Skip to main content
CPEBuddy
HackTheBox - RustyKey

HackTheBox - RustyKey

Source: YouTube · IppSec · published Nov 8, 2025 · 1:13:10

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

The video demonstrates rooting the Hack The Box machine "Rusty Key," focusing on a time-roasting attack to steal computer account hashes and subsequent privilege escalation. 0:00

Key Takeaways:
• The machine balances Active Directory and Windows exploitation challenges 0:06.
• The initial step involves a time-roasting attack to steal computer account hashes without authentication 0:10.
• Successful exploitation allows taking over user accounts by adding the attacker to a specific group and changing passwords 0:24.
• NLM authentication is disabled, requiring the use of Cobalt Strike for certain interactions 0:31.

This walkthrough highlights critical AD attack vectors and the importance of understanding authentication protocols in penetration testing.

Sources:

  • 0:00 Introduction to the Hack The Box machine.
  • 0:10 Explanation of the time-roasting attack vector.
  • 0:24 Details on user account takeover methods.
  • 0:31 Note on NLM authentication settings.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

What's going on YouTube? This is IPS doing Rusty Key from Hack the Box, which I find to be a very well put together Windows machine that has a nice balance between Active Directory and general Windows exploitation. We start off with a set of credentials, which in reality we don't need because the first step is a time roasting attack, which doesn't require authentication to steal computer account hashes. However, without that previous access, it would be a complete guessing game to do the time roast attack. Once we get access to the computer account, we discover a path that lets us take over user accounts through adding ourel to a group and changing the password. But there's a few tricks. Firstly, NLM authentication is disabled, so we have to use Cobros. And secondly, the users in the prote…