feedback
11 Topics
Active Directory Basics: Demonstrate Your Skills
Hey team, i am working on the lab in the title and quite sure there's an issue with the answer for one of the questions. 12. What is the full name of the user on COMP-SIREN that begins with L? I am pretty sure it is Larry Young as you can see from the screenshot. Could i check whether there is an error with the question? Or am i missing somethingSolved53Views0likes3Comments
FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs
I am pulling my hair with this last question Rebuild the PowerShell script from the previous question using the three parts found in the PowerShell operational logs. What is the MD5 hash of this file? (The file should not contain any trailing white space or return characters) I ran index=* (EventCode=4104) | search "stager.ps1" AND "scriptblock" | table _raw and added the script content of files (1 of 3) (2 of 3) (3 of 3) to a new file. I removed the spaces and made sure they are glued together. I pasted the file in cyber chef with md5 selected and I keep getting the wrong hash. See a sample of the beginning and end of the 3 files This is just a sample below. I really don't know what else to do with this. $EncodedCompressedFile = @' 7b1pk+LKcjD83RH3P5y4cT/Y0ddusfXAfcMRT5U2JJCgBBJIDn8AAQIklmmgBfz6N7O00sCcnuuxH9vPUcRMo1qycqvMrFItfxmsgu3keHqf//avv/2fP//pH/5NiiJts9+9H//xz+H8fTuPatV/mUXRn//p u3rgE9+I/KPY62u+qTQuvp0Xqu3KPkEovj/867/++Z/+9A9/+oe/jFZbY7757V9/w1+96fpvf3NW78fTJCJRtPP/UfjrvxmT4/Lf//Y3Y3L+x79ML8f54V+6821wXP5VOFcEQfgn+FuDv/CnLnCY/za4HI7zzb9Yp+1xtZn/i7Y9zt93+8H8/WPlQ3Vj8n5YTiKAKe72lxToX4W/prj89aaVHEuOm/g+nxznwyX8mQFuRR38ja3//w== '@ $Decoded = [System.Convert]::FromBase64String($EncodedCompressedFile) $MemStream = New-Object System.IO.MemoryStream $MemStream.Write($Decoded, 0, $Decoded.Length) $MemStream.Seek(0,0) | Out-Null $CompressedStream = New-Object System.IO.Compression.DeflateStream($MemStream, [System.IO.Compression.CompressionMode]::Decompress) $StreamReader = New-Object System.IO.StreamReader($CompressedStream) $Output = $StreamReader.readtoend() $Output | IEXSolved51Views0likes1CommentWinDbg: Ep.3 – Debugging Malware
The briefing says: [...] bp kernel32!LoadLibraryA ".printf \"Loading Library: %ma\",poi(esp+0x4);.echo};g"bp kernel32!GetProcAddress ".printf \"\t Looking up function: %ma\",poi(esp+0x8);.echo;g"bp advapi32!CreateServiceW ".printf \"Creating Service: \";.echo;.printf \"\tService Name: %mu\",poi(esp+0x4);.echo;.printf \"\tDisplay Name: %mu\",poi(esp+0x8);.echo;g" [...] Yet, none of these work. The OS was updated, the instructions not. Fix: bp KernelBase!LoadLibraryA bp KernelBase!GetProcAddress bp sechost!CreateServiceWSolved142Views1like1CommentRemove the panel on Linux?
On most Linux systems (except for e.g. Kali Linux) there's a panel at the bottom. The first thing I do usually: killall xfce4-panel Maybe it's better with larger screens, but on laptop screens that panel is really a waste of screen space. How's about removing it?Solved54Views0likes1Comment
Open Source Intelligence (OSINT): Boarding Pass
Has anyone else had issues with this entire OSINT lab? In the Social Media lab, I had to create a throwaway X account just to be able to find the content on the Dade Murphy profile. Perhaps this lab should be updated to reflect the way X operates now, with limits on what can and can't be viewed without logging into an account. I'm now on the Boarding Pass lab, where I have to continue the OSINT research into Dade's Facebook profile. I'm having significant issues with The Wayback Machine, as it only allows me to access 1 of the 16 captures showing. However, I can't view anything on this 1 accessible profile as I am not logged in, yet I cannot log in through The Wayback Machine. The lab requires me to find and view an image of a boarding pass he has apparently uploaded, to do some OSINT research on the data within it, but I can't view any images at all! It seems like this lab isn't possible at the moment for me. Does anyone have any tips on this? ThanksSolved107Views0likes4Comments
Node.js - Beginner -- What am I missing?
In the Node.js - Beginner collection there is a practical lab on Forced Browsing. I have completed what is setup as the criteria for the lab but it keeps telling me that the code isn't secure. I have tested with two different users and the solution works to prevent forced browsing. Is there some other criteria that needs to be met that I'm missing. Remediation: Authorization check: returns a 401 if the user isn't logged in I have also added the author check to verify that only the logged in user retrieves their own drafts.Solved193Views1like5Comments
tweaks to career paths
Hi - I'm reasonably close to finishing career path: Advanced Threat Hunting and Digital Forensics However I really don't like the look of "DFIR CTF: LightNeuron DLL" Is it possible to get the career path amended so that this lab does not have to be completed. many thanks - gusSolved114Views1like2Comments
