Ben Folland
Ben Folland
  • Видео 64
  • Просмотров 26 347
Hunting for malware persistence
This video covers an introduction into common malware persistence techniques, how they work, and how to hunt for these techniques using Autoruns.
MITRE ATTACK TA0003 - attack.mitre.org/tactics/TA0003/
Huntress Persistence Blog - www.huntress.com/defenders-handbooks/persistence-in-cybersecurity
Mandiant's 2024 M-Trend report - services.google.com/fh/files/misc/m-trends-2024.pdf
Lucifer Campaign - unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/
TrendMicro Services abused in Lusca ops - www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysi...
Просмотров: 259

Видео

Unit42 - HackTheBox Sherlock Walkthrough
Просмотров 1,3 тыс.6 месяцев назад
In this HackTheBox Sherlock challenge will use Sysmon logs to investigate an intrusion pertaining to a backdoored UltraVNC malware sample that was discovered by Palo Alto's Unit42 team. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #dfir #securityoperations #digitalfor...
Brutus - HackTheBox Sherlock Walkthrough
Просмотров 3,2 тыс.7 месяцев назад
In the HackTheBox Brutus Sherlock challenge we'll investigate a successful SSH brute-force intrusion and analyse persistence, privilege escalation and command-execution TTPs after initial access was gained. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #dfir #securityo...
DarkGate Loader - Live Malware Analysis
Просмотров 5168 месяцев назад
This video covers me unravelling a .LNK sample of malware found on MalwareBazaar live, containing 8 stages, and leading to an installation of DarkGate Loader. Twitter Thread containing detailed analysis: x.com/polygonben/status/1768867675692831008 Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland...
Detecting Mimikatz - sekurlsa::logonpasswords
Просмотров 6388 месяцев назад
This videos covers a demonstration of the sekurlsa::logonpasswords Mimikatz function, to dump credentials from lsass.exe, alongside detection opportunities that may arise by using Sysmon telemetry. techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-logging-on-to-windows/ba-p/2420705 www.kayssel.com/post/active-directory-4-secrets-in-windows-systems/ github.com/ParrotSec/mimikatz learn.mic...
Photobomb - HackTheBox Walkthrough
Просмотров 2639 месяцев назад
Photobomb is an easy-rated Linux box that includes a blind command-injection to gain initial access, followed by abusing sudo privileges to gain a shell as root. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infosec #ctf #cybersecurity #...
Traverxec - HackTheBox walkthrough
Просмотров 4399 месяцев назад
Traverxec is an easy-rated Linux HTB Machine. We gain initial access by exploiting a vulnerability in the nostromo web server. After gaining an initial shell, we can discover a file path containing SSH keys to a user. After using this private key to authenticate as that user we can recover the user.txt flag. Finally, this user has a sudo capability to a binary which can be exploited to gain a r...
Frolic - HackTheBox Walkthrough
Просмотров 30010 месяцев назад
Useful resources: Ret2Libc - ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/ret2libc Frolic 0xdf Walkthrough - 0xdf.gitlab.io/2019/03/23/htb-frolic.html Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infosec #ctf #cybe...
Magic - HackTheBox Walkthrough
Просмотров 75710 месяцев назад
Magic HTB detailed walkthrough. This was a 'Medium' rated Linux box that involved exploiting SQL injection to access a image upload feature, that could be abused to upload a webshell. With initial access gained, we use previously stolen and reused credentials to move laterally. Finally, to gain root access, we can hijack the PATH of a SUID binary. Twitter ( polygonben) Medium Blog (m...
Broker - HackTheBox walkthrough (w/o Metasploit)
Просмотров 46410 месяцев назад
Broker HTB detailed walkthrough. This was a Linux machine that involved exploiting CVE-2023-46604 for initial access and abusing sudo permissions on nginx to privilege escalate to root! Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infos...
Sau - HackTheBox walkthrough
Просмотров 14810 месяцев назад
Sau is a 'Easy' Linux HTB machine. It includes a Request Baskets instance susceptible to Server-Side Request Forgery (SSRF) through CVE-2023-27163. By exploiting this vulnerability, we gain entry to a Maltrail instance that is vulnerable to Unauthenticated OS Command Injection, enabling us to gain initial access. Subsequently, we exploit a sudo misconfiguration to obtain a root shell. Twitter (...
OpenAdmin - HackTheBox walkthrough
Просмотров 13610 месяцев назад
OpenAdmin - HackTheBox walkthrough
HackTheBox Sherlock - Ticktock (DFIR CTF)
Просмотров 52711 месяцев назад
HackTheBox Sherlock - Ticktock (DFIR CTF)
Irked - HackTheBox walkthrough
Просмотров 40811 месяцев назад
Irked is a easy Hack The Box (HTB) challenge that presents a Linux machine to exploit. The machine involves exploiting vulnerabilities in IRC software to gain initial access, navigate through privilege escalation techniques, and ultimately achieve root access. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/i...
Love - HackTheBox walkthrough
Просмотров 465Год назад
Love - HackTheBox walkthrough
BabyRE - HackTheBox Basic Reverse Engineering
Просмотров 66Год назад
BabyRE - HackTheBox Basic Reverse Engineering
Java Code Analysis!?! - PicoCTF
Просмотров 239Год назад
Java Code Analysis!?! - PicoCTF
PicoCTF - More SQLi (Basic SQL Injection)
Просмотров 321Год назад
PicoCTF - More SQLi (Basic SQL Injection)
Enhance! - Simple PicoCTF Forensics challenge
Просмотров 99Год назад
Enhance! - Simple PicoCTF Forensics challenge
Return - HackTheBox walkthrough
Просмотров 182Год назад
Return - HackTheBox walkthrough
BountyHunter - HackTheBox walkthrough
Просмотров 66Год назад
BountyHunter - HackTheBox walkthrough
Most Cookies - PicoCTF
Просмотров 320Год назад
Most Cookies - PicoCTF
PicoCTF - SOAP (XXE)
Просмотров 100Год назад
PicoCTF - SOAP (XXE)
Blueprint - Try Hack Me walkthrough
Просмотров 146Год назад
Blueprint - Try Hack Me walkthrough
Chocolate Factory - Try Hack Me Live solve
Просмотров 106Год назад
Chocolate Factory - Try Hack Me Live solve
Mustacchio TryHackMe walkthrough
Просмотров 335Год назад
Mustacchio TryHackMe walkthrough
Overpass - TryHackMe walkthrough
Просмотров 717Год назад
Overpass - TryHackMe walkthrough
Willow - TryHackMe walkthrough
Просмотров 226Год назад
Willow - TryHackMe walkthrough
HaskHell - TryHackMe walkthrough
Просмотров 94Год назад
HaskHell - TryHackMe walkthrough
TechSupport - TryHackMe walkthrough
Просмотров 49Год назад
TechSupport - TryHackMe walkthrough

Комментарии

  • @anonymouskashmir007
    @anonymouskashmir007 Месяц назад

    sound problem

  • @jigneshpatel2184
    @jigneshpatel2184 Месяц назад

    I want help from you 🙏

  • @jigneshpatel2184
    @jigneshpatel2184 Месяц назад

    Hello brother

  • @Googleplayfan
    @Googleplayfan Месяц назад

    Nice viddo? What is your discord username? I need some help

  • @Sodatex
    @Sodatex 2 месяца назад

    was great, thanks! was not really good into wireshark, helped a lot

  • @banditlkid
    @banditlkid 2 месяца назад

    You understand and explain better than most I've seen on this box. Everyone just seems to be following the same walkthrough, not understanding why theyre running the commands that they are, whereas you explained what you were doing. Nice one.

  • @Priya-h1q4q
    @Priya-h1q4q 2 месяца назад

    thnx for video

  • @abelromeroruiz5702
    @abelromeroruiz5702 2 месяца назад

    good video :D

  • @iShootidiots
    @iShootidiots 2 месяца назад

    good work man. I was loosing my shit with this box. Thanks for the help!!

  • @lars-010
    @lars-010 4 месяца назад

    Great Video, well explained, keep it up !

  • @claymoody
    @claymoody 4 месяца назад

    well done. a few notes, the function you wanted in python was "chr"... almost had it with char... also, the PDF was to deceive the user that something actually happened from the initial LNK file (that had a PDF icon). thanks for making this. very enjoyable.

    • @polygonben
      @polygonben 4 месяца назад

      Thanks for watching, I’m really glad you enjoyed it. Yes you’re right about the chr() function - it would’ve saved me a bit of time but hey ho! It wasn’t my smoothest video as it was live, however I did some deeper analysis & automated a lot of manual deobfusucation using CyberChef after recording & posted it on my Twitter: x.com/polygonben/status/1768867675692831008?s=46&t=Z6oSm07SkPk0O7rrcUf_Hg

  • @camoo7815
    @camoo7815 4 месяца назад

    Guide me on this. I found out that you'll get one IP on the exam. From that you have to identify the endpoints and then pivot to them. I found out two ways to find those is, with script to ping all the ips until I get the endpoints or use arp -a to get arp cache. Let me know if I am doing it correctly or is there any other on-point method to do it. Thanks ❤

  • @bobbyrandomguy1489
    @bobbyrandomguy1489 5 месяцев назад

    the privilege escalation at the end is so helpful. The rest I could find after a while but priv esc is pretty hard. Thanks!!!

  • @herllo2u2
    @herllo2u2 5 месяцев назад

    Fantastic videos, really helpful

  • @KarloJedvaj
    @KarloJedvaj 5 месяцев назад

    Great walkthrough! Your detailed explanations and clear steps made it easy to follow along. Learned a lot from this-thank you for sharing! Looking forward to seeing more content like this from you.

    • @polygonben
      @polygonben 5 месяцев назад

      Hi Karlo, thanks for the kind comments. It’s much appreciated - let me know if there any further Sherlock boxes you’d like me to cover 😀

  • @MalisaKomalKumar
    @MalisaKomalKumar 6 месяцев назад

    this is the one video in the whole internet

  • @simonst9r
    @simonst9r 6 месяцев назад

    good explanations, thx

  • @hafizalimansoor2879
    @hafizalimansoor2879 6 месяцев назад

    its great...keep it up bro

  • @Harris.Qaisrani
    @Harris.Qaisrani 6 месяцев назад

    Plz share your discord.

  • @沈剑心我独自升级
    @沈剑心我独自升级 6 месяцев назад

    我宣布你是讲得最好的

  • @bleuforcedz6727
    @bleuforcedz6727 6 месяцев назад

    thanks for ur effort bro

  • @abdullahyasin3055
    @abdullahyasin3055 6 месяцев назад

    Hello, i am cyberjunkie, creator of this sherlock. Linper is a toolkit used for advanced persistence setup like rootkits etc. Its not like linpeas

  • @DartrIxBTD
    @DartrIxBTD 6 месяцев назад

    Awesome video!

  • @DartrIxBTD
    @DartrIxBTD 7 месяцев назад

    awesome video

  • @wrathofainz
    @wrathofainz 7 месяцев назад

    🫡

  • @welintonpayano2854
    @welintonpayano2854 7 месяцев назад

    Good deal sir!

  • @gaborantal997
    @gaborantal997 7 месяцев назад

    Could you please recommend some material for the explanation at 13:31. I don't really get the meterpreter autorute section.

    • @polygonben
      @polygonben 7 месяцев назад

      No worries - please see below resources - hopefully these should help :) ruclips.net/video/I3N2_arY9Kg/видео.html docs.metasploit.com/docs/using-metasploit/intermediate/pivoting-in-metasploit.html www.offsec.com/metasploit-unleashed/pivoting/

  • @mmavsufc9848
    @mmavsufc9848 8 месяцев назад

    Thanks bro

  • @ziajalali3906
    @ziajalali3906 8 месяцев назад

    Thanks for such a great content 🎉

    • @polygonben
      @polygonben 8 месяцев назад

      Glad you enjoy it!

  • @ziajalali3906
    @ziajalali3906 9 месяцев назад

    great explanation 🎉🎉

  • @I_want_you_now
    @I_want_you_now 9 месяцев назад

    Thank you for sharing walkthrough.

  • @ReverseShell1337
    @ReverseShell1337 9 месяцев назад

    I follow up until bind shell. I understand the need for different shells depending on the situation but I’m still learning use case scenarios

  • @xt355
    @xt355 9 месяцев назад

    Nice job bro you saved me and my life, without you I would be lost forever, pleaes marry me

  • @itsecurity2423
    @itsecurity2423 9 месяцев назад

    hi hoe you are doing well as i am completely nobe in cyber security, as i doing a cs degree but decided my career in cyber secuty pentester , now i don't understant from where i should start as i have basic skills of linux usage and networking too ,can you help me please

  • @ferasalfarsi897
    @ferasalfarsi897 10 месяцев назад

    Please, zoom in. We can not read and see what you are typing!

  • @mcazertox6530
    @mcazertox6530 10 месяцев назад

    45:32 When u did strings on the sysinfo binary we can see a popen() before calling the bash commands, so we can imagine that popen() is used to execute those commands. According to the documentation, popen() is returning "a pointer to an open stream that can be used to read or write to the pipe", i guess in that case the standard output might has been detoured to that stream. Might be wrong, simple supposition

  • @mcazertox6530
    @mcazertox6530 10 месяцев назад

    At 22:20 i think the real reason why its not treating the file as image is because the file extension is png and its content type is image/jpeg

    • @polygonben
      @polygonben 10 месяцев назад

      Hi, yes that looks to be the case. Thanks for pointing it out :)

  • @UmairAli-k2e
    @UmairAli-k2e 10 месяцев назад

    .__ ___ .__

  • @nocturne2172
    @nocturne2172 10 месяцев назад

    good stuff man, fun to see other people methodologies

  • @IMPACT_INVASION-15U
    @IMPACT_INVASION-15U 11 месяцев назад

    poorly explanied sorry

    • @polygonben
      @polygonben 11 месяцев назад

      Apologies you felt that way. If you want me to explain any part in more detail, I'm happy to go over it again.

  • @newcollections7365
    @newcollections7365 11 месяцев назад

    Not clear

    • @polygonben
      @polygonben 11 месяцев назад

      Apologies you felt that way. If you want me to explain any part in more detail, I'm happy to go over it again.

  • @ErlonsouzaAlves
    @ErlonsouzaAlves 11 месяцев назад

    Nice🧠

  • @DrixoerTheDarklord
    @DrixoerTheDarklord Год назад

    Well explained. Thanks mate.

  • @UGPVlogsLA
    @UGPVlogsLA Год назад

    Great video..many thanks for this.

  • @sabarishAB-y3o
    @sabarishAB-y3o Год назад

    Amazing Mate

  • @Free.Education786
    @Free.Education786 Год назад

    Please make beginner to advance level practical live website hacking, live website bug hunting, live website penetration testing, live website exploitation content video series... 🙏 😊 💯✌❤💚💙💜😍😘🤝

  • @Thatoneguy-p1d
    @Thatoneguy-p1d Год назад

    Thank you so much! So many “walkthroughs” that failed to explain how to get privesc.. They just got stuck, paused their vid, then came back with it magically working and didn’t say how… Thank you so much for clearly explaining how it works..

  • @martinlastname8548
    @martinlastname8548 Год назад

    But on the exam you are not given two machines. How do you identify the second IP address on a compromised machine?

    • @johanjimenez3461
      @johanjimenez3461 Год назад

      u can use a module of metasploit if is windows machine, if its a linux machine u can create a bash script where u do ping to the network with a loop, for example 192.168.0.x, the variable x increase +1

    • @TalesforTots123
      @TalesforTots123 10 месяцев назад

      What module specifically. I dont see it mentioned in any of the training material.

    • @boyuhuang3978
      @boyuhuang3978 9 месяцев назад

      ​@TalesforTots123 I guess after u obtain the meterpreter, u run bin bash and ifconfig command to see the victim-2 ip address and then try the autoroute command. after that, u can do a port scan or something to the victim-2 ip

    • @boyuhuang3978
      @boyuhuang3978 9 месяцев назад

      ​@@TalesforTots123in the Metasploit MSF video, they covered basic pivoting in the enumeration section

    • @camoo7815
      @camoo7815 4 месяца назад

      ​@@johanjimenez3461 that's the only way to find endpoints we can pivot to, on the exam? Is there a module for both OS. Asking because I am going for this exam

  • @BrickTop086
    @BrickTop086 Год назад

    Nice 👍🏼

  • @BrickTop086
    @BrickTop086 Год назад

    I'm going to try this myself 👍🏼