00:50 - Begin of Reocn
03:30 - Using SMBMap to enumerate fileshares
05:45 - Discovering an Excel Macro File
09:25 - Using olevba to extract macro from the document to discover credentials
11:15 - Using MSSQLClient.py from Impacket to log into the SQL Server
12:15 - Doing the SQL CMD:XP_DIRTREE to read a file off a UNC Share to steal the hash with Responder
13:15 - Cracking the NetNTLMv2 Hash
14:11 - Explaining the Responder Database file to view previously captured hashes
16:30 - Logging into the SQL Server with the cracked account, then doing XP_CMDSHELL to run commands
17:50 - Getting a Nishang Reverse Shell
22:00 - Running PowerUp, doing Invoke-ServiceAbuse and discovering creds in an old Group Policy Object
** For some reason the user created with Invoke-ServiceAbuse cannot write to C$ so no psexec :(
26:30 - Going back to the password disclosed via Group Policy and discovering they are an administrator
28:00 - Explaining how the PowerUp module decrypted a password out of Group Policy
29:10 - Getting VIM to highlight the syntax of Powershell
34:50 - Rooting the box with Invoke-ServiceAbuse