Carson: A walkthrough, talkthrough of a Hardening Sherlock by sebh24 | Business CTF 2024 workshops
Source: YouTube · Hack The Box · published May 17, 2024 · 24:11
This video demonstrates a "Hardening Sherlock" exercise where the presenter investigates a compromised WebButler host, identifies an attacker's webshell and IP address, and implements a patch to secure the system 0:20-0:50.
Key Takeaways:
• The investigation begins by SSHing into the host and analyzing Apache access logs, which reveals suspicious activity including commands executed via a file named update.php 3:25-8:01.
• The update.php file is found to be a Base64-encoded webshell, and log analysis confirms it was uploaded by an attacker on February 14, 2024, at 12:17:32 UTC 10:00-12:38.
• To remediate the vulnerability, the presenter removes the malicious file and creates an .htaccess file to deny access to all PHP files in the media upload directory 16:30-18:10.
This walkthrough highlights the importance of not only identifying indicators of compromise but also taking active steps to patch and harden systems against future attacks 23:50-24:05.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
okay uh good morning good afternoon good evening wherever you are in the world um hopefully you're all enjoying business CTF talk so far and good luck in the CTF that's taking place in the very near future um my talk um I'm sub ag24 um defensive content lead here at at the box and what I'll be talking through um is an exclusive piece of content within the Enterprise platform in Sherlock called Carson which is a first of its kind for us and it's a a walk through talk through of what we call a hardening Sherlock what that what does that mean essentially that means that we're going Beyond just the analysis and we're actually putting in place um an element of a patch of s description uh to try and remedy a vulnerability that is in place on the host that we are actually investigating and so wit…