Hacking A Bank... (404 Bank - Part 3)

This video walks through part three of the 404 Bank lab on Hack Smarter, where the presenter chains two Active Directory attacks—targeted Kerberoasting and forced password change—to laterally move from Carl Hackerman to Tom Reboot and then Robert Grave 1:16-1:22.

Key Takeaways:
• BloodHound enumeration reveals Carl Hackerman has GenericWrite privileges over Tom Reboot, enabling attacks like targeted Kerberoasting 3:06-3:58.
• Using NetExec's targeted Kerberoasting feature, the presenter temporarily sets an SPN on Tom Reboot and obtains a crackable service ticket hash 6:32-7:48.
• The hash is successfully cracked with Hashcat against rockyou.txt, yielding Tom Reboot's password and confirming access via NetExec SMB 10:22-11:51.
• BloodHound shows Tom Reboot has ForceChangePassword over Robert Grave; the presenter uses BloodyAD's set password function to change it, emphasizing this should never be done on real engagements without client approval 12:20-13:57.
• Access to Robert Grave is verified, completing a second lateral movement and setting up homework for viewers to enumerate Robert Grave's privileges before part four 17:52-19:00.

The video demonstrates a clean methodology of enumerating outbound object control in BloodHound, exploiting each privilege, and documenting findings—ending with encouragement that struggling is part of learning.

Sources:

• 1:16 Recap of lab context and initial access as Carl Hackerman
• 3:06 Discovery of GenericWrite over Tom Reboot in BloodHound
• 6:32 NetExec targeted Kerberoasting attack execution
• 10:22 Hash cracking and lateral movement to Tom Reboot
• 12:20 ForceChangePassword discovery and BloodyAD attack
• 17:52 Verification of Robert Grave compromise and homework assignment