00:00 - Introduction 00:52 - Start of nmap 02:25 - Authenticating as alex.turner with NetExec (this is an assumed breach box), listing the domain users and noticing several accounts had their passwords set around the same time 04:10 - Enumerating SMB shares and finding DevDrop, a share for approved VS Code extensions. We only have read access for now 05:32 - Collecting BloodHound data with RustHound-CE, then using bloodyAD get writable to find write access over the Deleted Objects container and GenericWrite over a deleted user, mark.davies 11:52 - Using the NetExec tombstone module to list the deleted mark.davies account and restore it out of the AD Recycle Bin 14:35 - Logging in as mark.davies through password reuse (Checkpoint2024! is the help desk default) and seeing that this account now has write access to the DevDrop share 17:22 - Building a malicious VS Code extension with yo code, pasting in a Node reverse shell, and packaging it to a vsix while setting the engine to 1.118.0 to match the share 26:30 - Adding the onStartupFinished activation event so the extension runs when VS Code opens, swapping sh for cmd.exe, uploading to DevDrop and catching a shell as ryan.brooks 30:38 - BloodHound shows ryan.brooks has GenericWrite over svc_deploy; grabbing a TGT with Rubeus tgtdeleg and converting it to a ccache so we can run bloodyAD 35:10 - Explaining dMSA and the BetterSuccessor technique (BadSuccessor itself is patched on Server 2025), then running bloodyAD add badSuccessor to dump svc_deploy's NTLM hash 39:25 - Authenticating as svc_deploy and reading the VMBackups share, which holds huge VMware files that would take forever to exfil 41:10 - Running vmkatz on the box against the VM memory snapshot to pull the local Administrator NTLM hash without downloading the backups 44:33 - Reusing that hash for the domain Administrator over evil-winrm and grabbing the user and root flags
Trust cues for videos
