Hacking A Bank... (404 Bank - Part 4)

Part 4 covers AD privilege escalation in the 404 Bank lab, moving from the compromised Robert Graff account to RDP on the domain controller, recovering deleted emails, and compromising Daniel Hoffman 0:00.

Key Takeaways:
• BloodHound shows Robert Graff can add members to the Remote Desktop Users group and ForceChangePassword on three users 1:28
• Using BloodyAD, he adds himself to Remote Desktop Users and gains RDP access to the DC 2:27
• Jan Tresor is targeted since she has a profile on the DC; her password is reset and she's added to Remote Desktop Users 7:45
• As Jan, Recycle Bin emails reveal a password policy hint (custom wordlist from bank history), a notice that svc-services was deactivated by Robert Graff (hinting at a future ADCS path), and Daniel Hoffman's leaked credentials 11:33
• Hoffman's credentials ("RemoteAccess2024!") are confirmed working, compromising another user 17:25

After four parts, the presenter has compromised five users with RDP on the DC, challenging viewers to enumerate Hoffman's permissions and pursue svc-services via an ADCS exploit 19:59.

Sources:

• 0:00 Intro and recap
• 1:28 BloodHound enumeration of Robert Graff
• 2:27 RDP access to DC
• 7:45 Compromising Jan Tresor
• 11:33 Recycle Bin email discovery
• 17:25 Daniel Hoffman credential leak
• 19:59 Recap and viewer challenge