- 99
- 297 102
xct
Germany
Приєднався 28 гру 2019
This channel covers red teaming & penetration testing topics by solving vulnerable machines & labs.
VL Mythical - Mythic C2, ADCS, Domain Trust & MSSQL
[ Timestamps ]
00:00 - Intro
[ Blog Post ]
• vuln.dev/vulnlab-mythical/
[ Pentesting & Red Teaming Labs ]
• vulnlab.com
[ Discord ]
• discord.gg/vulnlab
[ Desktop ]
• github.com/xct/kali-clean
• www.yuumeiart.com/
[ About ]
• vuln.dev
• xct_de
• github.com/xct
This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
00:00 - Intro
[ Blog Post ]
• vuln.dev/vulnlab-mythical/
[ Pentesting & Red Teaming Labs ]
• vulnlab.com
[ Discord ]
• discord.gg/vulnlab
[ Desktop ]
• github.com/xct/kali-clean
• www.yuumeiart.com/
[ About ]
• vuln.dev
• xct_de
• github.com/xct
This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
Переглядів: 1 214
Відео
Vulnlab | Ifrit - Intro, Initial Access & Enumeration
Переглядів 3,6 тис.4 місяці тому
[ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
Vulnlab | Klendathu - Auth Coercion, Mixed Kerberos Stacks & Domain Backup Keys // by snowscan
Переглядів 3,8 тис.6 місяців тому
[ Timestamps ] 00:00 - Intro [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • x.com/snowscan • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environments that allow and encourage offensiv...
Vulnlab | Kaiju Part II - KeePass Plugins & ESC8 with Port Bending // by r0BIT
Переглядів 2,4 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & KeePass 05:20 - Dump Credentials 07:45 - ADCS Enumeration 10:10 - Port Bending 15:36 - ESC8 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content -...
Vulnlab | Escape - Escaping the Windows Kiosk, Encrypted Credentials & UAC
Переглядів 2,6 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & Kiosk Escape 05:21 - Revealing the admin password [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environment...
Vulnlab | Kaiju Part I - Initial Access via Filezilla & Escalating Privileges
Переглядів 2,2 тис.9 місяців тому
[ Timestamps ] 00:00 - Intro & General Enumeration 03:40 - Filezilla Hashes 07:51 - Low-privileged SSH Access 09:40 - Filezilla Admin & Port Forwarding 14:45 - From Filesystem Access to Shell 17:24 - Local Enumeration [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ ...
Vulnlab | Lock - Gitea Access Tokens, mRemoteNG & PDF24
Переглядів 1,9 тис.10 місяців тому
[ Timestamps ] 00:00 - Intro & General Enumeration 00:43 Gitea Access Tokens & CI/CD 05:50 Shell & mRemoteNG Configs 09:35 RDP & PDF24 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely education...
Vulnlab | Tea - Gitea CI/CD, LAPS v2, WSUS
Переглядів 2,2 тис.11 місяців тому
This video is a walkthrough on Tea, a chain of vulnerable machines on Vulnlab that involves Gitea Runners, Laps Version 2 & WSUS. [ Timestamps ] 00:00 - Intro & General Enumeration 01:36 Gitea Runners 05:30 User Shell & Local Enum 08:22 Sliver Beacon & Bloodhound 11:38 Get Laps Password 13:55 WSUS [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de/en/ [ Discord ]...
Vulnlab | Baby2 - Logon Scripts, WriteDACL, Shadow Credentials & GPOs
Переглядів 3,1 тис.Рік тому
This video is a walkthrough on Baby2, a vulnerable machine on Vulnlab that involves Password Spraying, Logon Scripts, WriteDACL, Shadow Credentials & GPOs. [ Timestamps ] 00:00 - Intro & General Enumeration 01:28 - Password Spraying 02:34 - Bloodhound & modifying a logon script 06:57 - Shell & more Bloodhound 09:07 - WriteDACL & Shadow Credentials 12:35 - GPOs [ Pentesting & Red Teaming Labs ] ...
Vulnlab | Retro - Password Spraying, Pre-Created Computer Accounts & ADCS // by r0BIT
Переглядів 3,5 тис.Рік тому
This video by r0BIT (@0xr0BIT) is a walkthrough on Retro, a vulnerable machine on vulnlab.com. It involves Password Spraying, Pre-Created Computer Accounts & an ADCS Attack. [ Timestamps ] 00:00 - Intro & General Enumeration 03:17 - Enumerate SMB Share 06:15 - Grabbing Domain Users 07:58 - Brute-Forcing Domain Logins 10:54 - ADCS Enumeration 15:30 - Fail to Request the Certificate 16:22 - Enume...
Vulnlab | Store - Node LFI, Node Debugging & using the ChromeDriver
Переглядів 2,4 тис.Рік тому
This video is a walkthrough for Store, a machine on Vulnlab that focuses on using various debug ports. [ Timestamps ] 00:00 Intro & Enumeration 02:00 Figuring out the Encryption 04:42 Finding the Vulnerability 08:23 Reading files via LFI 10:19 SFTP & Port Forwarding 11:59 Node Debugging 15:01 ChromeDriver [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desktop...
Vulnlab | Reflection - MSSQL, Relaying, LAPS & ACL Misconfigurations
Переглядів 3,1 тис.Рік тому
This video is a walkthrough on Reflection, a chain of vulnerable machines on vulnlab.com. It involves MSSQL, Relaying, LAPS & ACL-Misconfigurations. [ Timestamps ] 00:00 Intro & Enumeration 03:47 MSSQL 07:29 NTLM Relaying 15:14 Authenticated Domain Enumeration 18:05 GenericAll Part I 22:40 GenericAll Part II [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desk...
Tool Review: WinSSH
Переглядів 2,2 тис.Рік тому
This video is a short overview on what you can do with WinSSH and how to use it. It essentially acts like a reverse shell with (dynamic-) port forwarding & file up- and download features that is only using trusted windows binaries. [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Additional Resources ] • vulndev.io/2023/07/09/tool-review-winssh/ [ Discord ] • discord.gg/vulnlab [ Desktop ] • g...
Vulnlab | Wutai: PKINIT & Shadow Credentials
Переглядів 2,7 тис.Рік тому
This is part 6 and the final video of the Wutai series. We are getting DA by writing to the "msds-KeyCredentialLink" property which allows to authnenticate via PKINIT & DCSync the domain. After this there are 2 domains left which you can do on your own on vulnlab.com. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Timestamps ] 00:00 Intro & DPAPI 01:40 Shadow ...
Vulnlab | Wutai: Account Operators, Trust Enumeration & Password Reuse
Переглядів 2,2 тис.Рік тому
This is part 5 of the Wutai series. We are getting DA by using a helpdesk account to add us to a privileged group. We then enumerate the trust relationship with another domain and run Bloodhound on it. Finally we find a user that uses the same password in both domains and use it to jump onto the second domain. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Tim...
Vulnlab | Wutai: Browser Credentials & Playing with Bitwarden
Переглядів 2,9 тис.Рік тому
Vulnlab | Wutai: Browser Credentials & Playing with Bitwarden
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
Переглядів 3,2 тис.Рік тому
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
Переглядів 5 тис.Рік тому
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
Переглядів 9 тис.Рік тому
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
Переглядів 2,3 тис.Рік тому
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
Переглядів 1,8 тис.Рік тому
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
Переглядів 2,1 тис.Рік тому
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
Переглядів 1,8 тис.Рік тому
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
Переглядів 1,7 тис.Рік тому
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
Переглядів 2,7 тис.Рік тому
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
Переглядів 4,9 тис.Рік тому
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
Переглядів 5 тис.Рік тому
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
Переглядів 11 тис.Рік тому
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
Переглядів 3,6 тис.2 роки тому
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
Resource-Based Constrained Delegation - Resourced @ PG-Practice
Переглядів 7 тис.2 роки тому
Resource-Based Constrained Delegation - Resourced @ PG-Practice
In the Sharphound.exe command, can you please tell me why did you use -c all,gpolocalgroup? Doesn't -c all give us all the necessary data?
hrr hyprland, nize ^^
ach nee, i3 :/
egal, thx4up!!!
You are a gifted person. I have learnt a lot from you over the years.
world know him! GREAT ninja skill of hack
Xct, this is a heartfelt thank you. I appreciate all your content, professionalism, and the amount of TLC you poor into your videos. I'm a new pentester and your videos are just golden. Ironically I just setup a mythic server in my test lab last week so this was epic. Thank you!
Yayyy video!!
Very cool thanks for the video
love this
Ltns
IFRIT Last Upload 😂
Rly usefull video, ty
Your video content is awesome
How i can make the whisker.exe file?
Hey xct, let's get OSE- wait
Thank you for the amazing video really appreciate your effort. You can also use nxc or cme to upload/download files to/from the machine easily --put-file --get-file.
Impacket errors out becuase there is no SAM file, the command should have been"impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL" but anyways awseome video! Thanks!
Hey man can you explain more why we could not use the ticket locally please I didn't get it. I know in theory it should works but I just have access denied, maybe its because of the double problem of winrm ? PS: you can exploit the box with WriteOwner abuse it's so much easier
fork u xct!!!!
What red team training I can take to learn such manual techniques?
You can join vulnlab :)
already did, but that's only partial of something to do to a red team engagement.
@@xct_de I saw vulnlab offering on access labs. Does it comes with guides, walkthrough, and video tutorials?
Loved the vigilant approach to enumeration. Learning cool new things!
nice explain
Yeah, I like the new walk-through style, too. It feels more detailed than before.
He's back!!! You need to reclaim your #1 spot, xct!!
You are underrated man @xct
Great video! 🙂 I love vulnlab
keep up the good work man
First🎉
accent is too thick to understand
Anyway you can show how you have your terminal setup? love the aesthetic!
Is vulnlab free like hackthebox?
nop :/ but its lower price than htb if you want to do machines + chains (close to endgame) and redteam lab (prolab likes)
Which theme are you using for vscode? This looks very nice.
I wouldn't have managed this box
😮 you have a mindset that I want to develop this large-scale vision of things
I wish we had an automated tool 🔧 to perform 🎭 such extreme level http request smuggling 😢... this is insane beyond normal hackers' imagination!!! Ufff....Awesome 🕷♥️🥇💉🏆✔️🖊❤️👌🔧🎭🔥👍
thanks! very helpful and learned a tons. looking forward to more!
Damn this was super informative. Always learning new stuff from you guys, cheers for the content <3
i will join vuln lab within few days am so weak on AD i hope i will learn a lot from vuln lab <3
nice i3 theme ! and ofc thanks for this content !
thats default i3
@@ohmsohmsohms 🤣 Still cool
@@hadzah_fr lol for real
How can I achieve his level of skill?
Practice.
Masturbation.
Finally his back
That's the best HTB player for you. You inspire me!!
Congratulations on 3rd place at the HTB - Business CTF 2024. Thats the reason i found your channel and did the subscription. Love to view your videos and are hoping for more content. i learned a bit about burpsuite and other techniques in the 7 minutes xD Greetings from your neighbour country
🔥🔥🔥🔥
Love u Man greetings from chile I am learning a Lot from your content
Thanks you ! Your explanations are perfect to understand RBCD, I struggled on it most of the time but not anymore :D
Hey r0BIT!, for capturing the NTLMv2 challenge/response hash we could use our kali IP for redirecting traffic from smb.
cool !
Mad props for the privesc
love r0BIT!
wow...