Blinker Fluids was a Web challenge in Cyber Apocalypse 2022. It has the following description: The challenge files could be downloaded and to retrieve the flag we had to exploit a running instance. The vulnerability The vulnerability which we had to exploit is CVE-2021-23639 and it has a CVSS score of 9.8…

This challenge was from the forensics category of Cyber Apocalypse 2022. For the challenge we had to download a PCAP file and analyze it. Analyzing the PCAP After opening the PCAP in Wireshark, I have inspected the files that got transfered. One of the file had the content type of image/png: I have…

We were able to acquire credentials for TBSEC_GUEST account in Part 8. In this article we will compromise TBSEC-DC01. C2 The credentials which we found in Part 8 can be used to login into TBSEC-DC01. I have added that server to my C2 Framework by running the launcher on it: Kerberoast Next…

From the update_email.txt notice, we now know that the corporation is using another email server with other email formats. We also know that there is a web service available that will check emails for leaked credentials. LeedLinked Now we need to get a list of emails in order to check for…

After we have access to the Domain Controller, it is time to extend our privileges. DCSync With a DCSync attack attacker can retrieve data on a domain controller by behaving like a domain controller. With a DCSync attack it is possible to retrieve for example the password hashes of users. To…

In Part 2 we have successfully gained access to Frank Murphy’s email account. It contained an interesting email with a reset link to the Timekeep server. In this part we will gained access to the Timekeep server via this link. Resetting the password If we want the link to work, then we have…

At this stage we still have access to THROWBACK-PROD as a domain user called BlaireJ. In order to gain higher privileges in the domain, e.g. Domain Admin, we should now enumerate the Active Directory Domain. Collecting the Data First of all we need to collect data on the domain. After that we can…

In Part 2 we got a meterpreter shell after successfully phishing BlaireJ. In Part 3 after gaining a Administrator shell we could run Mimikatz and retrieve more credentials and hashes. In Part 1 we also could gain the Hash of HumphreyW. …

In this article I will show you how to retrieve the password of PetersJ by doing LLMNR Poisoning. What is LLMNR Poisoning? LLMNR is a protocol used for name resolution in a Windows network. If a computer does not receive a domain from a DNS server, it will try to get the IP to…