• Notes key open ports such as:
  • HTTP (80)
  • LDAP/AD-related ports (e.g., 389)
  • WinRM/SMB-ish services, etc.
• Confirms likely DC presence by recognizing domain naming patterns and hostnames (examples mentioned: dc1, scrm.local).
• Suggests adding discovered names to the hosts file for stable resolution during attacks.

3) Kerberos-Focused Attack Logic

• Explains core Kerberos entities and flows using diagrams:
  • TGT (Ticket Granting Ticket)
  • TGS (Ticket Granting Service)
  • KDC / DC (domain controller)
  • AP / application service
• Mentions classic AD Kerberos attack families:
  • Kerberoasting (abusing SPNs/TGS to crack tickets offline)
  • Golden Ticket (forging a TGT)
  • Silver Ticket (forging a TGS for a specific service without contacting the DC, if inputs are correct)

4) Tooling and Practical Kerberos Enumeration

• Uses/mentions Kerberos enumeration and brute-force style tooling (e.g., Kerberforce / kerbutils-type workflow):
  • Enumerate valid users using Kerberos error/behavior differences.
  • Use username patterns/dictionaries aligned with common AD naming conventions (e.g., firstname.lastname and variations).
• Attempts to request artifacts like TGT / SPNs, but notes environment limitations.

5) The Major Kerberos/Service Abuse Attempt: Silver Ticket Direction

• Identifies a service account context around SQL service:
  • Mentions repeated references to sqlsvc and Microsoft SQL / MSSQL service.
• Retrieves enough service identity context to discuss forging a TGS.
  • Requires key material such as the service NT hash and the service principal name (SPN).
• Uses this to craft a Silver Ticket to impersonate high-privilege access to that service.

6) Code Execution / Interaction with the Service and Extraction

• Attempts to interact with MSSQL using the obtained capability.
• Describes connection attempts that can fail due to authentication mode mismatch.
• Explains that some methods fail when NTLM is disabled in the environment:
  • Kerberos must be preferred.
  • Certain SMB/auth approaches (e.g., null sessions / listing) may fail.

7) Pivot / Transport: Windows-Side Analysis

• Downloads and analyzes Windows .NET application components (references include):
  • scrambled...exe
  • scrambled...dll
• Uses a decompiler/analysis flow (e.g., DnSpy-like workflow) to inspect logic:
  • Finds hints around login checks / “special account” behavior.
  • Detects serialization/deserialization-related code paths that can lead to RCE if sanitization is insufficient.

8) Insecure Deserialization Exploitation (Application-Layer RCE)

• Builds an attack plan around sending serialized data:
  • Data is base64-wrapped.
  • Mentions BinaryFormatter-style gadget chains (including gadget selection like WindowsIdentity).
• Delivers a payload that triggers command execution back to the attacker via a reverse shell (netcat style).
• Successfully transitions from service access to a SYSTEM-level compromise path.

9) Privilege Escalation to SYSTEM (Windows Local Escalation)

• Uses a Juicy Potato-style exploitation approach:
  • Mentions alternatives in the “potato” family and notes handling Windows Server version quirks.
• Demonstrates both:
  • Unintentional-style narrative (typical misconfiguration + service token abuse)
  • Intentional-style narrative (more tailored path with a Windows 10 component and specific method packaging)
• Uses the resulting SYSTEM token to read flags in user/system directories.

10) Additional AD/SQL Post-Exploitation

• Uses SQL querying to enumerate and locate sensitive data:
  • Lists databases/tables.
  • Queries for a table that may contain credential-like fields (e.g., user/password-style entries).
• Demonstrates a PowerShell “credential creation + command execution” method within the AD context:
  • Creates a credential from stored values.
  • Uses Invoke-Command / scriptblocks to run commands as another user (pivoting).

Key Strategies / Tips Highlighted

• Export evidence formats: save nmap results in grepable form for faster review of port/state.
• Kerberos-first thinking:
  • If NTLM is disabled, expect SMB/auth approaches relying on NTLM to fail.
  • Prefer Kerberos flows and SPN-related enumeration.
• Don’t brute blindly:
  • Use AD naming conventions.
  • Validate targets using Kerberos error-based distinctions.
• Silver Ticket concept:
  • Know the needed inputs: SPN, domain/KDC identifiers, and service key material.
  • A correctly crafted Silver Ticket can avoid some DC validation steps.
• Application exploitation:
  • If you see BinaryFormatter-style serialization, look for:
    • Gadget chains
    • Sanitization gaps
    • How the service expects base64/serialized payloads
• Windows privilege escalation:
  • “Potato” escalation depends heavily on target OS/build; alternate logic (e.g., cl6-type variants) may be required.

Gamers / Sources Featured (Named at the End of the Subtitles)

• Chema Alonso (mentioned in chat context)
• Daniel Miessler (referenced for tooling/approach)
• Odin XD (supporter/sub mention)
• George (trusted moderator/moderator mentioned as “trusted George” in the stream)
• Andrew (Prime subscription mention)
• Felipe (credited/mentioned in chat)
• Tito (the streamer/host repeatedly addressed by name)
• BBVA (mentioned in discussion about COBOL usage)
• Harry Potter (mandrakes referenced; not a source for the game)
• “Hack The Box” / “Hackboxing” (platform name referenced throughout)

Note: Subtitles appear heavily auto-generated, so some names/sources may be partially garbled, but the items above are explicitly identifiable in the text.