- 98
- 292 279
xct hacks
Germany
เข้าร่วมเมื่อ 28 ธ.ค. 2019
This channel covers red teaming & penetration testing topics by solving vulnerable machines & labs.
Vulnlab | Ifrit - Intro, Initial Access & Enumeration
[ Pentesting & Red Teaming Labs ]
• vulnlab.com
[ Sponsors ]
• mantodeasecurity.de
[ Discord ]
• discord.gg/vulnlab
[ Desktop ]
• github.com/xct/kali-clean
• www.yuumeiart.com/
[ About ]
• vulndev.io
• xct_de
• github.com/xct
This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
• vulnlab.com
[ Sponsors ]
• mantodeasecurity.de
[ Discord ]
• discord.gg/vulnlab
[ Desktop ]
• github.com/xct/kali-clean
• www.yuumeiart.com/
[ About ]
• vulndev.io
• xct_de
• github.com/xct
This is purely educational content - all practical work is done in environments that allow and encourage offensive security training.
มุมมอง: 3 148
วีดีโอ
Vulnlab | Klendathu - Auth Coercion, Mixed Kerberos Stacks & Domain Backup Keys // by snowscan
มุมมอง 3.6K5 หลายเดือนก่อน
[ Timestamps ] 00:00 - Intro [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • x.com/snowscan • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environments that allow and encourage offensiv...
Vulnlab | Kaiju Part II - KeePass Plugins & ESC8 with Port Bending // by r0BIT
มุมมอง 2.3K9 หลายเดือนก่อน
[ Timestamps ] 00:00 - Intro & KeePass 05:20 - Dump Credentials 07:45 - ADCS Enumeration 10:10 - Port Bending 15:36 - ESC8 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content -...
Vulnlab | Escape - Escaping the Windows Kiosk, Encrypted Credentials & UAC
มุมมอง 2.5K9 หลายเดือนก่อน
[ Timestamps ] 00:00 - Intro & Kiosk Escape 05:21 - Revealing the admin password [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely educational content - all practical work is done in environment...
Vulnlab | Kaiju Part I - Initial Access via Filezilla & Escalating Privileges
มุมมอง 2.1K9 หลายเดือนก่อน
[ Timestamps ] 00:00 - Intro & General Enumeration 03:40 - Filezilla Hashes 07:51 - Low-privileged SSH Access 09:40 - Filezilla Admin & Port Forwarding 14:45 - From Filesystem Access to Shell 17:24 - Local Enumeration [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ ...
Vulnlab | Lock - Gitea Access Tokens, mRemoteNG & PDF24
มุมมอง 1.8K9 หลายเดือนก่อน
[ Timestamps ] 00:00 - Intro & General Enumeration 00:43 Gitea Access Tokens & CI/CD 05:50 Shell & mRemoteNG Configs 09:35 RDP & PDF24 [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de [ Discord ] • discord.gg/vulnlab [ Desktop ] • github.com/xct/kali-clean • www.yuumeiart.com/ [ About ] • vulndev.io • xct_de • github.com/xct This is purely education...
Vulnlab | Tea - Gitea CI/CD, LAPS v2, WSUS
มุมมอง 2.1K10 หลายเดือนก่อน
This video is a walkthrough on Tea, a chain of vulnerable machines on Vulnlab that involves Gitea Runners, Laps Version 2 & WSUS. [ Timestamps ] 00:00 - Intro & General Enumeration 01:36 Gitea Runners 05:30 User Shell & Local Enum 08:22 Sliver Beacon & Bloodhound 11:38 Get Laps Password 13:55 WSUS [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Sponsors ] • mantodeasecurity.de/en/ [ Discord ]...
Vulnlab | Baby2 - Logon Scripts, WriteDACL, Shadow Credentials & GPOs
มุมมอง 3Kปีที่แล้ว
This video is a walkthrough on Baby2, a vulnerable machine on Vulnlab that involves Password Spraying, Logon Scripts, WriteDACL, Shadow Credentials & GPOs. [ Timestamps ] 00:00 - Intro & General Enumeration 01:28 - Password Spraying 02:34 - Bloodhound & modifying a logon script 06:57 - Shell & more Bloodhound 09:07 - WriteDACL & Shadow Credentials 12:35 - GPOs [ Pentesting & Red Teaming Labs ] ...
Vulnlab | Retro - Password Spraying, Pre-Created Computer Accounts & ADCS // by r0BIT
มุมมอง 3.4Kปีที่แล้ว
This video by r0BIT (@0xr0BIT) is a walkthrough on Retro, a vulnerable machine on vulnlab.com. It involves Password Spraying, Pre-Created Computer Accounts & an ADCS Attack. [ Timestamps ] 00:00 - Intro & General Enumeration 03:17 - Enumerate SMB Share 06:15 - Grabbing Domain Users 07:58 - Brute-Forcing Domain Logins 10:54 - ADCS Enumeration 15:30 - Fail to Request the Certificate 16:22 - Enume...
Vulnlab | Store - Node LFI, Node Debugging & using the ChromeDriver
มุมมอง 2.4Kปีที่แล้ว
This video is a walkthrough for Store, a machine on Vulnlab that focuses on using various debug ports. [ Timestamps ] 00:00 Intro & Enumeration 02:00 Figuring out the Encryption 04:42 Finding the Vulnerability 08:23 Reading files via LFI 10:19 SFTP & Port Forwarding 11:59 Node Debugging 15:01 ChromeDriver [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desktop...
Vulnlab | Reflection - MSSQL, Relaying, LAPS & ACL Misconfigurations
มุมมอง 3.1Kปีที่แล้ว
This video is a walkthrough on Reflection, a chain of vulnerable machines on vulnlab.com. It involves MSSQL, Relaying, LAPS & ACL-Misconfigurations. [ Timestamps ] 00:00 Intro & Enumeration 03:47 MSSQL 07:29 NTLM Relaying 15:14 Authenticated Domain Enumeration 18:05 GenericAll Part I 22:40 GenericAll Part II [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Desk...
Tool Review: WinSSH
มุมมอง 2.2Kปีที่แล้ว
This video is a short overview on what you can do with WinSSH and how to use it. It essentially acts like a reverse shell with (dynamic-) port forwarding & file up- and download features that is only using trusted windows binaries. [ Pentesting & Red Teaming Labs ] • vulnlab.com [ Additional Resources ] • vulndev.io/2023/07/09/tool-review-winssh/ [ Discord ] • discord.gg/vulnlab [ Desktop ] • g...
Vulnlab | Wutai: PKINIT & Shadow Credentials
มุมมอง 2.6Kปีที่แล้ว
This is part 6 and the final video of the Wutai series. We are getting DA by writing to the "msds-KeyCredentialLink" property which allows to authnenticate via PKINIT & DCSync the domain. After this there are 2 domains left which you can do on your own on vulnlab.com. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Timestamps ] 00:00 Intro & DPAPI 01:40 Shadow ...
Vulnlab | Wutai: Account Operators, Trust Enumeration & Password Reuse
มุมมอง 2.2Kปีที่แล้ว
This is part 5 of the Wutai series. We are getting DA by using a helpdesk account to add us to a privileged group. We then enumerate the trust relationship with another domain and run Bloodhound on it. Finally we find a user that uses the same password in both domains and use it to jump onto the second domain. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Tim...
Vulnlab | Wutai: Browser Credentials & Playing with Bitwarden
มุมมอง 2.8Kปีที่แล้ว
This is part 4 of the Wutai series. We are looting a user's stored browser credentials and will be using them to access ESXi & Bitwarden. We'll then modify the Bitwarden login page to obtain more credentials. [ Support & Private Lab Access ] • vulnlab.com [ Discord ] • discord.gg/vulnlab [ Timestamps ] 00:00 Intro, Getting Beacons & Host Enumeration 02:05 Obtaining Credentials 05:55 Access to E...
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
มุมมอง 3.2Kปีที่แล้ว
Vulnlab | Wutai: Reverse Engineering & Lateral Movement
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
มุมมอง 4.9Kปีที่แล้ว
Vulnlab | Wutai: Writing a Loader & Getting a Beacon
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
มุมมอง 8Kปีที่แล้ว
Vulnlab | Wutai: Initial Enumeration, Password Spraying & Getting Access via VDI
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
มุมมอง 2.2Kปีที่แล้ว
Vulnlab | Shinra: gMSA, Constrained- & Resource-based Constrained Delegation
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
มุมมอง 1.7Kปีที่แล้ว
Vulnlab | Shinra: From Certificate Manager to DA - Active Directory Certificate Services ESC4
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
มุมมอง 2Kปีที่แล้ว
Vulnlab | Shinra: Local Privilege Escalation via File Redirection
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
มุมมอง 1.8Kปีที่แล้ว
Vulnlab | Shinra: Pass-the-Cache, WDAC & Visual Studio Code
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
มุมมอง 1.7Kปีที่แล้ว
Vulnlab | Shinra: Client-side Attack via NPM Registry & Local Privilege Escalation
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
มุมมอง 2.7Kปีที่แล้ว
Vulnlab | Shinra: Prov to Registry - Reverse Engineering, Binary Exploitation & Ansible
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
มุมมอง 4.8Kปีที่แล้ว
Vulnlab | Shinra: Those Pesky Humans! - Initial Payload Design, Host Enumeration & getting SYSTEM
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
มุมมอง 4.9Kปีที่แล้ว
Vulnlab | Shinra: Enumerate, Enumerate, Enumerate!
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
มุมมอง 11Kปีที่แล้ว
Vulnlab | Shinra: And So It Begins - SQLi, Command Injection & Hash Cracking
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
มุมมอง 3.6K2 ปีที่แล้ว
SQLi, LFI to RCE and Unintended Privesc via XAMLX & Impersonation - StreamIO @ HackTheBox
Resource-Based Constrained Delegation - Resourced @ PG-Practice
มุมมอง 7K2 ปีที่แล้ว
Resource-Based Constrained Delegation - Resourced @ PG-Practice
ASP, Windows Containers, Responder & NoPAC - Anubis @ HackTheBox
มุมมอง 7K2 ปีที่แล้ว
ASP, Windows Containers, Responder & NoPAC - Anubis @ HackTheBox
How i can make the whisker.exe file?
Hey xct, let's get OSE- wait
Thank you for the amazing video really appreciate your effort. You can also use nxc or cme to upload/download files to/from the machine easily --put-file --get-file.
Impacket errors out becuase there is no SAM file, the command should have been"impacket-secretsdump -ntds ntds.dit -system SYSTEM -security SECURITY LOCAL" but anyways awseome video! Thanks!
Hey man can you explain more why we could not use the ticket locally please I didn't get it. I know in theory it should works but I just have access denied, maybe its because of the double problem of winrm ? PS: you can exploit the box with WriteOwner abuse it's so much easier
fork u xct!!!!
What red team training I can take to learn such manual techniques?
You can join vulnlab :)
already did, but that's only partial of something to do to a red team engagement.
@@xct_de I saw vulnlab offering on access labs. Does it comes with guides, walkthrough, and video tutorials?
Loved the vigilant approach to enumeration. Learning cool new things!
nice explain
Yeah, I like the new walk-through style, too. It feels more detailed than before.
He's back!!! You need to reclaim your #1 spot, xct!!
You are underrated man @xct
Great video! 🙂 I love vulnlab
keep up the good work man
First🎉
accent is too thick to understand
Anyway you can show how you have your terminal setup? love the aesthetic!
Is vulnlab free like hackthebox?
Which theme are you using for vscode? This looks very nice.
I wouldn't have managed this box
😮 you have a mindset that I want to develop this large-scale vision of things
I wish we had an automated tool 🔧 to perform 🎭 such extreme level http request smuggling 😢... this is insane beyond normal hackers' imagination!!! Ufff....Awesome 🕷♥️🥇💉🏆✔️🖊❤️👌🔧🎭🔥👍
thanks! very helpful and learned a tons. looking forward to more!
Damn this was super informative. Always learning new stuff from you guys, cheers for the content <3
i will join vuln lab within few days am so weak on AD i hope i will learn a lot from vuln lab <3
nice i3 theme ! and ofc thanks for this content !
thats default i3
@@ohmsohmsohms 🤣 Still cool
@@hadzah_fr lol for real
How can I achieve his level of skill?
Practice.
Masturbation.
Finally his back
That's the best HTB player for you. You inspire me!!
Congratulations on 3rd place at the HTB - Business CTF 2024. Thats the reason i found your channel and did the subscription. Love to view your videos and are hoping for more content. i learned a bit about burpsuite and other techniques in the 7 minutes xD Greetings from your neighbour country
🔥🔥🔥🔥
Love u Man greetings from chile I am learning a Lot from your content
Thanks you ! Your explanations are perfect to understand RBCD, I struggled on it most of the time but not anymore :D
Hey r0BIT!, for capturing the NTLMv2 challenge/response hash we could use our kali IP for redirecting traffic from smb.
cool !
Mad props for the privesc
love r0BIT!
wow...
Sehr gut erklärt <3
Awesome walkthrough, thanks brother
Bro is so good at these i wanna cry sometimes, Helpful video though, Thank you!
Amazing content and explanation. More videos by r0BIT.
Great
Nice use of Coercer! Have fun :)
very interesting attack path.
Loved it!
Nice and straight forward, as always. Love watching your content. Looking forward to the rest of the series.
love your videos, would be cool if you could make more hackthebox videos since I've seen you've been playing the seasonal boxes.
Nice machine! Is it dwm you're using?
i3
hi love the content question im a begineer and learning from you,, do you always run your terminal and have current directory Desktop? or do you create a file and do your work from there?