Part 4: Hacking BitStream - (Active Directory)

This video covers privilege escalation and post-exploitation on a compromised SQL server in an Active Directory environment, demonstrating how to leverage Sliver C2's execute-assembly feature to run God Potato without transferring files to the target 1:02-1:04.

Key Takeaways:
• After obtaining a shell via Sliver, the presenter enumerates privileges using get privs and identifies the SEImpersonatePrivilege, which signals that a "potato" attack can be used for local privilege escalation 2:21-3:10.
• Using Sliver's execute-assembly command, God Potato is executed directly from the attacker's machine (no file transfer required) by wrapping command arguments in single quotes, successfully elevating to NT AUTHORITY\SYSTEM 5:53-6:08.
• Unlike standard CTFs, post-exploitation here focuses on finding domain credentials for lateral movement rather than grabbing a simple flag, as no AD credentials have been obtained yet 10:48-11:13.
• The presenter uses Sliver's NanoDump extension to create a minidump of the LSASS process (PID 728) to extract cached domain credentials, downloading the dump to parse with PyPyKatz 15:05-19:31.
• A PyPyKatz bug prevents successfully parsing Bob's domain hash from the LSASS dump in this session, but alternative methods like Mimikatz or other Bitstream-specific techniques will be explored in the next video 20:01-22:07.

The video effectively demonstrates advanced C2 usage and LSASS dumping, while emphasizing the importance of pivoting to alternative tools when encountering errors.

Sources:

• 1:02-1:04 Introduction to enumeration on the SQL server
• 2:21-3:10 Identifying SEImpersonatePrivilege for potato attacks
• 5:53-6:08 Executing God Potato remotely without file transfer
• 10:48-11:13 Post-exploitation goals in an AD environment
• 15:05-19:31 Dumping LSASS using NanoDump
• 20:01-22:07 PyPyKatz error and alternative extraction methods