00:00 - Into
00:54 - Begin of recon
03:36 - Using rpcclient with null authentication and dumping active directory users
06:26 - Building a password list with hashcat --stdout (Forest Video does it better)
08:41 - CrackMapExec shows SABatchJobs:SABatchJobs are valid credentials
12:06 - Using SMBMap to list contents of directories
16:20 - Using SMBMap to download azure.xml which has a hardcoded credential in it then testing with WinRM to see if we can get a shell
19:50 - Downloading and running Seatbelt on the server
25:20 - Running WinPEAS for a second opinion
27:45 - Talking about the Azure Admins group
28:55 - Playing with SQLCMD to view the MSSQL Database
30:45 - Downloading and running PowerUpSQL to see if there's any obvious escalation paths
37:00 - Using XP_DIRTREE to connect to our Responder Instance and leak an NetNTLMv2 hash (I should of noticed its the machine account due to username ending with a $, these are pretty much never crackable)
39:45 - Searching google to find XPNSec's post on "Azure AD Connect for Red Teamers"
43:00 - Running through the commands with SQLCMD to understand what is going on
48:20 - Executing the Azure AD Connectdecryption script and having Evil-WinRM Crash on us
49:10 - Stepping through the script to see where it is failing
51:25 - Updating the SQL Connection script to work with our MSSQL Configuration, then fixing the script
55:40 - Running the updated script, and getting the administrator password then using PSExec to get a system shell on the box
58:30 - Using DNSPY to decompile the MCRYPT.DLL binary to just explore what is going on
1:03:50 - Dumping the DNS Zone for MEGABANK.LOCAL via powershell