TRYHACKME'S ADVENT OF CYBER 2023 (Day 11)

Day 11 - "Jingle Bells, Shadow Spells"

The learning objectives of day 11 were :

• Understanding Active Directory
• Introduction to Windows Hello for Business
• Prerequisites for exploiting GenericWrite privilege
• How the Shadow Credentials attack works
• How to exploit the vulnerability

In this task we were provided with access to a user account on AD and we had to answer the questions after exploiting the vulnerability found.

We were briefed with Active Directory, Windows Hello for Business and the authentication process, how to enumerate for misconfigurations, how to abuse the vulnerable privilege, how to generate the certificate required for impersonation and pass-the-hash attack.

So we started by enumerating the privileges for our user, we found that our user had generic write access over another user, then we used a tool called whisker to get the certificate for impersonation of the vulnerable user, after getting the certificate we used another tool called rubeus to get the TGT by providing the certificate we generated earlier, This gave us the NTLM hash , we performed pass-the-hash attack using the Evil-winRM.

Active Directory (AD) is a system mainly used by businesses in Windows environments. It's a centralised authentication system. The Domain Controller (DC) is at the heart of AD and typically manages data storage, authentication, and authorisation within a domain.

Whisker is one helpful tool for abusing the vulnerable privilege, a C# utility created by Elad Shamir.

Rubeus is a C# toolset designed for direct Kerberos interaction and exploitation, was developed by SpecterOps. a pass-the-hash attack! 

Evil-winRM, a tool for remotely managing Windows systems abusing the Windows Remote Management (WinRM) protocol.

Click here to see the walkthrough.

TRYHACKME'S ADVENT OF CYBER 2023 (Day 10)

  Day 10 - "Inject the Halls with EXEC Queries"

The learning objectives for day 10 were :

• Learn to understand and identify SQL injection vulnerabilities
• Exploit stacked queries to turn SQL injection into remote code execution
• Restore the website

In this task we were provided with a website that is vulnerable to SQL injection attack,we had to exploit this vulnerability , to answer the question and retrieve the flag.

We were briefed on SQL, PHP, how to connect PHP to SQL database using PHP data objects, how to detect and perform SQLi, calling stored procedures, and remote code execution. First we went to the website and detected the vulnerability and performed SQLi using '1=1;-- , we then enabled the xp_cmdshell to execute system level commands.Then, we generated a payload on our attack machine using msfvenom and setup a http server , using the certutil.exe we downloaded the payload we generated on the target . Later we setup a listener on our and attack machine and executed the payload on the target giving us the shell . We found a bat file to perform the restoration of the website . 

SQL injection is an attack technique that exploits how web applications handle user input, particularly in SQL queries. Instead of providing legitimate input, the attacker injects malicious SQL statements into a web application's input fields or parameters. The application's database server then executes this rogue SQL query.

xp_cmdshell is a system-extended stored procedure in Microsoft SQL Server that enables the execution of operating system commands and programs from within SQL Server. It provides a mechanism for SQL Server to interact directly with the host operating system's command shell.

certutil.exe command is a native Windows command-line program installed as part of Certificate Services. It's handy in engagements because it is a binary signed by Microsoft and allows us to make HTTP/s connection.

Click here to see the walkthrough.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 9)

 Day 9 - "She sells C# shells by the C2shore"

The learning objectives for day 9 were: 

• The foundations of analysing malware samples safely
• The fundamentals of .NET binaries
• The dnSpy tool for decompiling malware samples written in .NET
• Building an essential methodology for analysing malware source code 

In this task we were provided with a compiled malware file written using C#, we had to analyse this malware and answer some questions based on it .

We were briefed with dotnet compiled binaries, C# basics, C2 server, a tool called dnSpy and malware functionalities .We used dnSpy to decompile the malware and retrieve its source code , then we analysed the functionalities of each functions used and the main program. After understanding the working of this malware we were able to answer the questions.

C2, or command and control, refers to a centralised system or infrastructure that malicious actors use to remotely manage and control compromised devices or systems. It serves as a channel through which attackers issue commands to compromised entities, enabling them to carry out various activities, such as data theft, surveillance, or further malware propagation.

dnSpy is an open-source .NET assembly (C#) debugger and editor. It is typically used for reverse engineering .NET applications and analysing their code and is primarily designed for examining and modifying .NET assemblies in a user-friendly, interactive way. It's also capable of modifying the retrieved source code (editing), setting breakpoints, or running through the code one step at a time.

Click here to see the walkthrough.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 8)

 Day 8 - “Have a Holly, Jolly Byte!”

The primary objectives of this challenge were :

• Analyse digital artefacts and evidence.
• Recover deleted digital artefacts and evidence.
• Verify the integrity of a drive/image used as evidence.

In this task we used FTK imager to recover deleted files and folders, and to verify drive/image integrity

FTK Imager is a forensics tool that allows forensic specialists to acquire computer data and perform analysis without affecting the original evidence, preserving its authenticity, integrity, and validity for presentation during a trial in a court of law.

FTK Imager presents three distinct modes for displaying file content, arranged sequentially from left to right, each represented by icons enclosed in yellow:

1. Automatic mode: Selects the optimal preview method based on the file type. It utilises Internet Explorer (IE) for web-related files, displays text files in ASCII/Unicode, and opens unrecognised file types in their native applications or as hexadecimal code.
2. Text mode: Allows file contents to be previewed as ASCII or Unicode text. This mode is useful for revealing hidden text and binary data in non-text files.
3. Hex mode: Displays files in hexadecimal format, providing a detailed view of file data at the binary (or byte) level.

Here is the walkthrough of Day 8.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 7)

 Day 7 - “‘Tis the season for log chopping!”

The primary objectives of this challenge were :

• Revisiting log files and their importance
• what is a proxy and breaking down the contents of a proxy log
• Building Linux command-line skills to parse log entries manually
• Analysing a proxy log based on typical use cases.

In this task we were given a proxylog and asked to asked certain questions, which required us to use some commands like cut, sort, uniq, grep, head, tail, base64

A proxy server is an intermediary between your computer or device and the internet. When you request information or access a web page, your device connects to the proxy server instead of connecting directly to the target server. The proxy server then forwards your request to the internet, receives the response, and sends it back to your device.

The cut command allows you to extract specific sections of lines from a file or input stream by "cutting" the line into columns based on a delimiter and selecting which columns to display.

Grep is a command in Linux that is used for searching text within files or input streams

Sort is a Linux command used to sort the lines of text files or input streams in ascending or descending order, while the uniq command allows you to filter out and display unique lines from a sorted file or input stream.

Here is the walkthrough of Day 7.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 6)

 Day 6 - “Memories of Christmas Past”

The primary objectives of this challenge were :

• How specific languages may not handle memory safely
• how variables might overflow into adjacent memory and corrupt it
• Exploit a simple buffer overflow to directly change memory you are not supposed to access

 We needed one coin per character to change our name , and 12 bytes were allocated for the name, but when we tried to enter a name containing 13 bytes the 13th bytes went to the coins memory , so this indicated that there was a buffer overflow error. Then when we tried to purchase the star from the inventory every time we got a different item, but since we knew that the inventory id of star was "d" , if we could overflow the name and change the inventory byte to "d" then we will get our star. So we did this by changing the name to one with 45 characters , 45th being "d" , this way we got our star and set it on the christmas tree.

A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it was allocated to hold. This can lead to unpredictable behavior and is a common source of security vulnerabilities. Buffer overflows can result in crashes, unauthorized access to sensitive data, and even execution of arbitrary code by attackers.

 Here is the walkthrough of Day 6.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 5)

 Day 5 - “A Christmas DOScovery: Tapes of Yule-tide Past”

The primary objectives of this challenge were :

•How to navigate an unfamiliar legacy system

•Learn about DOS and its connection to its contemporary, the Windows Command Prompt

•Significance of file signatures and magic bytes in data recovery and file system analysis

In this task we had to restore a backup file, we were provided with some of the commonly used Dos commands and utilities.

When we tried to access the backup file we found out there was a file signature problem and we fixed the file signature and restored the backup file.

File signatures, commonly referred to as "magic bytes", are specific byte sequences at the beginning of a file that identify or verify its content type and format. These bytes often have corresponding ASCII characters, allowing for easier human readability when inspected. The identification process helps software applications quickly determine whether a file is in a format they can handle, aiding operational functionality and security measures.

In cyber security, file signatures are crucial for identifying file types and formats. You'll encounter them in malware analysis, incident response, network traffic inspection, web security checks, and forensics.

Here is the walkthrough of Day 5.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 4)

 Day 4 - “Baby, it's CeWLd outside”

The primary objectives of this challenge were :

•What is CeWL and it's capabilities

•How can we leverage CeWL to generate a custom wordlist from a website

•How can we customise the tool's output for specific tasks

In this task we were provided with a website, with some information about where we could find the potential username and password to login 

We used cewl to generate a username list from the team members page in the website , and a password list from the contents of the website's homepage. Then we used wfuzz to bruteforce the login page to get the required credentials.

CeWL is a wordlist generator, it is unique compared to other tools available because CeWL is capable of creating custom wordlists based on web page content.Wfuzz is a tool designed for brute-forcing web applications. It can be used to find resources not linked directories, servlets, scripts, etc

Here is the walkthrough of Day 4.

TRYHACKME’S ADVENT OF CYBER 2023 (Day 3)

 Day 3 - “Hydra is Coming to Town”

The primary objectives of this challenge were :

• Password complexity and the number of possible combinations
• How the number of possible combinations affects the feasibility of brute force attacks
• Generating password combinations using crunch
• Trying out passwords automatically using hydra

In this task we were provided with the length of the password and the possible characters, and we had to find the password by bruteforcing .

We first generated the list of all possible passwords using crunch , then we inspected the source code of the login page and collected the required information like the method used, the url and the variable used to send our password, then we used hydra to bruteforce the password with the help of the information we gathered and the password list we generated.

A brute force attack is when the attacker tries all possible combinations of passwords to gain unauthorized access to a system or information. Normally if you try to perform this you might get locked out after a couple of tries, but if you capture the hash of the password then you can take your time and crack it offline without getting interrupted.

It is not always practical to try all the different combinations of passwords manually, this is were crunch and hydra comes handy , you can generate a file containing all possible passwords using crunch and with the help of hydra you can automatically try out all passwords from the file . 

Here is the walkthrough of Day 3.

TRYHACKME'S ADVENT OF CYBER 2023 (Day 2)

 Day 2 - “O Data, All Ye Faithful”

The primary objectives of this challenge were :

• What data science involves and how it can be applied in Cybersecurity
• Introduction to Python
• Python libraries such as Pandas and Matplotlib to crunch data

In this task we were provided with a huge dataset and we had to use Jupiter notebooks and analyse the dataset and answer certain questions that required us to use the python libraries

.
The use of data science is increasing in cybersecurity due to its ability to offer insights. Analysing data, such as log events, leads to an intelligent understanding of ongoing events within an organisation. It is used in SIEM, threat trend analysis and predictive analysis.

Jupyter Notebooks are open-source documents containing code, text, and terminal functionality. They are popular in the data science and education communities because they can be easily shared and executed across systems. Additionally, Jupyter Notebooks are a great way to demonstrate and explain proof of concepts in Cybersecurity.

Pandas is a python library used for data manipulation and analysis, It provides data structures like DataFrames, which are efficient for handling and analyzing structured data whereas, Matplotlib is a python library used for plotting high-quality static, animated, and interactive visualizations, It provides a wide variety of charts and plots, including line plots, scatter plots, bar plots, histograms, pie charts, and more.

Here is the walkthrough of Day 2.

Try Hack Me Advent of Cyber 2023 | DAY 1

 

TOPICS COVERED

This is a wonderful event which is well organized by tryhackme , which enables beginners to learn many cybersecurity concepts as well as gain hands on experience to enhance their skills on cyber security for FREE. This is a wonderful opportunity for all those looking to gains some skills to break into the cybersecurity industry.

The Day 1 room focused on :

• Natural language processing , which powers modern AI chatbots
• Prompt injection attacks 
• Defence against prompt injection

HOW IT WORKS  

Each room contained detailed explanation on each topic , which is very beginner friendly Once each topic is explained there is a hands on session where you have to perform the specified tasks and submit the flag or answer depending on the task.

WHAT I LEARNED

•  How the chatbots are trained and the quality and the nature of data they are trained upon deeply influence the way the respond.
• How natural language processing works and analyses the patterns in data to understand the relationship between words and make educated guesses..
• Why it's difficult to prevent them from disclosing sensitive information as, what may be deemed harmless today could become sensitive tomorrow due to the evolving circumstances
• The importance of implementing security measures on chatbots.
• Different types of security measures  and how they work.
• How we can make use of AI to enhance the security of another AI .

CONCLUSION

It was a great experience and it was definitely worth the time spend. I would highly recommend this for beginners trying to develop new skills in the field of cybersecurity . You can click here to go through a walkthrough of the day 1 room.