Hacking NorthBridge Systems (Part 6) - Hack Smarter Labs

Part six of the North Bridge Systems walkthrough on Hack Smarter demonstrates bypassing Active Directory protections by identifying an alternative user to impersonate via BloodHound, then pivoting through multiple tools to capture the first user flag 0:00.

Key Takeaways:
• After domain admins couldn't be impersonated due to protected user restrictions, BloodHound was used to enumerate tier-one admin accounts as alternative Kerberos impersonation targets 1:30.
• Successfully impersonated user G Cook T1 and confirmed admin access to the jump box using NetExec with Kerberos authentication 2:45.
• When WMIExec2 failed due to pre-authentication errors, the instructor pivoted to dumping SAM hashes via NetExec and used Evil-WinRM pass-the-hash to gain administrator access 5:00.
• The first user flag was retrieved from the jump box desktop, concluding part six with a challenge for viewers to attempt domain controller pivoting independently 6:10.

The video reinforces the importance of tool agility, demonstrating how to pivot when a primary tool fails during an Active Directory attack chain.

Sources:

• 0:00 Recap of part five and AD restriction bypass
• 1:30 BloodHound enumeration of admin accounts
• 2:45 Kerberos impersonation of G Cook T1
• 5:00 Pass-the-hash pivot after WMIExec2 failure
• 6:10 User flag capture and challenge to viewers