HackTheBox - Mirage
Source: YouTube · IppSec · published Nov 22, 2025 · 1:32:29
BLUF: This video demonstrates a multi-stage privilege escalation on the "Mirage" Hack The Box machine, leveraging insecure DNS, NFS, and NAT configurations to harvest credentials and achieve initial access. 0:00
Key Takeaways:
• The attack chain begins by exploiting an NFS share and insecure DNS configuration to intercept traffic via a malicious DNS update. 0:09
• By forcing clients to authenticate to a controlled server, the attacker captures credentials used to access the legitimate NAT service. 0:15
• Saved messages in Jet Stream reveal additional credentials, facilitating Kerberos authentication and further domain compromise. 0:24
• The final credential grants Windows access, allowing the use of Remote Potato for privilege escalation to the logged-in user. 0:32
This walkthrough highlights the critical importance of securing DNS, NFS, and NAT configurations to prevent credential harvesting.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube. This is me doing Mirage from Hack the Box,
which is a really fun box. Can also be summed up with yet
another credential because we have a lot of hops
to go through. It starts off with reading some documents on an NFS
share that points to an insecure
DNS configuration, and then that's message broker
being utilized. We put a malicious DNS update
to take over the Nat sub domain, and have clients
authenticate to our server, which gives us their credential. We use this credential to log
into the legitimate Nat service, discover some saved messages thanks to Jet Stream,
which contains yet another credential. This allows us to kerberos the domain
which gets us yet another credential. This one gives us the win access and we discover
a user is logged in to the box. We can u…