Skip to main content
CPEBuddy
HackTheBox - University

HackTheBox - University

Source: YouTube · IppSec · published Aug 9, 2025 · 1:41:35

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

This video details a walkthrough of the "University" Hack The Box machine, highlighting a complex privilege escalation path involving PDF exploitation, credential reuse, and Kerberos delegation attacks.

Key Takeaways:
• The initial foothold is achieved by exploiting a vulnerable PDF generator to gain a shell on the domain 0:18.
• Discovered credentials allow access to both a Linux host and a Windows host, with the Linux box already running as root 0:22.
• The Windows host possesses unconstrained delegation, enabling the attacker to intercept and manipulate Kerberos tickets 0:28.
• A man-in-the-middle attack is performed against the Windows workstation to capture NTLM hashes via WPAD requests 0:35.

The summary illustrates how misconfigured delegation and shared broadcast domains can lead to full domain compromise.

Sources:

  • 0:00 Introduction to the University Hack The Box machine.
  • 0:18 Exploiting the PDF generator for initial access.
  • 0:22 Using found credentials to access Linux and Windows hosts.
  • 0:28 Leveraging unconstrained delegation on the Windows host.
  • 0:35 Performing a man-in-the-middle attack via WPAD.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on, YouTube? This is IPSC, and we'll be doing University from Hack the Box, or I guess I should say attempt university because a lot went wrong when recording this video. I debated on redoing it, but I figured I just roll with it in case any of the troubleshooting or pain is helpful to you. Anyways, the main difficulty with this box comes from one step that is really hard to spot. Once you get a shell on the domain by exploiting a PDF generator, you find a set of credentials that lets you log into two other VMs, a Linux host and a Windows host. The Windows host is trusted to delegate and has unconstrained delegation and we are root on the Linux box. Because both of these host on the same broadcast domain, we can perform a man-in-the-middle attack. And when the Windows workstat…