NoShade.Vision

Summarized Videos

0xdf

Malicious LNK File Analysis

This video is about the analysis of a malicious LNK file that was uploaded to the Malware Bazaar. After taking a closer look, the speaker discovered that the file was tagged as Cobalt Strike and proceeded with the analysis. The process involved multiple layers of redirection and downloading from a live C2 server using PowerShell and Linux. The speaker also analyzed a decoy PDF file but found nothing suspicious. They then looked at the unzipped runtime broker files that were extracted from the LNK file and found two identical MD5 sum files, which they deemed not interesting but still found potential C2 traffic on VirusTotal. The speaker concluded the video by inviting viewers to leave comments on what tasks they wanted them to do in the future.

PHP Filter Injection: LFI2RCE Explained

The YouTube video "PHP Filter Injection: LFI2RCE Explained" discusses the technique of LFI2RCE, which allows for the creation of a PHP file out of filters, turning an LFI vulnerability into RCE if disabled functions and content are present in the URL link. The presenter demonstrates multiple methods of injecting PHP filters and uploading web shells onto servers and introduces a new technique that exploits PHP filters meant to change the encoding of strings. They explain the process of generating a filter chain, using base64 encoding for payload characters to speed up the process, and building a payload that can be executed as a web shell. The video also highlights the challenges that may arise when using this technique.

Creating a SSH Honeypot with Python

The video "Creating a SSH Honeypot with Python" demonstrates the process to create an SSH honeypot using Python rather than pre-existing honeypot projects. The presenter demonstrates each step of the process, including creating the necessary elements of the TCP stack, implementing socket level aspects and incorporating the Paramiko library to handle SSH server functionality. They explain how to store the server public key, prevent man-in-the-middle attacks, and handle multiple client connections using threading. Finally, they subclass the paraminko server interface and define the check_password function to create the honeypot server, which logs any attempt to log in with a password. The presenter suggests that there are other functions that can be added to further build the server, such as creating a session and responding to commands.

Scanning UDP with nmap

The video provides guidance on how to scan UDP ports with nmap, an essential skill for hacking. Although UDP scans can be slow and unreliable, they can be useful and necessary. The video recommends starting with basic scans of the top 10 ports with the S capital u command, with the most common ports being SNMP and DNS. The speaker provides tips for scanning larger port ranges, including hitting the top thousand ports quickly and identifying any potential issues. The video also explains the differences between "filtered" and "closed" results in nmap, which indicate either administratively closed ports or OS port-not-open responses.

Build an HTTP Proxy to Abuse SSRF [HackTheBox Response]

In this video, the creator explores how to abuse a proxy fetch API endpoint using an SSRF to fetch a site. They build a Flask/Python app that will act as a custom proxy to forward specific requests to the appropriate location while using Burp to help troubleshoot any issues. The creator writes a web server using Python to act as a proxy that always returns "High" regardless of the path visited. They also discuss debugging the code to find the necessary digest using the re library to search for a specific session string and then discuss base64 encoding the request body before sending it through the proxy. The creator also discusses testing the proxy and successfully interacting with a chat app. Overall, the creator demonstrates the thought process and development process behind building an HTTP proxy to abuse SSRF.

Recent Updates in Feroxbuster 2.9.1

The video presents various updates made to the tool Feroxbuster, which can be used to Brute Force API endpoints or web directories. The speaker highlights the tool's simplicity, speed, and recursive functionality and mentions its recently added auto-update feature. The video explains how to set up Feroxbuster directory correctly and focuses on the latest addition of the filtering out a default answer feature and bug fix in version 2.9.1. Feroxbuster is useful in identifying parameters that are not correctly set and recommended for those who want to do directory brute forcing on a web server.

Malicious Lnk and JavaScript Analysis

In this YouTube video on malicious Lnk and JavaScript analysis, the speaker analyzes a Link file and a JavaScript file uploaded to Malware Bazaar that appear to be related. The video goes through the steps of how the Link file leads to the JavaScript file and how it downloads and executes it. The speaker then analyzes the hundreds of lines of JavaScript code and explains how it sets up downloads and runs another execute. The video also covers the analysis of a piece of malware, the creation of sub-functions within the malware, and the identification of suspicious techniques used by adversaries to bypass countermeasures. The analysis is done using a Windows VM and Linux.

CVE 2022-23935 Analysis: Command Injection in Exiftool [HackTheBox - Investigation]

In the video "CVE-2022-23935 Analysis: Command Injection in Exiftool [HackTheBox - Investigation]", the vulnerability found in Exiftool is explored. Through examining the source code versions before 12.38 and analyzing the Git image info function, the video explains how an attacker could use the Pearl open command to inject commands and potentially gain control of the system. The vulnerability is demonstrated through an example and the video showcases how it was fixed in version 12.38 by explicitly setting the mode with the trusted_pipe variable. The speaker recommends using an explicit mode set instead of relying on the filename.

Exploring the HackTheBox TwoMillion PHP Application [Beyond Root]

In this section of the "Exploring the HackTheBox TwoMillion PHP Application [Beyond Root]" video, the presenter looks into the TwoMillion PHP web server to identify vulnerabilities in its code. They examine different functions, such as generate code and update settings, to find potential weaknesses. The presenter discovers a bug in the admin controllers that allows non-admin users to access the admin API and escalate their privileges. They also discuss a second-order command injection vulnerability and explain how to fix it by removing special characters from the username. The video serves as a practical guide to identifying and mitigating weaknesses in PHP web server code.

jq Injection [Jason Hacky Easter 2023]

In the "jq Injection [Jason - Hacky Easter 2023]" video, the speaker discusses the process of breaking a JQ injection challenge called "Jason" that was part of the Hacky Easter 2023 event. After trying command injection and SQL injection without success, the speaker discovers that the challenge is JQ injection. They then explain how to use JQ to extract a specific key in a JSON blob, using JQ's "keys" function to return a list of keys and then looping through them until the target key is found. The speaker praises JQ as a valuable tool for working with large volumes of JSON data.