- Видео 64
- Просмотров 26 347
Ben Folland
Добавлен 23 мар 2023
Hunting for malware persistence
This video covers an introduction into common malware persistence techniques, how they work, and how to hunt for these techniques using Autoruns.
MITRE ATTACK TA0003 - attack.mitre.org/tactics/TA0003/
Huntress Persistence Blog - www.huntress.com/defenders-handbooks/persistence-in-cybersecurity
Mandiant's 2024 M-Trend report - services.google.com/fh/files/misc/m-trends-2024.pdf
Lucifer Campaign - unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/
TrendMicro Services abused in Lusca ops - www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysi...
MITRE ATTACK TA0003 - attack.mitre.org/tactics/TA0003/
Huntress Persistence Blog - www.huntress.com/defenders-handbooks/persistence-in-cybersecurity
Mandiant's 2024 M-Trend report - services.google.com/fh/files/misc/m-trends-2024.pdf
Lucifer Campaign - unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/
TrendMicro Services abused in Lusca ops - www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysi...
Просмотров: 259
Видео
Unit42 - HackTheBox Sherlock Walkthrough
Просмотров 1,3 тыс.6 месяцев назад
In this HackTheBox Sherlock challenge will use Sysmon logs to investigate an intrusion pertaining to a backdoored UltraVNC malware sample that was discovered by Palo Alto's Unit42 team. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #dfir #securityoperations #digitalfor...
Brutus - HackTheBox Sherlock Walkthrough
Просмотров 3,2 тыс.7 месяцев назад
In the HackTheBox Brutus Sherlock challenge we'll investigate a successful SSH brute-force intrusion and analyse persistence, privilege escalation and command-execution TTPs after initial access was gained. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #dfir #securityo...
DarkGate Loader - Live Malware Analysis
Просмотров 5168 месяцев назад
This video covers me unravelling a .LNK sample of malware found on MalwareBazaar live, containing 8 stages, and leading to an installation of DarkGate Loader. Twitter Thread containing detailed analysis: x.com/polygonben/status/1768867675692831008 Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland...
Detecting Mimikatz - sekurlsa::logonpasswords
Просмотров 6388 месяцев назад
This videos covers a demonstration of the sekurlsa::logonpasswords Mimikatz function, to dump credentials from lsass.exe, alongside detection opportunities that may arise by using Sysmon telemetry. techcommunity.microsoft.com/t5/itops-talk-blog/deep-dive-logging-on-to-windows/ba-p/2420705 www.kayssel.com/post/active-directory-4-secrets-in-windows-systems/ github.com/ParrotSec/mimikatz learn.mic...
Photobomb - HackTheBox Walkthrough
Просмотров 2639 месяцев назад
Photobomb is an easy-rated Linux box that includes a blind command-injection to gain initial access, followed by abusing sudo privileges to gain a shell as root. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infosec #ctf #cybersecurity #...
Traverxec - HackTheBox walkthrough
Просмотров 4399 месяцев назад
Traverxec is an easy-rated Linux HTB Machine. We gain initial access by exploiting a vulnerability in the nostromo web server. After gaining an initial shell, we can discover a file path containing SSH keys to a user. After using this private key to authenticate as that user we can recover the user.txt flag. Finally, this user has a sudo capability to a binary which can be exploited to gain a r...
Frolic - HackTheBox Walkthrough
Просмотров 30010 месяцев назад
Useful resources: Ret2Libc - ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/ret2libc Frolic 0xdf Walkthrough - 0xdf.gitlab.io/2019/03/23/htb-frolic.html Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infosec #ctf #cybe...
Magic - HackTheBox Walkthrough
Просмотров 75710 месяцев назад
Magic HTB detailed walkthrough. This was a 'Medium' rated Linux box that involved exploiting SQL injection to access a image upload feature, that could be abused to upload a webshell. With initial access gained, we use previously stolen and reused credentials to move laterally. Finally, to gain root access, we can hijack the PATH of a SUID binary. Twitter ( polygonben) Medium Blog (m...
Broker - HackTheBox walkthrough (w/o Metasploit)
Просмотров 46410 месяцев назад
Broker HTB detailed walkthrough. This was a Linux machine that involved exploiting CVE-2023-46604 for initial access and abusing sudo permissions on nginx to privilege escalate to root! Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/in/ben-folland-309963233/) #hackthebox #pentesting #hacking #security #infos...
Sau - HackTheBox walkthrough
Просмотров 14810 месяцев назад
Sau is a 'Easy' Linux HTB machine. It includes a Request Baskets instance susceptible to Server-Side Request Forgery (SSRF) through CVE-2023-27163. By exploiting this vulnerability, we gain entry to a Maltrail instance that is vulnerable to Unauthenticated OS Command Injection, enabling us to gain initial access. Subsequently, we exploit a sudo misconfiguration to obtain a root shell. Twitter (...
HackTheBox Sherlock - Ticktock (DFIR CTF)
Просмотров 52711 месяцев назад
HackTheBox Sherlock - Ticktock (DFIR CTF)
Irked - HackTheBox walkthrough
Просмотров 40811 месяцев назад
Irked is a easy Hack The Box (HTB) challenge that presents a Linux machine to exploit. The machine involves exploiting vulnerabilities in IRC software to gain initial access, navigate through privilege escalation techniques, and ultimately achieve root access. Twitter ( polygonben) Medium Blog (medium.com/@polygonben) Personal Blog (polygonben.github.io/) LinkedIn (www.linkedin.com/i...
BabyRE - HackTheBox Basic Reverse Engineering
Просмотров 66Год назад
BabyRE - HackTheBox Basic Reverse Engineering
PicoCTF - More SQLi (Basic SQL Injection)
Просмотров 321Год назад
PicoCTF - More SQLi (Basic SQL Injection)
Enhance! - Simple PicoCTF Forensics challenge
Просмотров 99Год назад
Enhance! - Simple PicoCTF Forensics challenge
Chocolate Factory - Try Hack Me Live solve
Просмотров 106Год назад
Chocolate Factory - Try Hack Me Live solve
sound problem
I want help from you 🙏
Hello brother
Nice viddo? What is your discord username? I need some help
was great, thanks! was not really good into wireshark, helped a lot
You understand and explain better than most I've seen on this box. Everyone just seems to be following the same walkthrough, not understanding why theyre running the commands that they are, whereas you explained what you were doing. Nice one.
thnx for video
good video :D
good work man. I was loosing my shit with this box. Thanks for the help!!
Great Video, well explained, keep it up !
well done. a few notes, the function you wanted in python was "chr"... almost had it with char... also, the PDF was to deceive the user that something actually happened from the initial LNK file (that had a PDF icon). thanks for making this. very enjoyable.
Thanks for watching, I’m really glad you enjoyed it. Yes you’re right about the chr() function - it would’ve saved me a bit of time but hey ho! It wasn’t my smoothest video as it was live, however I did some deeper analysis & automated a lot of manual deobfusucation using CyberChef after recording & posted it on my Twitter: x.com/polygonben/status/1768867675692831008?s=46&t=Z6oSm07SkPk0O7rrcUf_Hg
Guide me on this. I found out that you'll get one IP on the exam. From that you have to identify the endpoints and then pivot to them. I found out two ways to find those is, with script to ping all the ips until I get the endpoints or use arp -a to get arp cache. Let me know if I am doing it correctly or is there any other on-point method to do it. Thanks ❤
the privilege escalation at the end is so helpful. The rest I could find after a while but priv esc is pretty hard. Thanks!!!
Fantastic videos, really helpful
Great walkthrough! Your detailed explanations and clear steps made it easy to follow along. Learned a lot from this-thank you for sharing! Looking forward to seeing more content like this from you.
Hi Karlo, thanks for the kind comments. It’s much appreciated - let me know if there any further Sherlock boxes you’d like me to cover 😀
this is the one video in the whole internet
good explanations, thx
its great...keep it up bro
Plz share your discord.
我宣布你是讲得最好的
thanks for ur effort bro
Hello, i am cyberjunkie, creator of this sherlock. Linper is a toolkit used for advanced persistence setup like rootkits etc. Its not like linpeas
Awesome video!
awesome video
🫡
Good deal sir!
Could you please recommend some material for the explanation at 13:31. I don't really get the meterpreter autorute section.
No worries - please see below resources - hopefully these should help :) ruclips.net/video/I3N2_arY9Kg/видео.html docs.metasploit.com/docs/using-metasploit/intermediate/pivoting-in-metasploit.html www.offsec.com/metasploit-unleashed/pivoting/
Thanks bro
Thanks for such a great content 🎉
Glad you enjoy it!
great explanation 🎉🎉
Thank you for sharing walkthrough.
I follow up until bind shell. I understand the need for different shells depending on the situation but I’m still learning use case scenarios
Nice job bro you saved me and my life, without you I would be lost forever, pleaes marry me
hi hoe you are doing well as i am completely nobe in cyber security, as i doing a cs degree but decided my career in cyber secuty pentester , now i don't understant from where i should start as i have basic skills of linux usage and networking too ,can you help me please
Please, zoom in. We can not read and see what you are typing!
45:32 When u did strings on the sysinfo binary we can see a popen() before calling the bash commands, so we can imagine that popen() is used to execute those commands. According to the documentation, popen() is returning "a pointer to an open stream that can be used to read or write to the pipe", i guess in that case the standard output might has been detoured to that stream. Might be wrong, simple supposition
At 22:20 i think the real reason why its not treating the file as image is because the file extension is png and its content type is image/jpeg
Hi, yes that looks to be the case. Thanks for pointing it out :)
.__ ___ .__
good stuff man, fun to see other people methodologies
poorly explanied sorry
Apologies you felt that way. If you want me to explain any part in more detail, I'm happy to go over it again.
Not clear
Apologies you felt that way. If you want me to explain any part in more detail, I'm happy to go over it again.
Nice🧠
Well explained. Thanks mate.
Great video..many thanks for this.
Amazing Mate
Please make beginner to advance level practical live website hacking, live website bug hunting, live website penetration testing, live website exploitation content video series... 🙏 😊 💯✌❤💚💙💜😍😘🤝
Thank you so much! So many “walkthroughs” that failed to explain how to get privesc.. They just got stuck, paused their vid, then came back with it magically working and didn’t say how… Thank you so much for clearly explaining how it works..
But on the exam you are not given two machines. How do you identify the second IP address on a compromised machine?
u can use a module of metasploit if is windows machine, if its a linux machine u can create a bash script where u do ping to the network with a loop, for example 192.168.0.x, the variable x increase +1
What module specifically. I dont see it mentioned in any of the training material.
@TalesforTots123 I guess after u obtain the meterpreter, u run bin bash and ifconfig command to see the victim-2 ip address and then try the autoroute command. after that, u can do a port scan or something to the victim-2 ip
@@TalesforTots123in the Metasploit MSF video, they covered basic pivoting in the enumeration section
@@johanjimenez3461 that's the only way to find endpoints we can pivot to, on the exam? Is there a module for both OS. Asking because I am going for this exam
Nice 👍🏼
I'm going to try this myself 👍🏼