GS-040: CITY COUNCIL (P3) — NetExec Slinky + Responder (HackSmarter) | 2026-09-17

The streamer demonstrates a live penetration test of the "City Council" HackTheBox machine, exploiting Active Directory misconfigurations to capture and crack Net-NTLMv2 hashes for domain access 0:52.

Key Takeaways:
• The host works around emulation slowness on an ARM64 Mac running an AMD64 VM to analyze the challenge binary 0:38.
• The binary reveals a service account authenticating via plain text LDAP, allowing credentials to be sniffed with Wireshark 15:53.
• Captured credentials enable domain enumeration, including Kerberoasting checks and RustScan port discovery confirming accessible SMB shares 1:03:01.
• With write access to the uploads share, the host uses the slinky module in netexec to plant a malicious link file, capturing John Peters' Net-NTLMv2 hash 1:38:23.
• Hashcat (mode 5600) cracks the password "Johnny," granting further access; John Peters holds generic write rights over three users for targeted Kerberoasting next session 1:52:23.

The session underscores how network protocol knowledge and AD misconfigurations enable privilege escalation, with targeted Kerberoasting planned for next week.

Sources:

• 0:52 Challenge introduction
• 1:38:23 Slinky attack capturing the hash