Hacking A Bank... (404 Bank - Part 5)
Source: YouTube · Tyler Ramsbey - Hack Smarter · published Nov 13, 2026 · 23:10
In part five of the 404 Bank AD lab walkthrough, the presenter obtains the user flag as Daniel Hoffman, pivots laterally to web admin, and uncovers a promising new attack path 0:00.
Key Takeaways:
• Using Daniel Hoffman's recycled-bin password, BloodyAD added him to Remote Desktop Users, granting RDP access to the DC and yielding the user flag 1:32.
• BloodHound showed ForceChangePassword over web admin; the first reset failed (authenticated as Robert Gray), but succeeded as Daniel Hoffman—NetExec confirmed the new creds (hacksmarter123!) 4:36.
• With no outbound control for web admin in BloodHound, BloodyAD's "writable" command revealed a curious Alex Meyer object and DNS zone creation rights 12:45.
• RDPing as web admin unlocked inetpub, exposing a likely password-protected config_backup tied to an internal-only port 5000 web server 19:08.
• Homework: transfer config_backup to Kali, extract the hash with zip2john, and crack it with rockyou.txt or a custom wordlist built from the bank's history page 22:22.
The presenter stresses that repeated lab work builds a reusable methodology—enumerate users in BloodHound, chain BloodyAD attacks, take clean notes—that pays off in exams like the OSCP and real engagements 4:50.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What is up everyone? Welcome back to another video. This video is part five of working through the 404 Bank Active Directory lab from the Hack Smarter platform. Now, this is part five, so if this is the first one you're watching, I would suggest going to part one and following the series in order. You will learn the best that way. Additionally, you will learn a lot by watching, you'll learn more by hacking. So, if you haven't already, make sure you boot up 404 Bank and get ready to hack all of the things with me. You will also notice chat on the screen as we go. I make these videos while I live stream. I live stream all the time, but you're not here. So, make sure you subscribe and hit the bell notification so you are notified the next time I am live. All that being said, we're going to di…