https://stream.echo6.co/videos/watch/60a18bda-bda2-4364-8860-e271b0098275 00:00 - Introduction 01:00 - Start of nmap 04:50 - Looking at what an XLL Is 06:50 - Finding a skeleton xll payload, then compiling it on Linux 12:20 - Shell returned, grabbing the NTLMv2 Hash of our user with responder 17:45 - Looking into hMailServer, discovering emails from other users. Hints at dropping URL Shortcuts in a directory 21:20 - Converting the XLL Payload to an exe, then uploading it to the box and creating a URL Shortcut and getting shell as Dallon.Matrix 25:40 - Using Powershell to search a directory for files containing password, discovering the Powershell ConsoleHost_History 28:00 - Using Bloodhound.Py to get bloodhound data 37:20 - Discovering we can ForceChangePassword on other users 42:15 - For some reason our Bloodhound Python Ingestor didn't get the WinRM Edge, running Sharphound to see it should of been there 46:00 - The users in App Dev can enter the "App Development" directory which has a program called kbfiltr, and a hint towards StandaloneRunner.exe being ran 50:45 - Creating the StandaloneRunner LOLBin and waiting for the scheduled task to open the exe to get a shell as administrator Wed, 15 Apr 2026 11:41:51 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://stream.echo6.co https://stream.echo6.co/client/assets/images/icons/icon-512x512.png https://stream.echo6.co/videos/watch/60a18bda-bda2-4364-8860-e271b0098275 All rights reserved, unless otherwise specified in the terms specified at https://stream.echo6.co/about and potential licenses granted by each content's rightholder.