Lab link. Questions 1. What is the name of the webshell that was used by Mayor Malware? The Kubernetes cluster is started using Minikube. The output shows that the cluster has been successfully started and configured by default. We check…
Lab link. Questions 1. What is the function name that downloads and executes files in the WarevilleApp.exe? DownloadAndExecuteFile 2. Once you execute the WarevilleApp.exe, it downloads another binary to the Downloads folder. What is the name of the binary? explorer.exe…
Lab link. Questions 1. What was the first message the payload sent to Mayor Malware’s C2? ip.src == 10.10.229.217 system prompt 2. What was the IP address of the C2 server? 10.10.123.224 3. What was the command sent by the…
Lab link. Questions 1. What is the OTP flag? If we run the command <strong>frida-trace ./TryUnlockMe -i 'libaocgame.so!*'</strong>, it will automatically start tracing all the functions. The penguin is requesting a PIN code, which is handled by the <strong>_Z7set_otpi</strong> function.…
Lab link. Questions 1. What is the technical term for a set of rules and instructions given to a chatbot? system prompt 2. What query should we use if we wanted to get the “status” of the health service from…
Lab link. Questions 1. Extract all the events from the cctv_feed logs. How many logs were captured associated with the successful login? 642 2. What is the Session_id associated with the attacker who deleted the recording? rij5uu4gt204q0d3eb7jj86okt 3. What is…
Lab link. Questions 1. What is the password for backupware that was leaked? az ad user list –filter “startsWith(‘wvusr-‘, displayName)” R3c0v3r_s3cr3ts! 2. What is the group ID of the Secret Recovery Group? 7d96660a-02e1-4112-9515-1762d0cb66b7 3. What is the name of the…
Lab link. Questions 1. On what day was Glitch_Malware last logged in? Answer format: DD/MM/YYYY 07/11/2024 2. What event ID shows the login of the Glitch_Malware user? 4624 3. Read the PowerShell history of the Administrator account. What was the…
Lab link. Questions 1. What is the name of the CA that has signed the Gift Scheduler certificate? THM 2. Look inside the POST requests in the HTTP history. What is the password for the snowballelf account? c4rrotn0s3 3. Use the credentials…