Video summary

HackTheBox | Jab [OSCP Style] (TWITCH LIVE)

Main summary

Key takeaways

Technology

Video topic

A live, OSCP-style penetration test walkthrough of a Hack The Box Windows Active Directory machine (“Japanese” DC), medium difficulty. The walkthrough focuses heavily on Active Directory reconnaissance and Kerberos/SMB/LDAP attacks, then escalates to full compromise.

Key technical concepts, commands, and attack path (in order)

1) Initial recon & fingerprinting

  • Uses ping-like checks and TTL analysis to infer target OS:
    • Notes typical Windows TTL ≈ 128 and Linux TTL ≈ 64, but warns these values can be manipulated and shouldn’t be trusted blindly.
    • Mentions Hack The Box behavior can cause hop counts to show a consistent “one less” pattern.
  • Performs Nmap host/port discovery:
    • Intent: full TCP scan (up to 65,535 ports), but presented in a “list only open ports” style (--open-like behavior).
    • Uses a faster “stealth” scanning approach:
      • Contrasts TCP connect scan vs stealth scanning (less fully completed handshakes to reduce logging/visibility).
    • Tunes performance (e.g., --min-rate around 5000 packets/sec).
    • Exports results for later processing:
      • “grepable” output, and XML for conversion into HTML using xsltproc.

2) Identify AD role and relevant services

  • Open ports strongly suggest an Active Directory Domain Controller, including:
    • Kerberos (88)
    • DNS/LDAP-related ports (53/389)
    • SMB + WinRM (445 / 5985) (and other supporting services)
  • Concludes it’s a DC and plans exploitation around common AD attack paths.

3) Port data processing & workflow automation

  • Uses helper scripts/functions (custom shell utilities) to:
    • Parse Nmap “grepable” output and present copied/open-port lists
    • Run Nmap Lua NSE scripts for targeted recon (described as an sc approach)
    • Convert XML to HTML using XSLT for readable reporting

Active Directory exploitation plan

4) Hypotheses driven by service exposure

Based on the port/service list, the plan branches into common AD attack types:

  • Kerberos user enumeration → AS-REP roasting
  • SMB enumeration
    • Machine name/domain
    • Null/anonymous session attempts
  • RPC/LDAP enumeration possibilities (if access permits)
  • Ticket-based attacks
    • AS-REP roasting / Kerberoasting depending on conditions

5) SMB reconnaissance with CrackMapExec

  • Uses crackmapexec smb:
    • Determines machine name and domain
    • Recommends adding entries to /etc/hosts for consistent name resolution
  • Attempts SMB/null/anonymous session:
    • May enumerate or list shares/resources, but concludes credentials are likely required for richer enumeration.
  • Uses an RPC client–style null session to test whether domain user enumeration is possible without credentials, noting that misconfigured DCs can sometimes allow this.

Kerberos user enumeration & AS-REP roasting (major win)

6) KerberosRoasting setup using Kerbrute (user enum + AS-REP roast)

  • Uses Kerbrute for Kerberos-related enumeration:
    • User enumeration using dictionaries (from SecLists)
    • Then AS-REP roasting attempts:
      • Identifies accounts that do NOT require pre-authentication, enabling AS-REP roasting to obtain crackable hashes
  • Notes scale:
    • The domain has ~thousands of users, making brute force time-consuming.

7) Alternative enumeration strategy via Jabber/XMPP (Pidgin)

Because full brute force is too heavy, the walkthrough pivots to XMPP/Jabber:

  • Finds XMPP-related ports and uses Pidgin as the XMPP client.
  • Attempts XMPP account creation/registration (described as possible).
  • Uses an XMPP feature (“Search users” with wildcard/asterisk queries) that effectively performs directory queries (likely LDAP-backed):
    • Retrieves a list of users (emails/names).
  • Converts results into usable lists (filters/regex processing) to feed roasting workflows.

8) Successful AS-REP roasting

  • Runs roasting logic until it finds users whose hashes can be exported.
  • Extracts ticket-hash material; Hashcat is used:
    • Hashcat auto-detects mode and identifies Kerberos 5 mode (18200).
  • Cracks at least one password:
    • Example credential (from subtitles): J Montgomery / Midnight 121
  • Validates the password and checks capabilities:
    • Not sufficient for WinRM or membership in the “Remote Management Users” group.

Pivot into Openfire service + AD privilege escalation (second major win)

9) Discover an internal management web service (Openfire)

  • Finds SMB-readable areas and GPO-ish files (later deemed not very useful).
  • Uses obtained credentials to confirm interaction with an Openfire service.

10) Use a tunnel/proxy to reach “localhost-only” service

  • Observes Openfire admin console listens on a local-only port (9090) that wasn’t externally visible during Nmap.
  • Uses Chisel for reverse port forwarding:
    • Server runs on the attacker machine
    • Client runs on the compromised host
    • Exposes remote localhost:9090 to the attacker machine

11) Openfire exploit selection

  • Connects to the Openfire admin console (attempting known/default credential paths).
  • Identifies Openfire version 4.7.5 as outdated.
  • Finds/uses a vulnerable pattern in the issue space:
    • Subtitles discuss authentication bypass vs path traversal leading to RCE (same CV family warning).
  • Executes a known exploit workflow:
    • Uploads/installs a malicious Openfire plugin
    • Uses the admin console to run commands / obtain a reverse PowerShell shell
    • Achieves NT AUTHORITY\SYSTEM

Final goal: capture flags / confirm full compromise

  • From the SYSTEM shell, enumerates the filesystem (including Program Files / Openfire folders).
  • Uses reverse PowerShell payload delivery:
    • Mentions Base64 encoding and Windows UTF-16LE handling.
  • Successfully escalates to SYSTEM, retrieves the final flag(s), and concludes the machine is solved.

Main speakers / sources

  • Main speaker: the streamer/teacher running the HTB live solve (references being live on Twitch; uses tools like Nmap, Kerbrute, CrackMapExec, Impacket, BloodHound/BloodHound Python, Hashcat, Chisel).
  • Tool authors / sources mentioned:
    • Daniel Mese(l)er / SecLists (enumeration dictionaries)
    • Hashcat (password cracking)
    • Impacket (Kerberos/LDAP/SMB tooling mentioned)
    • BloodHound / Neo4j ecosystem
    • Pidgin (XMPP/Jabber client)
    • Chisel (pivoting/port forwarding)
    • SharpHound/BloodHound (AD relationship discovery)

Original video