HackTheBox - Mist

BLUF: The video details the exploitation of the "Mist" Hack The Box machine, focusing on an NTLM relay attack to gain initial foothold and subsequent privilege escalation via LDAP injection.

Key Takeaways:
• The attacker used Rubeus for Pass-the-Ticket (PtT) to retrieve the NTLM hash of a social-engineered user, enabling authentication via a SOCKS proxy without knowing the plaintext password 0:16.
• PetitPotam was utilized to coerce the domain controller into authenticating to the attacker's machine, facilitating an NTLM relay to the LDAP service 0:28.
• Because LDAP signing was disabled, the relayed authentication allowed the attacker to bind as the computer account, leading to the acquisition of DCSync credentials 0:35.
• The initial foothold was complicated by restrictions preventing domain users from adding machines or DNS entries, requiring creative workarounds for the relay setup 0:10.

The "Mist" machine serves as a challenging example of how misconfigured LDAP signing can be leveraged for full domain compromise even with restricted user privileges.

Sources:

• 0:05 Introduction to the Mist machine and its difficulty.
• 0:16 Using Rubeus for Pass-the-Ticket to get NTLM hash.
• 0:28 Using PetitPotam for NTLM relay.
• 0:35 Exploiting disabled LDAP signing for computer account bind.
• 0:41 Final credential acquisition via DCSync.