Htb

Bagel involved dealing with file read vulnerability, reading the application source code (app.py) which reveals that it’s using web sockets, connecting to a dotnet application and mentions about a DLL which we can read by fuzzing for process ID /proc/$PID/fd which is the file that the process has open on…

Hey there, amazing readers! I must begin this blog post by saying I owe you a massive apology for my sudden vanishing act. Work took over my life like a stampede of caffeinated squirrels, leaving me no choice but to bid you farewell for a week. …

When a thing casts a shadow, it is surely there. When Windows Active Directory began the policy of shadow copy creation, we thought “Neat! We can now safely backup our entire filesystem to the AD server on the fly.” We thought this would protect us from some of the damages…

Timelapse is a retired box on Hack The Box, that provides a fun experience for developing your Active Directory and PowerShell skills as a penetration tester. Let’s start enumeration with a basic NMAP scan: nmap -sV -sC -oN scan.txt -O -p 1-65535 10.10.11.152

Challenge description: The finance team received an important looking email containing an attached Word document. Can you take a look and confirm if it's malicious? For this challenge we we’re given a UrgentPayment.doc file, with the task to find out if it’s malicious. Word documents can made malicous with the…

Challenge description: A client reported that a PC might have been infected, as it's running slow. We've collected all the evidence from the suspect workstation, and found a suspicious trace of USB traffic. Can you identify the compromised data? For this challenge we were supplied a keystrokes.pcapng …

Challenge description: A potential insider threat has been reported, and we need to find out what they accessed. Can you help? This challenge provided us with a folder called ‘Mozilla’, with subfolders ‘Extensions’, ‘Firefox’ and ‘SystemExtensionsDev’. …

Challenge description: We spotted a suspicious connection to one of our servers, and immediately took a memory dump. Can you figure out what the attackers were up to? We are given a memory dump file WIN-LQS146OE2S1–20201027–142607.raw to work with. I used the tool Volatility to extract interesting information. Just to…

Absolute involved extracting usernames from image’s meta data, using a tool named anarchy to generate pattern for generating usernames, using kerbrute to find valid usernames, we’ll get a user d.klay who has pre-authentication disabled leading to AS-REP roasting, cracking the hash the credentials won’t work as NTLM auth is disabled…