PRIVILEGE ESCALATION LIVE! PowerShell Hacking & TryHackMe

[00:00:00]If you can hear me, type in type in hacker frog dis space issue disc space issues. Yeah.

[00:00:09]Okay, we're back. We're back. Okay, great. Great. Great.

[00:00:13]Thank you everybody. Um I think we might have lost we might have lost YouTube.

[00:00:21]Let me see if I'm streaming on YouTube right now.

[00:00:29]No. Are we on YouTube?

[00:00:32]YouTube is back up as well. Okay. Thank you. Thank you. That was uh anyways thank thank you very thank you very much everybody. Okay. So let's let's get back to what we were doing. Um I was having some problem with that disc space.

[00:00:49]That's kind of that's kind of weird.

[00:00:54]Just buffering. what's going on.

[00:00:58]Okay, so we can specify like specific uh directories to look inside of. So let's go ahead and do that. So we run get child item recurse hidden file and then we can do like let's see dot slash dot slash there. Now, there's now more than one stream. Okay. Yeah, that's true.

[00:01:37]It's a bit of a pain, but uh it's better than not having to stream at all.

[00:01:42]Okay. So, what directories are we supposed to be looking inside of?

[00:01:50]Contacts, desktop, documents, downloads.

[00:02:03]So, it's contacts.

[00:02:11]There's a bunch of these, so I might as well keep track of a few different directories that we're looking inside.

[00:02:24]YouTube issues. Yeah. Yeah. Yeah. But you know, it is what it is.

[00:02:30]Okay. Desktop, documents, downloads.

[00:02:41]Back on mobile. Okay, that's great.

[00:03:01]Okay. Favorites.

[00:03:08]Oops.

[00:03:14]Green spider. Green spider. Okay, that doesn't sound very good.

[00:03:23]Music and last one is videos.

[00:03:31]H Oh, we got we we found one. The other thing about this is that we we had a lot of like error messages. There has to be something to suppress error messages, right?

[00:03:44]So PowerShell suppress error messages.

[00:03:59]So it's like error action silently continue.

[00:04:11]So just run all this And then we just get the secret sauce file. Okay, that's great.

[00:04:21]Let's go ahead and let's go ahead and read this. That's the name of the file, right?

[00:04:31]So, the password for Century 12 is the name of the hidden file. So, the name of the hidden file is secret sauce. Let's go ahead and uh record our solution for this.

[00:04:48]We need to search recursively inside certain directories on the users in the user's home diretory.

[00:05:21]Okay, we'll give the command over here.

[00:05:28]No Wi-Fi at the moment. Steaming fish.

[00:05:30]Steaming fish.

[00:05:33]All right, let's copy that. We'll paste it in. This is PowerShell.

[00:05:47]And that's it.

[00:05:52]Then we can move on to the next challenge.

[00:06:05]So the next level is level 12.

[00:06:18]So the first thing we do is the SSH command slashpass.

[00:06:26]We record the instructions.

[00:06:29]We record the method of solve.

[00:06:40]Okay, let's get out of here.

[00:06:44]So, the SSH command is identical um except that it's century 12 and password is what? Secret sauce.

[00:07:12]Okay, the instructions for this level.

[00:07:14]Let's take a look.

[00:07:20]Okay, the password for Century 13 is the description of the computer designated as a domain controller within this domain plus the name of the file on the desktop.

[00:07:33]Okay, let's copy that.

[00:07:45]Let's go ahead and copy this.

[00:07:50]Oops.

[00:07:52]So, SSH as sentry 12 password paste it in.

[00:08:00]Okay. So, everybody, if you want to do the same level as we're doing, I'll um provide the SSH command and the password over here.

[00:08:17]the description of the computer designated as the domain controller.

[00:08:21]Okay, so I guess we could look for PowerShell.

[00:08:36]Get domain controller computer to find domain controllers in active directory using powershell. So you do get ad domain controller commandlet.

[00:08:59]Okay.

[00:09:06]Hm.

[00:09:09]So, we're not we're not looking for everything in here. We're just looking for a specific thing in this output, right? We're looking for the description.

[00:09:20]So, dash description like this. No.

[00:09:36]Description of the computer.

[00:09:47]So what is the description?

[00:10:08]What is the process? What is the process? So I guess uh maybe what we need to do is we need to specify the host name.

[00:10:18]Specify the host name and then We need to get the description to the computer.

[00:10:33]40 ounce horada. That's a that's a funny name. Hello. Nice to see you here. Uh is this I am is this I am I mean this is PowerShell and we're currently working inside of like an active directory environment.

[00:10:57]Okay. So I guess what we need to do is we need to use PowerShell get computer description.

[00:11:09]So to find a computer description via PowerShell, you must use different commands depending on whether you want to query the local Windows system description or the Active Directory object description. I mean, I'm not too sure which one we're doing here.

[00:11:23]I am I am Dpril. Hello. Nice to see you here.

[00:11:30]Okay. To find the description configuration in the local Windows system profiles local Windows system properties, use the get cim instance commandlet.

[00:11:53]Okay. Remote computer append computer name your p your PC name to the command.

[00:11:58]Okay. Let's Let's try copying this.

[00:12:03]We'll paste it in.

[00:12:07]And we also need to specify which computer it is. So, computer name.

[00:12:18]And I can't remember what the thing was called.

[00:12:23]April says, "I always meant to do under the wire. Over the wire was the bomb."

[00:12:26]Yeah. Yeah. I mean, learning how to do stuff in PowerShell is very handy if you do a lot of scripting inside of Windows.

[00:12:52]Hold on.

[00:13:02]Copy paste is always a bit weird.

[00:13:08]Okay. So, what's the computer name going to be here?

[00:13:19]Maybe this host name. UTW.underwire.te.

[00:13:22]tech.

[00:13:26]Or maybe by the IPv4 address parameter cannot be found that matches the parameter name computer name. So computer name this isn't quite working.

[00:13:57]So, get ad computer identity your PC name.

[00:14:04]Maybe it's going to be the get ad computer commandlet instead.

[00:14:10]Snygoster says under the wire was so under underwhelming.

[00:14:14]Sniggy, hey, nice to see you here. We're just trying to cover our bases.

[00:14:21]by doing some um some PowerShell stuff in comparison to Over the Wire anyway. I mean, Over the Wire's got a lot more variety in the stuff that's there. I mean, they've got they've got like uh Linux war games.

[00:14:46]They've got web they've got web app security war games. They've got cryptography war games. They've got um reverse engineering and binary exploitation, but uh Under the Wire just has PowerShell stuff as far as I know anyways.

[00:15:17]H.

[00:15:22]So, we can't find our description here.

[00:15:30]So, we ran get 80 domain controller, but I'm wondering what name we use when we try to query information about this about this computer. Kind of hate PowerShell syntax, but got to admit it's handy. Yeah, I mean, it's very it's very extensible, but uh it's it's too verbose.

[00:15:53]Okay, so this thing is just called UTW, maybe.

[00:15:59]I wouldn't be caught dead with it on L.

[00:16:01]It's not really meant for Linux.

[00:16:07]So the identity of the machine is just UTW.

[00:16:14]Okay.

[00:16:16]Okay. This is exactly what we want.

[00:16:24]You can actually uh I don't know if that's the best thing to do on Linux.

[00:16:30]Is the description I authenticate?

[00:16:34]I authenticate. I authenticate things is the password for the next level.

[00:16:40]All right, let's uh let's write about it.

[00:16:49]So the first thing we need to do is get the get the details of the domain controller in our environment.

[00:17:11]Can't we do that with this command?

[00:17:28]Get AD domain controller.

[00:17:38]So the identity of the computer is UTW.

[00:17:48]We can feed this into the next command.

[00:18:04]This one.

[00:18:24]So we can combine the description with the the file name on the desktop.

[00:18:46]Okay. And then I think we're I think we're finished this with this level.

[00:19:01]So the next level is level number 13.

[00:19:30]So the whole password is I authenticate things like this and let's get that SSH command.

[00:20:09]Okay. So, if you wanted to do this yourself, here is the relevant information.

[00:20:24]We'll record the instructions and the method is solved in the challenge.

[00:20:40]Okay. So the password for century 14 is the number of the number of words within the file on the desktop.

[00:20:50]The number of words within the file in the desktop. This should be pretty this should be pretty easy.

[00:21:03]But first, let's go ahead and log into the server.

[00:21:20]Okay, count my words. So, count my words.

[00:21:25]Is there is there like a built-in word count into files using PowerShell or is there something else that we need to do?

[00:21:38]PowerShell get word count.

[00:21:45]Okay. So let's see. Measure object commandlet with the word parameter.

[00:21:54]So get content measure object word.

[00:21:58]Seems pretty straightforward.

[00:22:01]GC GC count my words.

[00:22:06]Split measure object. Split measure object. Split by I mean split by um by space also seems like a pretty good idea.

[00:22:17]But let's see if this works first. So we're going to run it on count my words.

[00:22:28]So, measure object word word 755 H.

[00:22:37]Let's see if this is the actual Let's see if this is the actual password. So, just get out of here. We'll um double check.

[00:22:52]That was That was it. That was it.

[00:22:59]I didn't know that there was a word parameter. I mean, you learn new stuff every day, huh? I mean, I do. I'm I've learned I learned dozens of new things every day.

[00:23:12]Okay. So, I mean, it's pretty it's pretty straightforward here.

[00:23:18]We're just kind of flying through these HMD, hello. Nice to see you here. Nice to see you. Okay, we can move very swiftly on on to level number 14.

[00:23:53]So after we if we So this is not super difficult right now, but uh we might come on like some levels that are that are very difficult.

[00:24:06]I'm not too sure how long we want to go on with this cuz it might get a bit boring after a while.

[00:24:29]So, I think it was like 755, right?

[00:24:31]Let's try again.

[00:24:35]Yeah. Okay.

[00:24:46]And the sh SSH command was this one.

[00:24:57]Power shell training for the people.

[00:24:59]Well, I mean for the people who want the power shell training. Yeah. Yeah.

[00:25:08]Okay. Method. Sorry. instructions.

[00:25:19]Let's get those instructions.

[00:25:25]The password for century 15 is the number of times the word polo appears within the file on the desktop.

[00:25:34]Important note, you should count the instances of the whole word only. So, we need to make sure that Polo is by itself.

[00:25:46]Dapel says the people who have to use it don't want to be on Windows.

[00:25:51]I mean, I'm sure I'm sure there are people who use PowerShell who enjoy using PowerShell. I don't know.

[00:26:24]Okay. So, let's get into this.

[00:26:30]So, we're doing PowerShell. We're going to get get string pattern or get word get number of words number of specific word but not as part of a larger word.

[00:27:00]I agree. Just there are people who like to self mutilate. Doesn't mean we should just let them. Haha.

[00:27:09]Okay. The more you use power shell, the easier it gets. Is quite handy in some respects. I mean, it it is it is quite powerful.

[00:27:22]Okay. How do you extract a specific word from a text file?

[00:27:28]Select string. Select string command that uses a regular expression matching to search for text patterns in the input of strings and files.

[00:27:43]Where am I from? Uh, Canada. Canada.

[00:27:46]Yeah.

[00:27:52]So, measure word.

[00:27:55]All right. Let's let's talk about this for a sec.

[00:28:00]Count specific strings in text file using PowerShell. So this is good old Stack Overflow.

[00:28:09]Here's one method.

[00:28:11]So select string.

[00:28:15]So the best the best version that they have of this is like a multi-line file.

[00:28:37]So file content equals get content your file.txt txt matches equals select string input object file content pattern export export all matches matches.mmatchescount this does seem kind of uh kind of verbose now doesn't it mean if it works it works H.

[00:29:30]Okay. Count polo. So, we're looking for uh the name well the word polo in this file.

[00:29:38]So the first thing they've got is file content equals get content your file. Uh for this one is going to be count polos.

[00:29:50]And the next line is matches select string and look for the pattern.

[00:30:03]Select string input object file content pattern is polo, right?

[00:30:13]Isn't that count the chicken in Spanish?

[00:30:15]I guess so.

[00:30:19]Polo. It's polo without the s though.

[00:30:26]The word the number of times the word polo appears within the file.

[00:30:34]Okay, so all matches and then we do the last one which is matches.mmatches.count.

[00:30:53]We have 158.

[00:30:56]I'm not sure if this is the password for the next level. We'll give it a shot.

[00:31:11]Yeah, this isn't it. Okay. So, so we need to we need to make sure that the word polo is not part of a larger word.

[00:31:48]Okay, so it looks like in this file Snagos says file content split SLS pattern polo something something measure object. What is the what is the dollar sign at the end of polo? Does it mean that it has to be cell content split on what a word list reject pattern? Oh, okay. Okay.

[00:32:30]So, file content get content this thing, right?

[00:32:37]count polos.

[00:32:44]Okay, so Snygoster recommends recommends like file content this thing.

[00:32:50]Hold on.

[00:32:52]This thing right here.

[00:32:56]Measure object.

[00:32:58]Count 153.

[00:33:01]153.

[00:33:06]Now, is this only going to count strings that are on their own?

[00:33:14]It means ends with polo. Ends with polo.

[00:33:18]How do we um completely isolate it though?

[00:33:25]So, SLS pattern in PowerShell isolate isolate string.

[00:33:46]If you want to be super specific, you do oh starts with polo and ends starts with P. Okay. Okay. Okay. All right. Let's uh let's give it a try. So start of line start of string this 153.

[00:34:08]Okay. So I'll just I'll save this and I'll see if this is the correct answer.

[00:34:33]153.

[00:34:37]That was the correct answer. That's awesome. That's awesome. That's awesome.

[00:34:42]Thank you, Snowing Guster. That uh that was uh that was clutch.

[00:34:51]So file content equals something something and then file content.split on spaces SLS pattern our pattern.

[00:35:04]Although I guess we could also do like get get content and then like pipe it into pipe it into the split.

[00:35:18]I wonder. Let me let me give that a try one more time because it's it's always nicer if you're able to do it in like a oneliner.

[00:35:44]Okay. Want to do a king of the hill.

[00:35:47]King of the Hill. I don't I don't think I've I haven't done a King of the Hill before.

[00:35:53]So let's see if we can do it like on get content count polos and then pipe that into pipe into the split on this and then SLS this pattern.

[00:36:33]Hold this thing and then pipe that into measure object.

[00:36:47]Ah, okay. So a parameter that cannot be found that matches the parameter named split. So get get content doesn't have split have to wrap it in parenthesis.

[00:37:01]Oh, okay.

[00:37:13]I like this.

[00:37:18]Okay, it does work. Great. Great.

[00:37:23]All right, let's let's measure that.

[00:37:27]Sorry. Let's um let's record that.

[00:37:36]Power shell.

[00:37:42]Yeah, they really like to split it on these things.

[00:37:46]They're so fun. Uh, if you're not with sweats. Not with sweats. I mean, is it?

[00:37:51]Well, it's more fun for the sweats, I guess, if they were doing it. I have a root kit that I made. A root kid. That sounds like a lot of fun. Xmanus, hi.

[00:38:01]Nice to see you here. Hope you're having a good day.

[00:38:12]But yeah, King of the Hill. I mean, if I was if I was to do a King of the Hill, I'd want to plan it in advance and get like a get like a good number of people on each team and make sure that the the teams are evenly split.

[00:38:29]So, this is going to be level 15.

[00:38:38]It's not teams, it's more individual. I mean, usually like uh King of the Hill.

[00:38:43]Oh, King of the Hill as in everybody's fighting to be king. Okay.

[00:38:49]Okay. I thought you were talking about like attack and defend, which is what they do over at Defcon.

[00:38:57]Like the Defcon CTF is attack and defend.

[00:39:13]Okay. So, there's like a king.txt file and your name has to be in it. Oh, okay. So, it's like a oneon-one. Can you do it like Can you do it like uh like a free-for-all? Can you do it like with um five people or seven people or 12?

[00:39:40]Oh, it is a free-for-all. Okay.

[00:39:56]Okay. So, what are our instructions for this level?

[00:40:04]It can be one-on-one. I guess that would be your uh how to solve how to resolve issues with people in the hacking community. One-on-one me scrub, that kind of thing.

[00:40:17]One-on-one me and King of the Hill.

[00:40:22]Oh, that's it. This was the last level.

[00:40:29]Not my forte. I don't I don't really ever think of how to defend. I would lose hard.

[00:40:35]I mean, I I think most people who do like um network hacking exercises would would lose pretty hard on the defend portion, but uh defending isn't just patching. You have to or you just don't defend.

[00:40:51]My defense is My defense is offense.

[00:40:55]Okay, so level 15 is the end of the game.

[00:40:59]Huh. I wonder if we can do another game then. So there's Century, there's Cyborg, there's Groot, Oracle, and Tribec.

[00:41:10]Pick a game and then pick a level. 0 to 15. All of these games are 0 to 15.

[00:41:24]H I think I think we might just move on to another we might just move on to another um to another thing now cuz I think I might be a bit powers shelled out.

[00:41:45]Are they all power shell? They're all supposed to be PowerShell. Yeah, because this entire channel is about PowerShell stuff.

[00:41:57]Scroll to the top to see the credentials. After obtaining the credentials, connect to the server via SSH.

[00:42:03]I kind of don't want to I kind of don't want to interact with their Slack channel, though.

[00:42:10]Maybe the credentials are online.

[00:42:14]Hold on. Let's Let's search for this PowerShell. Uh under the wire cyborg cyborg level zero password. All the credentials should be online. I'm hoping so.

[00:42:42]The password to log into the initial level level zero of the underwire cyborg post power shell war game is cyborg one.

[00:42:50]Okay, it's cyborg one. Okay, great.

[00:42:52]Let's give this a try.

[00:43:03]Actually, Cyborg Zero is the name of the level.

[00:43:12]Has anybody heard from from Slyborg lately?

[00:43:24]Let me make sure I've got the SSH Cyborg. Oh, it's it's okay. Okay. I need to change the um the name of the game here as well.

[00:43:41]Not in a while. Yeah, she got a she got a job. Um I think it was like a non tech job, too.

[00:43:54]Let's see. She did come back once with a stream where she said she got a job and would not stream as much anymore. Okay.

[00:44:06]Hm.

[00:44:22]Did I not spell this correctly?

[00:44:28]SSH Cyborgz at cyborg.underwire.te.

[00:44:33]Yeah, Cyborg is a streamer, right? She uh she used to she was like doing um whole like documenting her cyber security journey. She's very popular.

[00:44:54]H Yeah, it looks like it's that's not the it's not the correct password.

[00:45:15]I guess they changed they changed the credentials.

[00:45:32]I think she I think she's still aiming to get into cyber security. It's just that she has to she has to take care of her finances first.

[00:45:46]So it's not Cyborg Zero.

[00:46:15]H I guess we're going to have to check their slack.

[00:46:35]The other thing I could I could cheat and I could look at the YouTube video.

[00:46:40]Actually, the YouTube video isn't going to show us the the password because the password is blanked out.

[00:46:49]H maybe I can take a look at the at the walkth through just a sec. Just just a bit. Just a bit.

[00:47:13]Huh. That's kind of funny.

[00:47:18]for needing people. The industry is way too hard to get into. I've decided it's just a hobby. Yeah. I mean, the thing about uh the thing about cyber security is that it's reported that.

[00:47:38]Okay. So, the first level is actually cyborg cyborg one and not cyborg zero.

[00:47:46]That's interesting.

[00:47:50]All right, let's uh let's go ahead and get started. So, this is the end of the game.

[00:48:02]Congrats.

[00:48:09]Okay, so the next game is Cyborg.

[00:48:20]level one.

[00:48:30]So the SSH/pass we'll put over here.

[00:48:42]They only want to hire people with five years of experience. Sometimes it really does feel like that.

[00:48:57]Well, I mean it at least that's the way that it feels like especially if you look at the job postings. The job postings all have like a laundry list.

[00:49:04]Yeah, they all have like laundry lists of of requirements for like entrylevel jobs. But the other thing about cyber security is that even the entrylevel jobs in cyber security aren't necessarily how do you spell that? Necessary entry level.

[00:49:39]I mean, I guess some of them are like you would expect that like sock analyst level one, this would be entry level, but like network or even like junior network pentester.

[00:50:01]This is very rarely going to be entry level because the the required skill set to do like junior network pentester work is way way higher than you'd expect for entry for any entry-level job.

[00:50:18]Yeah, soft analyst level one is kind of entry level. The rest do not exist as entry level. I mean if you wanted to do like malware so something like forensics analyst which you would so you would suppose that this was this would be an entry- level job. That's actually not entry level.

[00:50:44]where you would go to get like a forensics analyst job is that you would start at like sock analyst and then you would work your way up from sock analyst level one to level two and then maybe you would you would um pivot from there to get into like a forensics analyst role and by entry level you mean something that you can do straight out of school.

[00:51:05]Yeah. It's not it's not super realistic.

[00:51:09]Like most cyber security, most CISC jobs have a laundry list of um of like prerequisites.

[00:51:32]So it's a laundry list of prerequisites, you know, for example, must be familiar with I don't know. Um, anyways, I don't even want to go into it. Uh, it's a shame because Sock Analyst is super boring. Had no heart for it.

[00:51:59]Okay, so we've got instructions and we've got method to solve. We might solve a couple of these levels and then move on to something else.

[00:52:22]Okay. The password for Cyborg 2 is the state that the user Chris Rogers is in.

[00:52:29]I'm sorry, what? The password for Cyborg 2 is the state that the user Chris Rogers is from, as stated within Active Directory. Okay. So, I'm assuming that Active Directory stuff we just need to get the Active Directory user and then look at the details to the description.

[00:53:01]We want to get the AD user for Chris Rogers.

[00:53:09]Chris Rogers. Okay.

[00:53:20]So, we're doing PowerShell like 80 users by first and last name.

[00:53:32]Holy grammar. Holy grammar. Grammar.

[00:53:35]Grammar. Grammar.

[00:53:38]To find Active Directory users by their first and last name using PowerShell, use the get ad user command lit with the filter given name and surname.

[00:53:49]So I guess we need to do something like this.

[00:53:55]We're looking for what was it?

[00:53:59]Chris Rogers.

[00:54:15]So this is Chris.

[00:54:25]Okay, so we found the guy.

[00:54:30]So we found the guy. Now we need to get his user description.

[00:55:02]So PowerShell 80 users get description.

[00:55:13]So get ad users properties description.

[00:55:16]Is this all we need to do?

[00:55:24]properties description. This kind I mean sometimes PowerShell really reminds me of um of SQL.

[00:55:38]So there's no there's no description.

[00:55:43]Hm.

[00:55:51]The state that the user Chris Rogers is from as stated within active directory.

[00:55:57]State refers to the location within the country and not state of the account.

[00:56:02]location within the Wait, are we able to get is there like a location?

[00:56:16]Yeah, I mean we we can also get all the properties.

[00:56:22]So we can just properties everything.

[00:56:32]Oh, okay.

[00:56:34]So, it's not a specific.

[00:56:37]We're looking for a property called state.

[00:56:43]I mean, this isn't normal.

[00:56:45]I mean, I don't think this is normal.

[00:56:47]Normally, they don't have like a property called state.

[00:56:59]Okay. Or a X509. And what is X509 in this case?

[00:57:13]Notice it populates there.

[00:57:24]I mean, this is all the information here.

[00:57:29]TLS TLS. Okay. Okay. TLS certification or Yeah.

[00:57:37]Okay. So, I mean, we've got the command.

[00:57:39]We'll do a couple more and then and then we'll uh re-evaluate.

[00:58:01]and it said property state. It popped up. Yeah. I mean, I'm not sure whether or not it's like a a standard property though or if it's like a custom one.

[00:58:17]Okay, let's let's do the next level.

[00:58:32]Oops.

[00:58:38]So, it's the Kansas Kansas H. What's the clear screen?

[00:58:54]What's the clear screen um keyboard shortcut for PowerShell? Does anybody know?

[00:59:15]CLS are clear.

[00:59:19]Wars don't end. Which wars are we talking about?

[00:59:26]IPV4. Okay, so we're dealing with some IP addresses now.

[01:00:04]Okay, we've got our instructions and then we've got our solving method.

[01:00:19]Okay. So, it's the next level, level two.

[01:00:25]So, the password for cyborg 3 is the host A record. The host A record IP address for cyborg. What is this?

[01:00:37]Plus the name of the file on the desktop.

[01:00:40]All right.

[01:00:43]host a record IP address. Host a record IP address.

[01:00:55]So if we take a look at this file, oh, IPv4 is the name of the file on the desktop. So the thing we need to look up is host a record for this.

[01:01:25]So I guess we're doing PowerShell lookup host information for domain.

[01:01:58]Is it a domain we're looking up or is it What are we looking up again?

[01:02:15]So we would call this like a UR like a URL.

[01:02:20]So look up host information for URL.

[01:02:28]To look up a host or DNS information for a URL in PowerShell, you first need to extract the host name from the URL and then pass it to resolve DNS name commandlet.

[01:02:46]Okay, so resolve resolve DNS name.host We're looking for for this thing. Cyber something something.

[01:03:14]Okay, that doesn't that doesn't work.

[01:03:28]Oh, we're just looking for like the IP address.

[01:03:32]Yeah. Okay. Okay. This makes it easier.

[01:03:35]So, let's see. PowerShell lookup IP address for host name for Yeah, I think it should be host name, right? Look up IP address for host name.

[01:03:58]Okay. So, resolve DNS name equals something something.

[01:04:13]So, the name is going to be like cyber something something this thing.

[01:04:25]Yeah, we found it. Okay, great.

[01:04:28]So, resolve DNS name.

[01:04:32]So, combine the IP address with this IPv4.

[01:04:51]Okay. Al together the password is this thing underscore IPv4.

[01:05:15]Okay, let's just double check that this is the correct password.

[01:05:28]And it is the correct password. Awesome.

[01:05:37]Okay. So, we'll do we'll do one more level.

[01:05:44]Okay. Adb says 2011.

[01:05:47]barely anyone had smartphones and now in 2026 we have AI. I mean technology kind of works like that.

[01:05:58]I was in where I was in where was I in 2011?

[01:06:10]I was in South Korea. I was in South Korea teaching English in 2011 and nobody had smartphones.

[01:06:18]Nobody I mean I the only people who had smartphones back in 2011 were people who had a lot of money.

[01:06:26]The thing is that is that the carriers didn't really support smartphones back then.

[01:06:33]Really cool job. It was a pretty It was a pretty fun job. It was a pretty good job for a person just out of um just out of college.

[01:06:45]Did you learn Korean? Yeah, I learned a a good amount of Korean. I was able to get by. Okay.

[01:06:54]Uh I was I was a person who liked to integrate into whatever country that I was working in. There are some people who absolutely refused who absolutely refused to learn the language while while they were there because they figured they would never use it after they left the country, but I tried to I tried to integrate as best I could.

[01:07:30]Okay, there's the password.

[01:07:35]Those people miss the point of going to another country. I mean, to some people, it's just a job.

[01:07:43]To some people, it's just it's just a way of making money and they see it as a very utilitarian thing.

[01:07:53]What are my instructions?

[01:08:00]don't understand how people I mean I understand their I understand their their way of thinking. It's just that I don't really agree with that.

[01:08:12]Were you glad you picked Korea over Japan or somewhere else? I mean I did all of them. I did Korea and then Japan and then China.

[01:08:22]I did like I did five years of overseas uh English teaching.

[01:08:33]Hold on. What was that password?

[01:08:41]I doubt you get to use it often. I mean, there's there there are like Korean people living in my neighborhood, but I don't get I don't get a lot of opportunities to just bust it out. Maybe sometimes at like restaurants or something.

[01:08:58]Okay. Back in the day, the AI was a web browser. I mean, everything was like Google searching.

[01:09:10]Okay. Where are my instructions?

[01:09:15]The number of users in the cyborg group within Active Directory plus the name of the file in the desktop. Okay, so that we're getting we're really getting into Active Directory stuff here.

[01:09:32]Okay, I've had a hard time getting a good job in America.

[01:09:36]I mean people who did education in Asia, they were just kind of like delaying uh most most people were like delaying getting a job in their chosen field after graduating from college cuz you needed to have like a degree in order to qualify for the jobs teaching English overseas.

[01:10:09]the number of users in the cyborg group.

[01:10:12]Okay, so first we need to get the number of users in the cyborg group.

[01:10:18]I mean we can probably search for it pretty easily. PowerShell count numbers in Active Directory group.

[01:10:37]It's useful to ease drop on strangers who assume you can't understand them. I don't know about that.

[01:10:43]What was the gaming scene like in China?

[01:10:46]The gaming scene in China. I mean I I don't think I was part I was not part of the gaming scene while I was in China. I was uh I was kind of not in I was not in the scene. As far as the gaming scene in China now it's mostly it mostly revolves around mobile games as far as I know.

[01:11:09]Okay. So PowerShell get 80 group member identity your group name and then count.

[01:11:14]Oh, is that it? Seems pretty easy.

[01:11:21]Okay, I can hear the difference between the f and the th sound.

[01:11:24]I'm pretty sure they have time limits.

[01:11:26]Yeah, I mean these days it's a lot more strict.

[01:11:32]So the name of the group is called cyborg.

[01:11:39]Okay, so we got 88 and I think we want to add 88 objects.

[01:11:53]The hardware scene in China was is where it's at least in one province. Um I think that most of the hardware manufacturing is done in the Guangong province in China. Although I could be wrong.

[01:12:12]That was the province where I was uh where I was working.

[01:12:25]Okay, let's see if this password works.

[01:12:29]Yep, it worked. Great.

[01:12:33]Let's go ahead and record this.

[01:12:46]The password is 88 objects.

[01:12:48]Got this thing.

[01:12:52]Igel, hello. Nice to see you here. Hope you're having a good day.

[01:13:08]Let's go ahead and copy this.

[01:13:11]Whoops, not that one.

[01:13:18]Get AD group member identity.

[01:13:31]Okay.

[01:13:35]That was quick.

[01:13:37]Now I can move on to the next level.

[01:13:46]The password for Cyborg 5 is the Thank you very much, Igal 64, for following on Twitch. Thank you. The password for Cyborg 5 is the PowerShell module with the version number of 8989 plus the name of the file. Okay.

[01:14:07]PowerShell module.

[01:14:09]Look up PowerShell module by version number.

[01:14:26]to look up a PowerShell module by its specific version number. Get module fully qualified name.

[01:14:36]So get module list available fully qualified name and then what module version where object dover version equals something something. Well, let's give it a try.

[01:14:56]Did I miss the priv? Yeah. Yeah. I mean the the priv was the third hour of today's stream. So, if you want to go back to hour number three, although I guess it would be kind of difficult uh because we had to we had like a break.

[01:15:13]I hate MS terminology. Fully qualified name. Fully qualified name. Sure. Sure.

[01:15:24]Okay.

[01:15:32]aac accounts. So get module list available.

[01:15:46]I mean, I'm pretty sure we just need to list the available modules.

[01:15:54]It's going to be a big whack a big whack of stuff.

[01:15:58]Oh, okay. Okay. And then we can look up the version number where object version where object version equals something something. So, we're looking for 8989.

[01:16:36]Okay.

[01:16:40]Atvou says, "Is 30 hours of programming studies a week feasible to do?" Uh, it depends on what else you have to do during the week.

[01:16:48]If you're a full-time student, then three 30 hours of programming studies is possible possible considering that um like a full-time full-time studies is usually around 40 First wear object. Thank you. Thank you. Topam versus nightcore and seg. Hey, what is up? What is up?

[01:17:32]Okay. So, wear object.

[01:17:42]Oh, got to spell everything correctly, of course.

[01:17:46]No typos allowed.

[01:17:52]Bacon.

[01:17:54]Get bacon. What happens when you just when you type in get bacon?

[01:18:00]It's bacon.

[01:18:08]Pretty cool.

[01:18:16]They were able to pone with that name.

[01:18:22]Tupam versus Nightcore. H I expected asy art of Kevin Bacon. Well, I mean, it's one or the other.

[01:18:38]So, this is level four.

[01:18:48]Oh, kind to brick rolls. Okay.

[01:18:52]Thank you very much, I I Man02.

[01:18:56]Thank you very much for the follow on Twitch. Thank you.

[01:19:04]Okay. And we'll record the instructions and the method of solve.

[01:19:21]Okay.

[01:19:27]I remember those commercials begging strips for do dogs. Oh, there has to be like um TV commercials, dogs begging for bacon treats.

[01:19:56]What was the name of that product?

[01:20:00]Pyina begging strips. Okay. Is this Dogs don't know it's not bacon? Are you Is this the thing you're thinking of? Uh, April or something else.

[01:20:25]Now, what was that password?

[01:20:33]Yeah, that one. Awesome. Awesome.

[01:20:44]There was a retriever that would say it's bacon.

[01:20:57]Okay. And uh you know what? We might move on to something else after this.

[01:21:02]Under the wire PowerShell. Yeah. Yeah.

[01:21:04]We're doing a PowerShell like a PowerShell CTF exercise.

[01:21:10]It's basically like over the wire bandit but for PowerShell stuff.

[01:21:18]It's a bit It's a bit dry, but you know, for some reason, PowerShell stuff is never as interesting as like Linux stuff. It's just a personal preference.

[01:21:42]10,000 hours of mastery in a skill. I never learned phonics. Okay, that's what the research says. Well, I mean, programming mastery.

[01:21:56]What kind of uh what kind of programming language do you want to do, though? Do you want to do Python or do you want to do C or C++ or something else?

[01:22:08]People usually specialize.

[01:22:18]The password is what are they looking for again?

[01:22:37]the name, right?

[01:22:42]Do Zigg or Cobalt? Yeah, of course. Only machine language counts.

[01:22:48]Nedmax says 10,000 10,000 hours is mastering is mastering one area of programming, not programming in general.

[01:22:56]That would require a lifetime. Get help, get bacon.

[01:23:00]Get help, get bacon.

[01:23:06]eggs. Okay. So, bacon eggs. Bacon eggs cuz they say it's the module name.

[01:23:20]The module name. So, the module name is bacon.

[01:23:29]So, bacon eggs.

[01:23:36]It didn't work for you. Really?

[01:23:45]Let's try to log in.

[01:23:47]Matrix 4. How good is the movie Matrix 4? I did not watch it.

[01:24:01]Well, I mean, bacon eggs worked for me.

[01:24:07]True story. I had trouble learning to read until I stopped doing the phonics.

[01:24:11]You were Hm. The phonics got in the way, huh?

[01:24:25]Okay. So, let's let's finish off. Let's go ahead and do some I really want to do some low low-level stuff, right?

[01:24:40]Let's try doing all cyber training. Cyber.it.

[01:24:52]Oh, you memorized whole words instead of sounding them out. Okay, makes sense.

[01:25:02]All right, so let's do some of these low-level software challenges over at allcyber.it.

[01:25:12]These are all in Italian, of course, so it it's an extra layer of difficulty.

[01:25:26]But there are 25 challenges. Okay, so we did the supermarket one. Let's do this one called hidden variable hidden variable. So this I mean this is probably the worst getting into cyber security as a career or am I wasting my time? Um, while F90 comp, hello, nice to see you here.

[01:25:50]Um, I wouldn't get into cyber security as a career unless you were unless cyber security was something you were generally interested in. I wouldn't get into cyber security if you just want to see it as like a vehicle to get rich or to make a bunch of money. Although it's possible to get a bunch of money while working in cyber security. If that's the reason why you're doing it, I'd say that is probably the wrong reason to do it.

[01:26:19]But what what are your where are your interests? F90 comp.

[01:26:26]Let's get out of here.

[01:26:32]And what's up with this challenge?

[01:26:35]They've got um they've got a file for us to examine. So just copy that.

[01:26:42]It's called hidden variable.

[01:26:50]Okay. We'll download the file. Ooh.

[01:26:55]Yeah. Okay. Let's just download it by clicking on the link.

[01:27:11]Then we'll move it on into this directory.

[01:27:40]Okay, so now we're doing a software a software hacking challenge. We need to figure out what the flag is inside of this inside of this binary called hidden variable. So, I guess the first thing we want to do is we want to make the thing executable and then it will destroy our computer because we downloaded from a sketchy website.

[01:28:04]If you want to get rich, go for finance and get a job on Wall Street.

[01:28:09]H.

[01:28:12]Okay, let's run some strings on this.

[01:28:16]So, the first thing we want to do is we want to make sure that there's no suspicious I see something. Uh, that might be a flag in here.

[01:28:26]Latua flag.

[01:28:29]Whoops.

[01:28:38]So, there's a hidden variable in here, maybe. Okay. Thanks for the insight. I mean, you might want to take a look at F90 Comp. You might want to take a look at this website here or this web page.

[01:28:57]Go to medicine. That's easier money. H.

[01:29:07]All right. So, it's been a while since I've did done any s sort of uh software hacking stuff. We'll try Rodari 2 default hidden variable and then we will analyze it.

[01:29:32]And then we'll print the disassembly function at main.

[01:29:53]So they're talking about like a hidden hidden variable.

[01:30:06]So, they've got a flag. It's a bunch of Are these Unicode code points?

[01:30:13]Kiwi, hello. Nice to see you here. All these people, not enough likes on the stream. If you're enjoying what you're watching right now, go ahead and click on the thumbs up on the stream. Thank you.

[01:30:35]Okay, we got some arc B, some arc C hidden variable. So, I guess let's let's translate this page.

[01:31:01]Translate page from Italian to English.

[01:31:14]Okay. I can no longer find my variable.

[01:31:17]Could you lend me a hand?

[01:31:22]Hidden variable. So, we're using Redari 2.

[01:31:26]Although, I suppose I'll stick to using Reddara 2 for a little while.

[01:31:37]List binary variables.

[01:31:43]Use the I information command. So, it's I what?

[01:31:48]List all symbols, functions, and global variables. So is for the symbols H.

[01:32:05]Well, we've got we've got a variable called flag apparently.

[01:32:15]Is there hacking in the Star Wars films?

[01:32:17]Um, I think some of the I think some of the droids do some do some hacking. I'm not too completely sure.

[01:32:34]So, we got a flag over here.

[01:32:37]Global object.

[01:32:50]Jackson, America. Hello. Nice to see you here. Hope you're having a good time.

[01:33:09]So, there's this thing called the flag.

[01:33:11]And then what are these?

[01:33:30]So it looks like it prints out the flag here.

[01:33:36]one like five characters.

[01:33:48]What are we doing today? Uh we were doing some PowerShell hacking CTF exercises, but uh we kind of did a lot of them. Um so we're doing some different stuff now. We're doing some reverse engineering.

[01:34:10]But of course, we're dealing with a website that's in Italian, so we have to Google translate some stuff.

[01:34:21]Okay, you should try cutter. I've I've thought about it. Um the the one big impediment is that I I've never found a good way to install Cutter. Let's translate.

[01:34:50]Okay. The something flag. Your flag.

[01:34:55]Your flag.

[01:34:57]So, this prints out your flag.

[01:35:07]Well, this is a message, right?

[01:35:20]So, I just need to make sure that these are code points.

[01:35:39]H.

[01:35:42]So if we just run the thing.

[01:35:47]So something. Can you get the original It looks corrupted. Where did I live the Where did I leave the original? So the original flag. Ah, okay. So I think I understand.

[01:36:11]So it tries to print out the flag, but it just comes out as a garble.

[01:36:18]And this is this is this message here.

[01:36:26]So there might be like um there might be like a hidden function.

[01:36:49]Okay. So, Jackson says, "I was trying to install Ubuntu Linux into my 13-year-old laptop.

[01:36:56]I made an a micro SD card as an installer, but during the during the bootup, the laptop could not read the micro SD card."

[01:37:06]H Okay, let's see if we can identify some of these functions.

[01:37:21]So there's a main function.

[01:37:31]Was there like a there was this object called flag that we found over here. Where was it?

[01:37:44]Flag here. So, can we can we look up what is in this memory?

[01:37:58]I forgot all of my radar commands.

[01:38:04]So, it's like print print hexodimal at this address.

[01:38:12]Oh, wow.

[01:38:16]There's the flag.

[01:38:19]But how do we how do we get only the printable characters?

[01:38:37]There's got to be some Linux fu we can do to get to get this.

[01:38:41]So print hexodimal. Maybe print asy.

[01:38:58]So let's see we're to print asky at memory address.

[01:39:10]Mhm. An exact copy of it with xxd. Then strip out the non-printing. Oh, maybe.

[01:39:14]Yeah.

[01:39:18]So, PS to print null terminated as strings. Okay. So, PS. So, we'll try PS H.

[01:39:33]That's just an F.

[01:39:37]Okay. Not great at reversing. I mean, this is why we're here. We're here to get We're here to get better at reversing, but you know, Sisos Master's recommendation isn't it isn't a bad idea.

[01:39:52]So, we just grab this and then turn it into like a hex dump cuz this this is basically a hex dump, right?

[01:40:03]Nano flag.dump.

[01:40:08]Paste it in. Save it out. Then we'll use xxd reverse printable on flag.dump.

[01:40:22]H.

[01:40:27]That still looks pretty rough.

[01:40:31]Yeah. There are too many um null bites in the way. There are single characters surrounded with the nullles. Yeah.

[01:40:40]I mean, what if we Okay, so we can output this to maybe we can pipe this into strings.

[01:40:50]No, we can't.

[01:41:06]I think let's do some fancy Linux fu. So, um, what's it od delimiter space field?

[01:41:42]I don't know. Seven.

[01:41:47]Was it TR?

[01:42:00]No, no, no.

[01:42:13]to output only certain fields.

[01:42:22]Oh, it's the print statement. Okay. So, o print. So, it's o print third and first and third columns of the file. So, o print.

[01:42:37]Well, I mean, we're only looking for the last column in this case.

[01:42:52]So print like 1 2 3 4 5 6 7 8 H 9 And okay, so here's our flag.

[01:43:15]We now need to delete.

[01:43:23]Delete the dots and then delete the new lines.

[01:43:35]Yeah, there we go.

[01:43:42]Okay, and that's one reverse engineering challenge done.

[01:43:47]I really want to get better at doing reverse engineering.

[01:43:55]Submit.

[01:43:56]Yep. Okay, let's see the write up.

[01:44:01]Thank you. Thank you, Ignifer.

[01:44:09]So this is for all cyber software hacking Olympiad.

[01:44:18]Oh, I've got one.

[01:44:30]I've already done this challenge before.

[01:44:51]Okay. Well, I don't think I solved the challenge when I when I did tried doing this the last time. So, how this was five months ago, so almost half a year.

[01:45:07]Okay, let's let's go ahead and actually solve the challenge this time cuz this looks like half the work. Yeah, it's about half the work, but not a not the not everything.

[01:45:20]Okay, what's actually going on is that there is an object called flag that is at that is stored at a specific memory address.

[01:45:51]Okay. Flagrante FL flagrant Elbow, hello. Nice to see you here. What is up? We're just uh hanging out. We're trying to do some software hacking challenges over here.

[01:46:05]Okay. So this is all redari 2 radari 2 um syntax.

[01:46:25]So is gives us the the list of variables or like um objects.

[01:46:57]So the memory address we've got for this one is this.

[01:47:02]So what we can do is we can print out the hexodimal located at this location, the memory location.

[01:47:18]So, it's just going to be px at this.

[01:47:29]Okay. And this gives us our flag.

[01:47:32]But it looks there's got to be like a more elegant way of doing this.

[01:47:42]All right. So, let's go ahead and go on for another hour or so. I could spend a lot of time doing reverse engineering challenges.

[01:48:02]Okay. Flag is at this memory address.

[01:48:06]So the flag is here, but it's um but it's messy.

[01:48:17]Save the output from the hex dump into a file. Then use your Linux fu.

[01:48:30]Reverse engineering is cool. I mean, I agree. You can definitely reverse engineering is very very cool especially if you can do it at high levels. I cannot but uh I'm trying to get there and I'm trying to share my share what I learn with all of you all.

[01:49:00]Okay, that is done.

[01:49:06]So what was the other easy one? So private club. So software hacking Olympiad.

[01:49:14]Private club.

[01:49:17]What were the other?

[01:49:19]Supermarket.

[01:49:22]Supermarket. Private club. What was supermarket again? I didn't do a write up.

[01:49:27]I want to be the customer of the supermarket.

[01:49:31]the customer of the month of the supermarket. Can you help me out? Okay.

[01:49:36]And why don't you give this a try yourself?

[01:49:43]So, we got the the compiled binary and we also have the C source code for the supermarket app.

[01:49:53]Here's the thing. If you didn't document it, it didn't happen. So, we need to make it happen.

[01:50:06]Let's download these files. So the source C and the supermarket Okay. So, let's take a look at the source code.

[01:50:42]Oh, okay. Okay. So, we need to find some way to to purchase the flag and then it'll give you the flag for the uh for the thing.

[01:50:56]So run supermarket.

[01:51:02]So current.

[01:51:04]So we have 10 euro.

[01:51:10]Kosa voya compl. Uh I don't know what that means. What does it mean? Google translate.

[01:51:21]What do you want to buy?

[01:51:26]So my suspicion here is that we can buy negative amounts. Yeah. Can we underflow the current amount? So we'll try buying the um pasti past alakma.

[01:51:44]And we'll just try the quantity. We'll buy minus 10,000.

[01:51:54]Gihato dispatch. Um, you tried. I'm sorry. Okay.

[01:52:14]So, we'll try running it again. We'll try buying this ultra ultra or like again or more.

[01:52:29]We buy four of the three one maybe other. So like continue uh yes buy this. How many do you want? like negative -2.

[01:52:50]Okay. So, we were able to buy a negative amount.

[01:52:55]So, I guess I'm guessing that it it waits for you to it does the comparison of whether or not you have enough money to to buy the thing.

[01:53:06]So if we choose three quantity minus one segmentation fault. So if we try to buy the flag and buy negative one of it it uh it crashes the program.

[01:53:26]How many you want minus 30?

[01:53:31]Now we've got 100. So, how many how many do we need to buy of this three thing to afford this?

[01:53:43]Some a million.

[01:54:01]I'm getting closer. How about 30,000?

[01:54:13]How about 300,000?

[01:54:28]H. Do we have enough?

[01:54:32]No, we're like we're like a few off.

[01:54:35]So, let's try buying negative a million.

[01:54:49]Okay, now we definitely have enough. So, we can just buy the flag.

[01:54:58]But when we try to buy the flag, it uh crashes the program. Maybe it crashes the program because we don't have the the flag file in here. Anyways, let's move on to the actual uh online version of the app over at All Cyber.

[01:55:15]So, we'll buy the first item. We'll buy 1 million and then we will buy the flag.

[01:55:30]Yeah, negative amount is not an amount.

[01:55:33]Okay.

[01:55:35]Yeah, we got it. This time we're going to document it so that we actually so that we actually did it.

[01:55:49]Okay. So this challenge is called supermarket.

[01:56:17]Okay. Okay. So this challenge is here.

[01:56:25]The concept we need to understand for this challenge is business logic flaws.

[01:56:38]So business logic flaws and I guess there's the whole concept of buying negative amounts.

[01:56:53]So, buying negative amounts, this leads to the infinite money glitch.

[01:57:05]Okay, so the method is solved. So the source code for this app looks like this.

[01:57:21]And let's grab that source code.

[01:57:49]Okay.

[01:57:54]So there is there are a distinct lack of checks to ensure that user input doesn't doesn't include negative numbers.

[01:58:23]which enables users to buy a negative amount of items.

[01:58:38]Okay. So, I guess what we need to do is we need to identify the part of the program that doesn't do the check.

[01:58:54]So price times amount.

[01:58:59]And how do we like result scanf amount?

[01:59:04]There's no check here.

[01:59:24]Okay. So, what does this mean?

[01:59:29]Um, never never trust user input. Yeah, that makes sense.

[01:59:37]The flag costs 1 million1 million euro.

[01:59:49]Sell or buy?

[01:59:52]Buy negative 1 million of any of the lower price items to get a balance of over 1 million euro.

[02:00:17]And I guess that's it.

[02:00:25]Okay, we can move on to the next challenge. So, the next challenge is private club.

[02:00:41]Okay. Only those who have the badge can join my private club. Smiley face.

[02:00:46]Okay. If you want to give this a shot yourself, here's the link or sorry, here's the uh the netcat command.

[02:00:56]So, private club, I think this is like um JavaScript challenge.

[02:01:28]Okay. So, what kind of file is this?

[02:01:32]Oh, this is just the executable.

[02:01:35]So, we're not given the source code.

[02:01:42]Okay, I actually have some notes for this, so I should probably take a look.

[02:01:51]Stack buffer overflow variable overwrite overwrite to win.

[02:01:56]So after downloading and making the binary executable, we run the binary.

[02:01:59]The binary takes in two inputs, then exits.

[02:02:04]This is what the main function disassembly looks like. Rear 2. Okay.

[02:02:10]We see that there is a branch of the main function that that opens up a shell for us.

[02:02:17]But in order to access the branch of the program, the the program must have a certain variable set.

[02:02:24]So before the test instruction, the bite in the var memory address is loaded into the EX register.

[02:02:32]And if the contents of the var the contents of var is smaller than the size of EAX, then the rest of the register is filled up with zeros.

[02:02:49]This payload should solve the challenge.

[02:02:51]HTO says, "Is Windows source code just encrypted? How do they hide their code?"

[02:03:01]I mean, there's I mean, I haven't really taken a look at Windows binaries.

[02:03:07]I'm sure if you were to work hard enough, you would be able to reverse engineer it.

[02:03:15]They probably take some measures to make sure that their stuff is hard to reverse engineer as well.

[02:03:26]Okay, let's see.

[02:03:29]Apparently, I didn't solve the challenge on the Ally website, but I've got this um this write up here that I did. How many how long ago did I do this write up?

[02:03:45]So, I did this write up 5 months ago as well. So, this was in this was in February or something.

[02:04:04]Apparently, this is not actually. Wait. Oh, okay. Okay. This gives us a shell.

[02:04:14]So, just cap the flag.

[02:04:19]Wow. Wow. Wow. Wow. They don't encrypt.

[02:04:24]Okay.

[02:04:26]Bad scanf. So scan like scan I think this is supposed to um illustrate that scan f is an insecure is an insecure function in C.

[02:04:39]Let's submit that flag.

[02:04:47]Okay, that is the correct flag.

[02:04:49]Great.

[02:04:55]All right. And I guess we can move on to the next challenge, which is Instagram generator. Instagram, huh?

[02:05:09]Let's get out of here.

[02:05:21]Not insta, but enter. H.

[02:05:27]So, what's going on with this challenge?

[02:05:32]I found this service that generates phrases for Instagram.

[02:05:37]At some point, however, he printed me sentences that he shouldn't have shown me. I think I think this is supposed to be some sort of um format vulnerability.

[02:05:56]Okay, let's let's download these files first.

[02:06:05]Out of bounds read maybe.

[02:06:08]Let's move the source code files.

[02:06:27]Okay. So, if we just run the thing, it crashes.

[02:06:36]If we just run the program, it crashes.

[02:06:39]All right.

[02:06:53]Mhm. Okay, we got some phrases over here.

[02:07:12]All right, let's try accessing the challenge with Netcat.

[02:07:32]So, let's see. Input the number from 1 to 10 to get a phrase. To get your phrase, choose a number from 1 to 10 to get your phrase.

[02:07:47]So maybe zero 11 12.

[02:08:05]What if it's a really big number?

[02:08:13]Hm.

[02:08:17]What is this message?

[02:08:28]Come back for new catchphrases. Okay, sure.

[02:08:41]Although I guess We might want to um dump out memory addresses and we can do it like this like pointers.

[02:08:59]Dump out the pointers.

[02:09:04]Hm.

[02:09:09]Otherwise, we'd have to figure out where the vulnerability is specifically.

[02:09:29]So usually we need to identify where the the vulnerable function is.

[02:09:37]There are a bunch of like common vulnerable functions uh in these beginner level binary exploitation challenges.

[02:10:05]So maybe it's puts puts or scanf.

[02:10:19]It's probably scanf because scanf is a like a notorious insecure function.

[02:10:38]This gets saved to choice result is not one and or choice is greater than one. So it has to be over one. So it can't be negative system strings.

[02:11:09]Wait, where do they define that? Okay, so system strings are characters.

[02:11:26]If this is a beginner stream, then non- beginners would be so hard. Yeah. No, I mean, this isn't this isn't a beginner level stream necessarily. This the beginner level stuff was all at the beginning of the stream.

[02:11:39]I'm really missing the color highlights.

[02:11:41]Yeah. I mean, if if we wanted to see the color highlights, we would do this.

[02:12:01]So, system strings, it uses these phrases here.

[02:12:12]So, it's an array of characters.

[02:12:22]One, two, three, four, five, 6, 7, 8, 9, 10.

[02:12:43]Well, get character is not H.

[02:12:54]So the system strings is also an array that the program uses to output to output the program um the program messages.

[02:13:22]So they define flag in read mode. Oh, you know what? That's why the program must have crashed.

[02:13:41]System strings 2.

[02:13:46]So scan f scan off the contents of the flag and save it to system strings two.

[02:13:55]So system strings two is I mean it starts starting it starts counting from zero. 0 1 2 3 4 5.

[02:14:12]0 1 2 3 4 5 which means that um the flag is blank.

[02:14:23]Yeah, I mean the flag is probably blank in the source code, but if we So how do we output the system system string too?

[02:14:36]because we only have um control over the phrases that we get here.

[02:14:45]Okay, let's try running the the netcat command. Where is it?

[02:15:15]Okay, try 14. 14. Oh, that's kind of clever. Yeah, let's give it a shot.

[02:15:28]It gave us something.

[02:15:49]We need to go beyond the boundaries of the array. Sounds about right.

[02:15:54]So 13 14 gives us something. 15 16 17 18 19 20 21 20 Ooh, we got timed out.

[02:16:29]Okay, we need to locate the system strings array.

[02:16:39]So the system strings array was like six big. I think we can jump with increments of five.

[02:16:48]It's like 10.

[02:16:51]So we start with 15 then 20 then 25 30 35 Oh wait I think there might be there might be an easier way of doing this. We could probably like debug.

[02:17:18]We could debug using um using radar.

[02:17:27]First, we need to make a make something called flag. Right.

[02:17:37]Yeah. Flag. So, we'll make something called flag. Echo hacker frogs.

[02:17:44]like and subscribe to a file called flag.

[02:17:54]And then we can we might be able to supply like a like a memory address cuz scan sometimes scanf can take in some really weird looking stuff.

[02:18:12]Anyways, so Redari 2 debug integram thing.

[02:18:20]Whoops.

[02:18:23]Okay. Analyze that.

[02:18:27]And then PDF.

[02:18:36]So where do they put this stuff?

[02:18:45]We need to figure out where they store the the variables.

[02:18:50]Relooks relocation is present. Addresses will not be fixed. Oh, that's that's um unfortunate.

[02:19:23]Okay. So, I mean, we can find where they store this stuff, right?

[02:19:29]Relative addresses might and offsets would.

[02:19:32]So, we just need to figure out where where the string is. So, no pain mode gain.

[02:20:04]The F open call. Yes. Open call.

[02:20:28]the one that reads in the flag. Yeah.

[02:20:30]Okay.

[02:20:32]So, let's see. Flo open. Okay. So, call colon fop here.

[02:20:41]String flag.

[02:21:02]So, this reads in the flag.

[02:21:07]I think what we need to do is we need to figure out where the where the system strings are are located though.

[02:21:18]Maybe actually let's set a little um break point. So, we'll set a break point for over here right after it loads in the flag.

[02:21:43]And then maybe we can take a look at what's in the memory at that point.

[02:22:08]Uh, I forget what the terminology is to get the variables.

[02:22:37]Okay. Local variables and arguments. So, AF, yeah, AFV. Let's call variables and arguments. So, AFV.

[02:22:46]So, we got a bunch of different locations we could look at.

[02:22:57]Yeah. Oh, there we go. There's our hacker frogs.

[02:23:07]There's our hacker frogs message. Yeah.

[02:23:11]So, I mean, we can't load this thing specifically, although it would be really nice if we could.

[02:23:34]So, how far is it away from the other array?

[02:23:38]Oh, that's a that's a good question.

[02:23:47]So I'm pretty sure that this is so it's 012.

[02:23:53]This is the memory address.

[02:24:02]So this is the flag string.

[02:24:07]The flag string array is here.

[02:24:10]So the other one is the one with the phrases.

[02:24:21]And I think it might be this.

[02:24:41]No, that was the same one. Just a second.

[02:24:45]Uh, Varten is here.

[02:24:52]Ho ho. Hello. Nice to see you here. What is up?

[02:25:00]So, this is a bunch of garbage.

[02:25:05]We'll try this other one.

[02:25:12]You're on try hackme now. That's great.

[02:25:18]There we go.

[02:25:20]This is where This is where the um the phrases are.

[02:25:31]Whoops.

[02:25:41]So something like this.

[02:26:01]Okay. So how many what is the the difference between this one and this one? So it looks like how many bytes is this?

[02:26:15]So 00 and FD uh FD let's hex to decimal 200.

[02:26:44]Okay. Um, hey ho ho ho. Um, please stop typing in all caps. Thank you.

[02:26:55]So, this is decimal number two 253. 253. Okay. So, let's let's give it a try from 253.

[02:27:16]H.

[02:27:23]So, it doesn't it doesn't let you do anything above a certain number. So, I wonder what that number is.

[02:27:33]So, 100's fine. 200 is fine. 220 is still fine.

[02:27:53]230 240 What was the number we were looking for?

[02:28:01]253 252 253 crashes the program or it head.

[02:28:37]So 255 immediately crashes the program.

[02:28:46]240 also crashes the program. 230 230 to 27.

[02:29:06]Hm.

[02:29:13]259.

[02:29:15]259.

[02:29:32]So, what numbers are going to make the thing crash?

[02:29:39]210 Parla Eng. Um, hello GX00. Nice to see you here. We're just doing some reverse engineering challenges.

[02:30:05]But >> doesn't that compare to correspond to an integer length? Integer length.

[02:30:22]Let's take a closer look at What's being referenced here?

[02:30:44]Do we divide the address by the array size?

[02:30:52]Yeah, I'm not too sure how we're supposed to be doing this.

[02:31:05]So, print f system strings 3. There's nothing that specifically prints out system strings 2 though.

[02:31:15]System strings 5.

[02:31:18]System strings 2 is referenced up here.

[02:31:35]Thank you very much. Reckless ties.

[02:31:38]Thank you.

[02:31:41]64 is the uh the string length.

[02:31:45]String length.

[02:31:54]So each one of these strings is supposed to be 64 bits in length or 64 characters in length.

[02:32:19]It runs scan F on choice.

[02:32:32]print f system strings three with the phrase at the index.

[02:32:47]Mhm.

[02:32:49]So a short index short index.

[02:33:05]It's 13.

[02:33:22]So 64. What is this? What is FS? FC scan F file scan.

[02:33:38]Okay, let's let's get some hints cuz we can we're we're entitled to them. Yay.

[02:33:46]I found this service that generates phrases for Instagram. At some point, however, he printed me sentences that he shouldn't have shown me.

[02:33:53]Okay, so hints. Do you want to unlock the hint? Sure.

[02:33:59]Check the management of the number you well enter. Well, where and how it moves it.

[02:34:06]File scan formatted.

[02:34:09]The number you enter, where and how it moves it.

[02:34:16]Well, I mean, this is probably talking about we're probably doing some uh overflow, right?

[02:34:24]Wait, if it's overflow, then maybe we can.

[02:34:42]Do you have like some really big input.

[02:34:50]I guess they don't really care about about like non-numerical input here either.

[02:35:00]The rereamer is lagging, is it?

[02:35:09]Oh, yeah. It's It's lagging pretty bad.

[02:35:22]So if you give really big numbers, it just Ooh, wait. It didn't crash. I thought if we give it like really big numbers, it would just crash.

[02:35:35]H probably a memory leak. I mean, it's it has to do with like buffering.

[02:35:49]The longer the stream goes, it's um it gets further and further behind because of the the reream buffer on uh on YouTube.

[02:36:10]Okay. So, since I've never deal dealt with some stuff like this before, I'm going to ask for I'm going to ask the AI for a little bit of help.

[02:36:33]Okay. AI solve all my problems.

[02:36:40]So this I guess we could call this um binary exploitation challenge.

[02:37:01]So, we're supposed to access the what was it? System strings.

[02:37:12]System strings to object.

[02:37:27]What is the recommended method to arrive there? Bam.

[02:37:51]I don't see a response. Okay, here we go.

[02:37:55]Nice challenge. Here's a concise practical analysis on how you reach the system strings in this program. Keeping things readable and focused on what you can test locally. What the code does, it loads in a string from a file into system strings by doing fop scan f and then f close.

[02:38:14]System strings is defined as six strings each 64 bytes with system strings being initially empty but it will be overwritten by the contents of the flag up to 63 characters stopping at whites space.

[02:38:28]Okay. The only direct user input that could affect memory layout here is via scanf flows into choice index and end choice. The program uses scanf to read a number.

[02:38:43]Scan F.

[02:38:45]So let's see. Hu. Hu is unsigned, right?

[02:38:51]But what is H?

[02:38:53]A local array frazzy. Not um obviously overflowed here.

[02:39:00]The key risk is that system strings is written from a file, not from user input. If you can influence the contents of the flag file, you can set system strings to any string.

[02:39:12]the content of the flag file. H but given the challenge says access the system strings object to get the flag, you expected to leverage memory out memory layout or control flow to cause the program to print or otherwise reveal system strings after the initial load.

[02:39:31]Okay, understand the print flow.

[02:39:37]If we could manipulate the flag file, we would have won already. That's true.

[02:39:47]Okay. After each iteration, it prints system strings and reads n choice. If n choice equals s, it loops again.

[02:39:54]Otherwise, it ends by printing the system strings. If n choice equals s h.

[02:40:05]Okay. File content as flag injection.

[02:40:08]You can modify the flag file before running. I don't think we're doing that.

[02:40:13]Format string printf misuse.

[02:40:17]If system strings can be manipulated to include format specifiers, it could cause a format string vulnerability.

[02:40:25]System strings is initializes as this and is overwritten only by scanf into system strings and writes the flag into the slot.

[02:40:43]disabling certain protections. This this uh they really want us to to hack the hack the flag.

[02:40:56]Okay. The intended route is likely a format string vulnerability via system strings being used as the format string to print f.

[02:41:11]Mhm.

[02:41:15]Experiment with flag content flag with a flag containing format specifiers. Um, we can't do that.

[02:41:24]Yeah, the AI is not helping us out very much.

[02:41:43]Can you link me the challenge? Yeah, I can certainly do that. It's over here.

[02:41:49]We can also pick up the extra.

[02:41:52]Maybe tell the AI that you suspect an offset entry.

[02:41:59]Yeah. Okay. We can uh we can talk about that. Let's let's get the extra the the other hint.

[02:42:08]Okay. Unsigned short choice equals zero.

[02:42:13]Integer index equals zero.

[02:42:17]H.

[02:42:20]So the unsigned short is registered as your choice.

[02:42:39]We suspect that we can access the system strings strings array from the from the choice variable.

[02:43:10]by providing a number that is outside of the range of the frazzy of the frazzy array.

[02:43:26]Okay, you can try manipulating the choice input to read memory beyond the fryzy array, but the code path doesn't expose system strings directly via that output. The realistic path is to leverage a format string vulnerability in the print f call using the string stored in system strings as a format content of system strings.

[02:43:47]Okay, let's say let's tell this guy um straight up we cannot modify the contents of the flag file.

[02:44:10]Okay. print f style format string vulnerabilities.

[02:44:17]So we could try looking for stuff that looks like this.

[02:44:47]We are getting stuff by going beyond.

[02:44:53]So 12 13 14. So this is just like random random data.

[02:45:09]What we need to find is we need to find where the actual system strings lie.

[02:45:44]The other thing they they told us to pay a lot of attention to is uh this right over here. Right.

[02:45:52]So hint to unsigned short choice equals zero. int index equals zero.

[02:46:00]Can also give this hint to the AI.

[02:46:04]We were told in a hint to pay attention to this part of the code.

[02:46:19]Okay. If the code declares unsigned short choice and in index There are a couple of common pattern implications to investigate without modifying the flag file. So the unsigned short choice may be used to control which p code path is taken. Its value wraps at this value right here. So 65,536.

[02:46:46]So if an input influences choice, you might trigger an outofbounds or misindex path even when the value seems small.

[02:46:58]The integer index is assigned 32-bit value on most platforms.

[02:47:05]I mean what happens if we give this big number here and this wraps around back to one.

[02:47:29]That's interesting.

[02:47:33]So if we So this should be number two.

[02:47:42]Yeah.

[02:47:53]Okay.

[02:47:54]So that wraps around.

[02:47:59]Okay. So What happens if we go beyond beyond this?

[02:48:11]So this is the last one.

[02:48:22]46 is the last one. What about 47 then?

[02:48:27]It's just nothing. Okay.

[02:48:43]Ah, okay. So, it just it just wraps around.

[02:48:49]Just enter the number and it overflows.

[02:48:51]Gives the flag. Enter that number and overflows.

[02:48:55]I mean, if it over it overflows, yeah, but it doesn't it doesn't give us the flag necessarily.

[02:49:03]I got the flag by literally entering 5533. Really?

[02:49:11]65533.

[02:49:17]Oh, okay. Okay. Okay. So, it I mean it wraps around But why? Okay. I I mean, we're we're pretty much um we're pretty much done.

[02:49:30]Um I think I' what I'd like to do is I'd like to take a look at a write up to figure out why the program behaves like this.

[02:49:42]I guess that was that was the next step.

[02:49:44]The next step was to just step down. So from the big number just keep on going down in in value. So 536 535 534 cuz there are only so many values there.

[02:50:04]All right. So let's talk about what we're going to be doing next week.

[02:50:12]So, next week is week 30, and we've got some uh some new streams coming up. So, we're we're going to be doing a stream on Sunday that we're adding to our late night rotation. So, we're doing two late night streams, coding Sunday and co-working Tuesday to start off the week. And then we're going to do our regular streams on Wednesday and on Friday at our regular time.

[02:50:35]But to people who like staying up late in North America, you're in for a treat cuz we're going to be doing leak code stuff on Sunday and then we're going to be learning C programming on Tuesday.

[02:50:51]Thank you very much. Ho ho ho. Thank you. Thank you. Okay, so let's go ahead and All right. I'm going to copy what you uh what you provided there.

[02:51:06]Nul sec. Thank you.

[02:51:18]Okay.

[02:51:20]And well, I mean, we're going to be uh going away for a little bit, but in the meantime, let's see who is doing infosex streaming. So, this is a fun list of people who do intros cyber security streams, hacking streams on YouTube and on Twitch. And usually if people are online, you'll see a green button over here. And I'm the only person.

[02:51:48]That's okay. Let's see who's streaming on Twitch right now.

[02:51:54]Looks like we've got Muhoodles. Okay, Muhoodles is usually doing some fun space stuff. Let's take a look at what she's doing.

[02:52:21]Oh yeah. I mean, we we're usually doing beginner level stuff at the at the start of the stream. So, Muhoodles is doing some Ambassador Celebration stream, Astrobiology, and space news. Ask me anything. Okay, so she's definitely a very uh a very fun streamer. She does educational content. We're going to raid into her channel.

[02:52:41]Raid Moo Hoodles.

[02:52:46]Okay, when you arrive on our stream, if you could give this message right here, OS Frog Hip Hop Hack OS Frog, I'd really appreciate it. Thank you very much. And yeah, we'll see you on Sunday. Sunday is going to be the next stream. We're going to be doing some coding.

[02:53:02]But have a great weekend. And uh until next time, HackerFrogs out in 5 4 3 2 1.

[02:53:12]See you next time everybody.