Abusing Trust Boundaries for RCE
I'm a bit stuck on this one as I'm not that familiar with Git and all the associated terminology. How do I clone the repo? which dir does the .mcp.json file sit in? Does this not pre-exist as its adding extra capabilities\extension to the original code? Does the target host pull the file automatically to give me a shell? Many thanks - Gus
Threat Research: Dependency Confusion exercise 8
Humble Pie is not updating after 60 seconds it is stuck in the version 1.0.0 my packages have been created my setup.py seems to be working fine But I am never getting an answer in listening, never getting the connection and build.log is NEVER updating to latest version why is this not working... I really need to have this lab finished for my work.
Struggling to find the IT email on Simulations: BarterTown Delivery
During the last few days, I’ve been stuck on this lab, and I’m not sure what I’m missing. The lab asks us to use OSINT tools and techniques to gather intelligence about individuals to target within the organization, with the goal of testing the awareness of BarterTown’s IT staff and eventually gaining a foothold in the internal network. I’ve been using the information provided by the lab as a starting point for my reconnaissance. The website gives us several employees and their email addresses, but none of them are identified as IT staff. I also found the DNS SOA contact (hostmaster.bartertown.bitnet), but that appears to be a standard administrative DNS alias rather than an actual employee. The mail server does not seem to allow useful anonymous user enumeration, and the other reconnaissance results have not revealed the missing user. Has anyone completed this lab and can give me a hint about where/how the missing target information is supposed to be discovered?
DFIR CTF: LightNeuron DLL - Question 8
In relation towards finding the decrypted email. I am wondering about what I am getting wrong from the conditional breakpoint in order to expose all the decrypted strings after the return function After searching up the XOR key location I went to from Ghidra Through the RET function which I thought would expose the strings I ran going to the ret function then after following the process in order to go to the DLL malware and got into the ret function I set the breakpoint and debug restarted However, it kept saying memory address unavailable. such as this also includes setting the CF flag to 0 I am wondering about what I am doing wrong here and where should I dig deeper? Note: used Gemini to help look into possible solutions however, refered to https://www.youtube.com/watch?v=Tc8Wl37uwYc for aid
Immersive Labs- Create a detection rule - Google SecOps
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hello everyone, I hope you can help me. I am currently taking the "Google SecOps Fundamentals: Demonstrate Your Skills" course, and I am stuck on Task 12, where I need to create a detection rule. I have already created the rule, but the lab is not recognizing it or marking the task as completed. The instructions say that I need to create a rule that detects communication with one of the specified domains. I have configured the following rule, but I'm not sure if it is correct. I am not very experienced with Chronicle/Google SecOps, so I am having trouble understanding what I might be missing. Does anyone know what could be wrong or what additional configuration is required for the task to be validated? Any guidance would be greatly appreciated. Thank you! This is the rule I created: rule lumma_c2_iocs { meta: author = "Diana Quezadas" description = "Detect DNS queries to known Lumma C2 IOC domain." severity = "HIGH" events: $e.metadata.event_type = "NETWORK_DNS" $ioc_url = $e.network.dns.questions.name re.regex( $ioc_url, `(?i)^forbidstow\.site$` ) outcome: $domain = array_distinct($ioc_url) $risk_score = 85 condition: $e }Investigating IAM Incidents in AWS: Preparation - Question 7
For the question: The ‘MetrolioQA’ IAM role in your account grants write access to a ‘metrolio’ role from another account. What is the full name of the external principle? I can't seem to find insight onto the role. I am wondering about what is the location of the GUI I should be looking into more of. I have mostly been digging throughout the csv download for any possible insights as well as the IAM access analyzer but I cant seem to get any good leads. Done through the MetrolioIAMAnalyst AWS role account. Summary: I am wondering if there is any direction that can be provided in which I can look into more for finding external principles.
