DFIR CTF: LightNeuron DLL - Question 8
In relation towards finding the decrypted email. I am wondering about what I am getting wrong from the conditional breakpoint in order to expose all the decrypted strings after the return function After searching up the XOR key location I went to from Ghidra Through the RET function which I thought would expose the strings I ran going to the ret function then after following the process in order to go to the DLL malware and got into the ret function I set the breakpoint and debug restarted However, it kept saying memory address unavailable. such as this also includes setting the CF flag to 0 I am wondering about what I am doing wrong here and where should I dig deeper? Note: used Gemini to help look into possible solutions however, refered to https://www.youtube.com/watch?v=Tc8Wl37uwYc for aid
Brute Force task in an 15 min lab taking over 30 hours to complete
Hello everyone, I am doing an Immersive Labs about hacking, and there is a lab where I can learn how to crack codes with Hydra using SSH, HTTP, and FTP. The problem is that for the FTP part, I am supposed to brute-force a password (a 4-character password composed of lowercase letters and numbers). I am using the correct command, but the brute force is extremely slow, doing roughly 1 attempt every 3.5 seconds, which brings the total cracking time to over 30 hours. I waited 2 hours already, which is far too long, especially since the lab has to be extended every 10–15 minutes. However, now it has become personal, and I really want to get this password. Can anyone help? I am using the following command: hydra -l jimmy -x 4:4:1a -f -t 64 ftp://(ip address) i have tried -t, 4, 8 and 16, doesn't change anything I also tried creating 4 lists containing all possible passwords and running them in parallel with -P instead of using -x, but I always got too many attempts. Name of the lab ist: Credential Access: Using Hydra
Help Request – Infrastructure Hacking: Demonstrate Your Skills – Attacking UnrealIRC
Hi Everyone, I’m currently working on the Infrastructure Hacking: Demonstrate Your Skills – Attacking UnrealIRC lab and have been stuck on Target 2. The target is running an SMTP server that is vulnerable to remote code execution. After identifying the software and version, I attempted to develop and execute an exploit to retrieve the token located in /root/token.txt. I also noted the hint that ncat is installed on the target. I have tried multiple approaches, including the exploit script shared below, but I have not been successful in obtaining a shell or retrieving the token. Despite several troubleshooting attempts, I’m unable to progress further. Has anyone completed this lab successfully? If so, I would greatly appreciate any guidance, hints, or suggestions that could help me understand what I might be missing. The target server has ncat installed. can someone complete this lab, can please help me Thank you in advance for your help and support! Regards, Prashanth N.
Immersive Labs- Create a detection rule - Google SecOps
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hello everyone, I hope you can help me. I am currently taking the "Google SecOps Fundamentals: Demonstrate Your Skills" course, and I am stuck on Task 12, where I need to create a detection rule. I have already created the rule, but the lab is not recognizing it or marking the task as completed. The instructions say that I need to create a rule that detects communication with one of the specified domains. I have configured the following rule, but I'm not sure if it is correct. I am not very experienced with Chronicle/Google SecOps, so I am having trouble understanding what I might be missing. Does anyone know what could be wrong or what additional configuration is required for the task to be validated? Any guidance would be greatly appreciated. Thank you! This is the rule I created: rule lumma_c2_iocs { meta: author = "Diana Quezadas" description = "Detect DNS queries to known Lumma C2 IOC domain." severity = "HIGH" events: $e.metadata.event_type = "NETWORK_DNS" $ioc_url = $e.network.dns.questions.name re.regex( $ioc_url, `(?i)^forbidstow\.site$` ) outcome: $domain = array_distinct($ioc_url) $risk_score = 85 condition: $e }
immersive labs - building-with-ai-claude-code-plugins
question 5. Open the plugin file in the editor (/home/developer/.claude/plugins/marketplaces/metrolio-marketplace/plugins/metrolio-plugin). Find the custom slash command. "What's the first subdomain of the hostname that the command is exfiltrating data to?" Need assistance to determine the subdomain? I have reviewed all of the plugin files and cannot find the answer. I have complete all sections of the training, this is the only question left to complete 100%.DFIR CTF: LightNeuron DLL - Question 5
In relation towards the question: What is the xor key for the decrypted strings? I have basically entered, and set the breakpoint into the neutron light dll While searching for the strings references I came across I am super lost in where I should continue and where I should be pivoting towards. Is there anything that I should be digging deeper into? As I mostly have been digging deeper into the 02x value.
