HackTheBox - Nanocorp
Source: YouTube · IppSec · published Jun 20, 2026 · 1:07:14
NanoCorp is a challenging Windows machine on Hack The Box where the primary difficulty stems from complex enumeration rather than complex exploitation techniques 0:06.
Key Takeaways:
• The machine requires identifying a specific vulnerability in Windows ZIP file handling, which allows for the leakage of NTLM hashes 0:17.
• This vulnerability is exploited via a web form that permits zip file uploads, serving as the initial attack vector 0:19.
• Successful exploitation leads to the acquisition of credentials, which is a critical step in the penetration testing workflow 0:22.
• The challenge emphasizes deep reconnaissance, as the vulnerability is somewhat buried and requires specific recon efforts to discover 0:27.
This box serves as a reminder that hard machines often rely on obscure vulnerabilities and rigorous enumeration skills rather than advanced exploitation code.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we'll be doing NanoCorp from Hack The Box, which is a hard Windows machine, and the techniques in this box aren't too hard. The main difficulty comes from enumeration because there's one thing in particular that's probably going to make you question your sanity, at least it did for me. But before we get to that, we have to enumerate a vulnerability within zip files in Windows because there's a web form where we can upload a zip. This vulnerability lets us leak NTLM hashes. At the time of release, it wasn't too hard because the vulnerability was in the news. However, now it's been almost a year, and the vulnerability's come a little bit buried, but there's some recon we can do to help us out there. This gets us credentials, and there's a re…