Recent Discussions
Logging and Monitoring in AWS: Demonstrate Your Skills
Hello, In Q3 Creating EventBridge I followed the instructions as exposed, but it didn't Detect the completion. Here's how I structured the Rule: Are there any error on the way I structured the rule (don't think so) or can it be an error on the lab itself (missing content)? Thanks in advance. Regards,Solved1like2CommentsFIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs
I am pulling my hair with this last question Rebuild the PowerShell script from the previous question using the three parts found in the PowerShell operational logs. What is the MD5 hash of this file? (The file should not contain any trailing white space or return characters) I ran index=* (EventCode=4104) | search "stager.ps1" AND "scriptblock" | table _raw and added the script content of files (1 of 3) (2 of 3) (3 of 3) to a new file. I removed the spaces and made sure they are glued together. I pasted the file in cyber chef with md5 selected and I keep getting the wrong hash. See a sample of the beginning and end of the 3 files This is just a sample below. I really don't know what else to do with this. $EncodedCompressedFile = @' 7b1pk+LKcjD83RH3P5y4cT/Y0ddusfXAfcMRT5U2JJCgBBJIDn8AAQIklmmgBfz6N7O00sCcnuuxH9vPUcRMo1qycqvMrFItfxmsgu3keHqf//avv/2fP//pH/5NiiJts9+9H//xz+H8fTuPatV/mUXRn//p u3rgE9+I/KPY62u+qTQuvp0Xqu3KPkEovj/867/++Z/+9A9/+oe/jFZbY7757V9/w1+96fpvf3NW78fTJCJRtPP/UfjrvxmT4/Lf//Y3Y3L+x79ML8f54V+6821wXP5VOFcEQfgn+FuDv/CnLnCY/za4HI7zzb9Yp+1xtZn/i7Y9zt93+8H8/WPlQ3Vj8n5YTiKAKe72lxToX4W/prj89aaVHEuOm/g+nxznwyX8mQFuRR38ja3//w== '@ $Decoded = [System.Convert]::FromBase64String($EncodedCompressedFile) $MemStream = New-Object System.IO.MemoryStream $MemStream.Write($Decoded, 0, $Decoded.Length) $MemStream.Seek(0,0) | Out-Null $CompressedStream = New-Object System.IO.Compression.DeflateStream($MemStream, [System.IO.Compression.CompressionMode]::Decompress) $StreamReader = New-Object System.IO.StreamReader($CompressedStream) $Output = $StreamReader.readtoend() $Output | IEXSolvedHelp with Introduction to Python Scripting: Ep.7 – Demonstrate Your Skills
Hello all, I am stuck with the last question on this Immersive lab . Below is my question Using Python, build a web scraper to scrape the website for 12-digit phone numbers beginning with + (e.g., +123456789012). The requests and BeautifulSoup4 (BS4) libraries are available to you. How many extracted phone numbers are returned? I created the following python script import requests from bs4 import BeautifulSoup import re url = "http://10.102.35.108:4321" try: response = requests.get(url) response.raise_for_status() # Raise an exception for bad status codes except requests.exceptions.RequestException as e: print(f"Error fetching the page: {e}") exit() soup = BeautifulSoup(response.text, 'html.parser') phone_pattern = r"\+\d{12}" found_numbers = re.findall(phone_pattern, soup.get_text()) num_found = len(found_numbers) print(f"Found {num_found} phone numbers:") for number in found_numbers: print(number) The value is 0, but I am getting an incorrect solution. please helpICS Malware: Triton - unpack trilog.exe
Hi. I get the following error when trying to unpack trilog.exe by: iml-user@ics-malware-triton:~/Desktop/Lab-Files/python_exe_unpacker$ python3 python_exe_unpack.py /Desktop/Lab-Files/trilog.exe Traceback (most recent call last): File "python_exe_unpack.py", line 14, in <module> import pefile ModuleNotFoundError: No module named 'pefile' Thanks.2likes5CommentsIntroduction to Detection Engineering: Ep.3 – Parent Processes - Kibana says no
Introduction to Detection Engineering: Ep.3 – Parent Processes Team, Trying to complete what should be a straightforward lab, however the elastic search is never ready. Is there any chance someone could take a look at this? I will try on better wifi later but i feel its more a lab issue than connection.1like2CommentsRadare2 Reverse Engineering: Ep.2 – Windows Binary Part 2
I have run into a challenge with Question 3 on this lab. I can't seem to get the appropriate md5 hash value for the .text section to correctly answer this question. I feel that I am close but slightly off on one of the mandatory calculations. Any insight or guidance on what I'm missing / doing incorrectly would be greatly appreciated. Thanks in advance.1like4CommentsPrivilege Escalation: Windows – Automated Enumeration
I am not sure if I am missing something or there is something buggy with this module. The last questions asks what was the total amount of flagged LOLBAS after running Seatbelt? I've run it more than once, and mine came back with 385 LOLBAS. I've tried that as the answer though and it tells me it's incorrect.0likes1Comment