Threat Hunting: Investigating a Fake PoC Q9

Question

I am having issues trying to solve this last question.
After running some obfuscated Powershell commands, the program outputs either a success or a failure message. What command is executed that sets the value of the "text" variable within the "main" function? Any tip?

Thanks

netcat · Answer

Assuming you solved the previous questions, found the main function:Locate the row with "text = foo.bar()" and enter "foo.bar()". Too easy.

Forum Discussion

Threat Hunting: Investigating a Fake PoC Q9

1 Reply

Featured Places

Help & Support Forum

Related Content

Help needed for Threat Hunting: Mining Behaviour

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

Help needed for Threat Hunting - Credential Access

APT29 Threat Hunting with Splunk: Ep.11 – Demonstrate Your Skills - Question to Q9

APT29 Threat Hunting with Elasticsearch: Ep.5 – LNK File Analysis - Tools?

Recent Discussions

Threat Hunting: Investigating a Fake PoC Q9

Stuck on “Server-Side Template Injection: Ep.2 – Identifying SSTI Vulnerabilities”

Stuck on "SQL Injection (Module 1) : File download"

MassMutual Node.js Developer - Basic Training

Incident Response