In this video walk-through, we covered a blue team scenario where we investigated a virtual hard disk snapshot for Windows system. We investigated Powershell console history and discovered traces of Powershell script embedded as an alternate data streams in a DLL file. After revealing the contents of the script, it is revealed as an encoded base64 with null bytes and obfuscation. De-obfuscating the script started with decoding it from base64 and removing the null bytes using CyberChef. The script was still obfuscated so we executed every single part of it before the pipe character that came at the end of it. This resulted in a bunch of chars that when executed again with Powershell revealed the contents of the script and the flag.
***********
Receive Cyber Security Field Notes and Special Training Videos
[ Ссылка ]
**********
Writeup
[ Ссылка ]
HackTheBox Artifacts of Dangerous Sightings
[ Ссылка ]
********
Patreon
[ Ссылка ]
Instagram
[ Ссылка ]
Twitter
[ Ссылка ]
Facebook
[ Ссылка ]
LinkedIn
[1]: [ Ссылка ]
[2]: [ Ссылка ]
Website
[ Ссылка ]
Backup channel
[ Ссылка ]
My Movie channel:
[ Ссылка ]
******

свернуть