Hi there 👋

This post today will be about Telly - a HackTheBox Sherlock about the shiny new vulnerability of Telnet where it grants you sudo from userspace, in a pretty trivial manner. I will do a walkthrough the tasks in Sherlock first, then we will go on how this particular CVE works. Scenario You are a Junior DFIR Analyst at an MSSP that provides continuous monitoring and DFIR services to SMBs. Your supervisor has tasked you with analyzing network telemetry from a compromised backup server. A DLP solution flagged a possible data exfiltration attempt from this server. According to the IT team, this server wasn’t very busy and was sometimes used to store backups. ...

Forewords Ah yes, finally, some Linux forensics tasks. Though, this one should have been on the difficulty level of easy, not medium (in my opinion of course, but don’t listen to this linux addict ;)) The most difficult part of this sherlock, in my opinion, is to figure out which tool would you need to read the kdump file, and henceforth, how to use crash. Introduction and Scenario A production server crashed unexpectedly and rebooted. The crash happened at a strange time, and we doubt it was a simple hardware fault. A kernel crash dump was captured. Your mission is to analyze it to find the real cause of the crash and determine if any other suspicious activity was present on the system. ...

This is one of the HackTheBox’s Sherlock - Reaper. It’s also one of the more terrible and sloppy write-up of mine, I don’t recommend you reading this unless there really is no other choice. Scenario Our SIEM alerted us to a suspicious logon event which needs to be looked at immediately. The alert details were that the IP Address and the Source Workstation name were a mismatch. You are provided a network capture and event logs from the surrounding time around the incident timeframe. Corelate the given evidence and report back to your SOC Manager. ...

Introduction When you compile C code for an ARM microcontroller, the compiler translates your high-level code into machine instructions. Reverse engineering tools like Binary Ninja, Ghidra, radare2, etc. can decompile those instructions back into pseudo-C code. This guide shows you how to read that decompiled output and understand what’s happening at the hardware level. The Example: STM32 LED Blink We’ll use a simple LED blink program for an STM32F103xx (ARM Cortex-M3) microcontroller, that I have published in another repo: https://github.com/Flock137/stm32_blinky_baremetal ...

TLDR Stop using both the usb and memory card at once. Else, it will be next to impossible to recover anything back, since the data cells got overwritten, instead of just being “unlisted”. On Window (Linux), you can just install Recuva (extundelete or fatcat) for free and point the app to your usb or memory card, you’re welcome. However, I would still prefer a more sure-fire way to preserve my data, hence the blog. ...

Void Step How many decoy hosts are randomized in this recon evasion technique Answer: 12 In Wireshark filter: (tcp.flags.syn == 1 && tcp.flags.ack == 0 ) && (ip.dst == 192.168.1.27) Explaination: Destination IP is found through manual inspection. For faster port scanning, we (or the attacker) perform the half-open scan, where SYN=1, ACK=0 (means: send only, no need response). Go to Statistics > Endpoints > IPv4, count the addresses, then minus 1 (the destination address, which we need to exclude). ...

Introduction I chose to start my hardware hacking journey with an attempt to live debugging a piece of hardware. As I am waiting for the necessary parts I need to arrive, I did some emulations of the STM32, so I might have the binary ready to flash the binary into the hardware by the times the parts arrive. As weird as it is to write about a failed attempt on a blog post, this is written to at least temporary record what I did, for potential future references. The code for this attempt would not be released, as I definitely do not want to embarrase myself. ...

Intro This is actually my thought process of making this script https://github.com/Flock137/EOSxBlackArch, where I put the BlackArch repo on top of EndeavourOS for a quick Arch pentest environment, since BlackArch is a bit of a hassle for installing quickly. I hope it would help you in the case you wanna make an automation script yourself someday. First and foremost Install EndeavourOS. We will port our BlackArch repo into right after the former’s installation finish. ...

Introduction This is a Private CTF organized under the collaboration between HackerOne and HackTheBox that focus only on the AI category. Re-car AI You have been tasked with pentesting the largest used car listing website in your area. They have recently implemented an AI chatbot in their listing page to help users with common questions. The website’s policy is not to disclose the seller’s information unless the user is logged in. Can you find a way to bypass the filters and reveal the seller’s phone number by asking the chatbot? Flag format: HTB{xxx-xxxx-xxx} ...

Introduction To encourage and celebrate women/girls in cyber security, Re:Hack has organized this girls-only-CTF. As a woman, I really appreciate this effort and it feels incredibly inspiring. This is the first time that myself see so many girls and women gather in one place and all are incredibly passionate about this very technical field. So, I would like to give a very special thank-you to the organizers and all the challenge writers involved to make this sort of event possible. ...