GS-041: CITY COUNCIL (P4) — WIM Extract + DACL Abuse (HackSmarter) | 2026-10-01

This stream continues the Hack Smarter "City Council" AD CTF, showing credential attacks, Kerberoasting, and DPAPI abuse, plus discussion on AI's impact on cybersecurity 9:22.

Key Takeaways:
• Recap: sniffed plaintext credentials via Wireshark, kerberoasted, then used write access to the "uploads" SMB share with the Slinky module to capture and crack John Peters' net-NTLMv1 hash 11:00
• Targeted Kerberoasting as John Peters yielded hashes for four users; only Nina Sto's cracked, granting read access to the "backups" share 21:42
• Backups files exposed new users and an email revealing Emma Hayes shares credentials with clerk.j via Windows Credential Manager (DPAPI) 1:10:35
• DPAPI master key decryption with John's password recovered Emma's credentials; she has GenericAll over web admin 1:31:22
• On AI: entry-level cyber isn't going away—AI expands attack surface and pentesting demand, though the job will evolve 1:15:43
• The box wasn't finished—a DPACL edit hit syntax issues—so it's pinned for next week 2:13:18

A practical look at AD attack tradecraft; the host raided a fellow creator and invited viewers back next week 2:15:01.

Sources:

• 11:00 Wireshark capture and NTLM theft
• 21:42 Kerberoasting four users
• 1:10:35 Email revealing DPAPI credential sharing
• 1:31:22 DPAPI key decryption
• 2:13:18 Wrap-up, pinned for next week