xct
xct
  • 99
  • 297 102
VL Mythical - Mythic C2, ADCS, Domain Trust & MSSQL
[ Timestamps ]
00:00 - Intro
[ Blog Post ]
• vuln.dev/vulnlab-mythical/
[ Pentesting & Red Teaming Labs ]
• vulnlab.com
[ Discord ]
• discord.gg/vulnlab
[ Desktop ]
• github.com/xct/kali-clean
• www.yuumeiart.com/
[ About ]
• vuln.dev
xct_de
• github.com/xct
This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
Переглядів: 1 214

Відео

Vulnlab | Ifrit - Intro, Initial Access & Enumeration
Переглядів 3,6 тис.4 місяці тому
[ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
Vulnlab | Klendathu - Auth Coercion, Mixed Kerberos Stacks & Domain Backup Keys // by snowscan
Переглядів 3,8 тис.6 місяців тому
[ Timestamps ] 00:00 - Intro [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • x.com/snowscan • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environments that allow and encourage offensiv...
Vulnlab | Kaiju Part II - KeePass Plugins & ESC8 with Port Bending // by r0BIT
Переглядів 2,4 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & KeePass 05:20 - Dump Credentials 07:45 - ADCS Enumeration 10:10 - Port Bending 15:36 - ESC8 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content -...
Vulnlab | Escape - Escaping the Windows Kiosk, Encrypted Credentials & UAC
Переглядів 2,6 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & Kiosk Escape 05:21 - Revealing the admin password [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environment...
Vulnlab | Kaiju Part I - Initial Access via Filezilla & Escalating Privileges
Переглядів 2,2 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & General Enumeration 03:40 - Filezilla Hashes 07:51 - Low-privileged SSH Access 09:40 - Filezilla Admin & Port Forwarding 14:45 - From Filesystem Access to Shell 17:24 - Local Enumeration [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ ...
Vulnlab | Lock - Gitea Access Tokens, mRemoteNG & PDF24
Переглядів 1,9 тис.10 місяців тому
[ Timestamps ] 00:00 - Intro & General Enumeration 00:43 Gitea Access Tokens & CI/CD 05:50 Shell & mRemoteNG Configs 09:35 RDP & PDF24 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely education...
Vulnlab | Tea - Gitea CI/CD, LAPS v2, WSUS
Переглядів 2,2 тис.11 місяців тому
This video is a walkthrough on Tea, a chain of vulnerable machines on Vulnlab that involves Gitea Runners, Laps Version 2 & WSUS. [ Timestamps ] 00:00 - Intro & General Enumeration 01:36 Gitea Runners 05:30 User Shell & Local Enum 08:22 Sliver Beacon & Bloodhound 11:38 Get Laps Password 13:55 WSUS [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de/en/ [ Discord ]...
Vulnlab | Baby2 - Logon Scripts, WriteDACL, Shadow Credentials & GPOs
Переглядів 3,1 тис.Рік тому
This video is a walkthrough on Baby2, a vulnerable machine on Vulnlab that involves Password Spraying, Logon Scripts, WriteDACL, Shadow Credentials & GPOs. [ Timestamps ] 00:00 - Intro & General Enumeration 01:28 - Password Spraying 02:34 - Bloodhound & modifying a logon script 06:57 - Shell & more Bloodhound 09:07 - WriteDACL & Shadow Credentials 12:35 - GPOs [ Pentesting & Red Teaming Labs ] ...
Vulnlab | Retro - Password Spraying, Pre-Created Computer Accounts & ADCS // by r0BIT
Переглядів 3,5 тис.Рік тому
This video by r0BIT (@0xr0BIT) is a walkthrough on Retro, a vulnerable machine on vulnlab.com. It involves Password Spraying, Pre-Created Computer Accounts & an ADCS Attack. [ Timestamps ] 00:00 - Intro & General Enumeration 03:17 - Enumerate SMB Share 06:15 - Grabbing Domain Users 07:58 - Brute-Forcing Domain Logins 10:54 - ADCS Enumeration 15:30 - Fail to Request the Certificate 16:22 - Enume...
Vulnlab | Store - Node LFI, Node Debugging & using the ChromeDriver
Переглядів 2,4 тис.Рік тому
This video is a walkthrough for Store, a machine on Vulnlab that focuses on using various debug ports. [ Timestamps ] 00:00 Intro & Enumeration 02:00 Figuring out the Encryption 04:42 Finding the Vulnerability 08:23 Reading files via LFI 10:19 SFTP & Port Forwarding 11:59 Node Debugging 15:01 ChromeDriver [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desktop...
Vulnlab | Reflection - MSSQL, Relaying, LAPS & ACL Misconfigurations
Переглядів 3,1 тис.Рік тому
This video is a walkthrough on Reflection, a chain of vulnerable machines on vulnlab.com. It involves MSSQL, Relaying, LAPS & ACL-Misconfigurations. [ Timestamps ] 00:00 Intro & Enumeration 03:47 MSSQL 07:29 NTLM Relaying 15:14 Authenticated Domain Enumeration 18:05 GenericAll Part I 22:40 GenericAll Part II [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desk...
Tool Review: WinSSH
Переглядів 2,2 тис.Рік тому
This video is a short overview on what you can do with WinSSH and how to use it. It essentially acts like a reverse shell with (dynamic-) port forwarding & file up- and download features that is only using trusted windows binaries. [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Additional Resources ] • vulndev.io/2023/07/09/tool-review-winssh/ [ Discord ] • discord.gg/vulnlab [ Desktop ] • g...
Vulnlab | Wutai: PKINIT & Shadow Credentials
Переглядів 2,7 тис.Рік тому
This is part 6 and the final video of the Wutai series. We are getting DA by writing to the "msds-KeyCredentialLink" property which allows to authnenticate via PKINIT & DCSync the domain. After this there are 2 domains left which you can do on your own on vulnlab.com. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Timestamps ] 00:00 Intro & DPAPI 01:40 Shadow ...
Vulnlab | Wutai: Account Operators, Trust Enumeration & Password Reuse
Переглядів 2,2 тис.Рік тому
This is part 5 of the Wutai series. We are getting DA by using a helpdesk account to add us to a privileged group. We then enumerate the trust relationship with another domain and run Bloodhound on it. Finally we find a user that uses the same password in both domains and use it to jump onto the second domain. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Tim...
Vulnlab | Wutai: Browser Credentials & Playing with Bitwarden
Переглядів 2,9 тис.Рік тому
Vulnlab | Wutai: Browser Credentials & Playing with Bitwarden
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
Переглядів 3,2 тис.Рік тому
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
Переглядів 5 тис.Рік тому
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
Переглядів 9 тис.Рік тому
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
Переглядів 2,3 тис.Рік тому
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
Переглядів 1,8 тис.Рік тому
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
Переглядів 2,1 тис.Рік тому
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
Переглядів 1,8 тис.Рік тому
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
Переглядів 1,7 тис.Рік тому
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
Переглядів 2,7 тис.Рік тому
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
Переглядів 4,9 тис.Рік тому
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
Переглядів 5 тис.Рік тому
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
Переглядів 11 тис.Рік тому
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
Переглядів 3,6 тис.2 роки тому
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
Resource-Based Constrained Delegation - Resourced @ PG-Practice
Переглядів 7 тис.2 роки тому
Resource-Based Constrained Delegation - Resourced @ PG-Practice

КОМЕНТАРІ

  • @aaryan1143
    @aaryan1143 7 годин тому

    In the Sharphound.exe command, can you please tell me why did you use -c all,gpolocalgroup? Doesn't -c all give us all the necessary data?

  • @monamoralisch264
    @monamoralisch264 2 дні тому

    hrr hyprland, nize ^^

  • @TShad0w-Sec
    @TShad0w-Sec 2 дні тому

    You are a gifted person. I have learnt a lot from you over the years.

  • @jesuhelper1790
    @jesuhelper1790 3 дні тому

    world know him! GREAT ninja skill of hack

  • @ndog315
    @ndog315 3 дні тому

    Xct, this is a heartfelt thank you. I appreciate all your content, professionalism, and the amount of TLC you poor into your videos. I'm a new pentester and your videos are just golden. Ironically I just setup a mythic server in my test lab last week so this was epic. Thank you!

  • @Bchicken2
    @Bchicken2 4 дні тому

    Yayyy video!!

  • @d3m0n_404
    @d3m0n_404 4 дні тому

    Very cool thanks for the video

  • @mpotisambo2465
    @mpotisambo2465 4 дні тому

    love this

  • @ghosttester-g6u
    @ghosttester-g6u 4 дні тому

    Ltns

  • @RISE_BEFORE_YOU_GREECE
    @RISE_BEFORE_YOU_GREECE 4 дні тому

    IFRIT Last Upload 😂

  • @fer2127
    @fer2127 16 днів тому

    Rly usefull video, ty

  • @TShad0w-Sec
    @TShad0w-Sec 21 день тому

    Your video content is awesome

  • @JosuéQuiroa-f2x
    @JosuéQuiroa-f2x 24 дні тому

    How i can make the whisker.exe file?

  • @AUBCodeII
    @AUBCodeII 29 днів тому

    Hey xct, let's get OSE- wait

  • @salluc1712
    @salluc1712 2 місяці тому

    Thank you for the amazing video really appreciate your effort. You can also use nxc or cme to upload/download files to/from the machine easily --put-file --get-file.

  • @sohambakore2733
    @sohambakore2733 2 місяці тому

    Impacket errors out becuase there is no SAM file, the command should have been"impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL" but anyways awseome video! Thanks!

  • @longnguyenminhthang2810
    @longnguyenminhthang2810 3 місяці тому

    Hey man can you explain more why we could not use the ticket locally please I didn't get it. I know in theory it should works but I just have access denied, maybe its because of the double problem of winrm ? PS: you can exploit the box with WriteOwner abuse it's so much easier

  • @vedantkanoujia
    @vedantkanoujia 3 місяці тому

    fork u xct!!!!

  • @palevelmode
    @palevelmode 4 місяці тому

    What red team training I can take to learn such manual techniques?

    • @xct_de
      @xct_de 4 місяці тому

      You can join vulnlab :)

    • @palevelmode
      @palevelmode 4 місяці тому

      already did, but that's only partial of something to do to a red team engagement.

    • @palevelmode
      @palevelmode 3 місяці тому

      @@xct_de I saw vulnlab offering on access labs. Does it comes with guides, walkthrough, and video tutorials?

  • @plasma28
    @plasma28 4 місяці тому

    Loved the vigilant approach to enumeration. Learning cool new things!

  • @cymzfr
    @cymzfr 4 місяці тому

    nice explain

  • @gojo1825
    @gojo1825 4 місяці тому

    Yeah, I like the new walk-through style, too. It feels more detailed than before.

  • @gojo1825
    @gojo1825 4 місяці тому

    He's back!!! You need to reclaim your #1 spot, xct!!

  • @PerumalJegan
    @PerumalJegan 4 місяці тому

    You are underrated man @xct

  • @lonelyorphan9788
    @lonelyorphan9788 4 місяці тому

    Great video! 🙂 I love vulnlab

  • @hasancanogan9730
    @hasancanogan9730 4 місяці тому

    keep up the good work man

  • @alanisam6220
    @alanisam6220 4 місяці тому

    First🎉

  • @tanq1687
    @tanq1687 4 місяці тому

    accent is too thick to understand

  • @AliasTBD3
    @AliasTBD3 4 місяці тому

    Anyway you can show how you have your terminal setup? love the aesthetic!

  • @jake2090-lr6kp
    @jake2090-lr6kp 4 місяці тому

    Is vulnlab free like hackthebox?

    • @hadzah_fr
      @hadzah_fr 20 днів тому

      nop :/ but its lower price than htb if you want to do machines + chains (close to endgame) and redteam lab (prolab likes)

  • @for14556
    @for14556 4 місяці тому

    Which theme are you using for vscode? This looks very nice.

  • @berthold9582
    @berthold9582 5 місяців тому

    I wouldn't have managed this box

  • @berthold9582
    @berthold9582 5 місяців тому

    😮 you have a mindset that I want to develop this large-scale vision of things

  • @Free.Education786
    @Free.Education786 5 місяців тому

    I wish we had an automated tool 🔧 to perform 🎭 such extreme level http request smuggling 😢... this is insane beyond normal hackers' imagination!!! Ufff....Awesome 🕷♥️🥇💉🏆✔️🖊❤️👌🔧🎭🔥👍

  • @newhackerlearning7160
    @newhackerlearning7160 5 місяців тому

    thanks! very helpful and learned a tons. looking forward to more!

  • @boosywoosy
    @boosywoosy 6 місяців тому

    Damn this was super informative. Always learning new stuff from you guys, cheers for the content <3

  • @cherifxtitou6822
    @cherifxtitou6822 6 місяців тому

    i will join vuln lab within few days am so weak on AD i hope i will learn a lot from vuln lab <3

  • @hadzah_fr
    @hadzah_fr 6 місяців тому

    nice i3 theme ! and ofc thanks for this content !

    • @ohmsohmsohms
      @ohmsohmsohms 6 місяців тому

      thats default i3

    • @hadzah_fr
      @hadzah_fr 6 місяців тому

      @@ohmsohmsohms 🤣 Still cool

    • @ohmsohmsohms
      @ohmsohmsohms 6 місяців тому

      @@hadzah_fr lol for real

  • @mmmdyarcavadl9004
    @mmmdyarcavadl9004 6 місяців тому

    How can I achieve his level of skill?

  • @rodneynsubuga6275
    @rodneynsubuga6275 6 місяців тому

    Finally his back

  • @gojo1825
    @gojo1825 6 місяців тому

    That's the best HTB player for you. You inspire me!!

  • @Marco_Ris
    @Marco_Ris 6 місяців тому

    Congratulations on 3rd place at the HTB - Business CTF 2024. Thats the reason i found your channel and did the subscription. Love to view your videos and are hoping for more content. i learned a bit about burpsuite and other techniques in the 7 minutes xD Greetings from your neighbour country

  • @bambangsutrisna5006
    @bambangsutrisna5006 7 місяців тому

    🔥🔥🔥🔥

  • @Fyzethh
    @Fyzethh 7 місяців тому

    Love u Man greetings from chile I am learning a Lot from your content

  • @hadzah_fr
    @hadzah_fr 7 місяців тому

    Thanks you ! Your explanations are perfect to understand RBCD, I struggled on it most of the time but not anymore :D

  • @ARZ10198
    @ARZ10198 8 місяців тому

    Hey r0BIT!, for capturing the NTLMv2 challenge/response hash we could use our kali IP for redirecting traffic from smb.

  • @3ky3ky
    @3ky3ky 8 місяців тому

    cool !

  • @TShad0w-Sec
    @TShad0w-Sec 8 місяців тому

    Mad props for the privesc

  • @sharpicx
    @sharpicx 8 місяців тому

    love r0BIT!

  • @BitCloud047
    @BitCloud047 8 місяців тому

    wow...