Hacking A Bank... (404 Bank - Part 1)

[BLUF] This video demonstrates the initial enumeration phase of a red team engagement against the 404 Bank Active Directory lab, focusing on identifying the domain, discovering usernames via the web interface, and extracting credentials from a downloadable binary 1:50.

Key Takeaways:
• The attacker uses RustScan and Nmap to identify open ports and services, specifically targeting RDP to reveal the domain name 404finance.local 3:10.
• After determining the domain, the attacker updates the local /etc/hosts file to ensure proper resolution of the domain controller dc404.404finance.local 8:15.
• The web application hosts a "Meet Our Team" page which reveals three employee names: Alex Meyer, Robert Graff, and Carl Hackerman, providing a basis for username enumeration 10:15.
• A downloadable executable named corpbankdialer.exe is found on the site; running the strings command against it reveals a Base64 encoded debug string 14:05.
• Decoding the Base64 string yields an MD5 hash, which is subsequently cracked using Hashcat with the wordlist rockyou.txt to reveal the password password123 17:45.

The summary concludes that by combining passive information gathering with simple binary analysis, the attacker successfully identified valid users and a likely password, setting the stage for initial access in the subsequent phase of the engagement.

Sources:

• 1:50 Introduction to RustScan and Nmap for port scanning and service enumeration.
• 3:10 Using Nmap against RDP to discover the domain name and DC hostname.
• 8:15 Configuring /etc/hosts to resolve the discovered domain.
• 10:15 Extracting employee names from the website for username enumeration.
• 14:05 Downloading and analyzing corpbankdialer.exe to find hidden data.
• 17:45 Cracking the MD5 hash found in the binary to obtain a password.