GS-039: CITY COUNCIL (P2) + MARTINIAD — AD Recon + Kerberoast (HackSmarter) | 2026-09-10
Source: YouTube · HaxrByte · published Sep 11, 2026 · 2:36:40
The streamer initially struggled with technical issues due to running a x64 Kali Linux instance on an ARM-based Mac, which prevented him from using his primary setup for the planned CyberChef challenge. After resolving connectivity issues via SSH and VNC, he pivoted to a new Active Directory penetration testing exercise on the "Martini" machine, demonstrating key enumeration and exploitation techniques.
Key Takeaways:
• The presenter faced significant hurdles connecting to his remote x64 Kali VM from his ARM Mac due to architecture incompatibilities and VNC configuration errors, highlighting the complexity of cross-architecture remote desktop setups 20:00-23:00.
• To bypass the need for a GUI on the remote VM, he utilized SSH to access the terminal and manually configured the VNC server environment variables, allowing him to run graphical tools remotely 36:30-48:00.
• During the "Martini" CTF, he performed initial reconnaissance using nmap and smbclient, discovering a readable share named notes that contained a list of usernames [109:00-145:00].
• He identified a valid credential pair (inprice/password) by testing passwords against the extracted usernames and then used crackmapexec to verify the account and extract a password hash [145:00-150:00].
• By leveraging password reuse, he accessed the domain with the Athena account and used secretsdump.py to extract the KRBTGT hash, completing the objective 19:00-29:00.
The session underscores the importance of having a reliable local or remote infrastructure for penetration testing and demonstrates how small details like password reuse can lead to full domain compromise in Active Directory environments.
Sources:
- 20:00 Discussion on ARM vs x64 architecture issues with Kali binaries.
- 36:30 Troubleshooting and fixing the VNC server connection remotely.
- 109:00 Starting the port scan and SMB enumeration on the target.
- 145:00 Discovering credentials and extracting the user hash.
- 19:00 Exploiting password reuse to gain domain admin access.
- 29:00 Dumping the KRBTGT hash to complete the challenge.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 2 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello. Hi. Hi everyone. Uh I hope everyone can hear me. Okay, I am live it seems. Hopefully all the audio problems have been sorted out. I might be too loud. If somebody can just maybe let me know. Let's see who's online. Say logic. Nice. Welcome. Nice to see you. Welcome. Welcome. Is it good? Awesome. Yeah, man. Sunday's one had a bit of issues, but I think I found the problem and I think we're all good. I think we are good. Let's see. Everything. Yes. Everything is feeding through. Good stuff. Hey, Dark Trace. Welcome. Welcome. Uh yeah, Dark Trace. Um, I did tell you already I found the problem with the that we had with um, what was it? What did we do? Oh, good. City Council. So, that app is definitely not an ARM app. So, that was definitely a problem. I think I did find a way to to fix …