Forensics Challenges Walkthroughs | by 0xdf
Source: YouTube · Hack The Box · published Mar 21, 2023 · 43:32
This video demonstrates solving two CTF forensics challenges: identifying a Windows registry persistence mechanism using RC4 decryption and analyzing a PCAP file to detect DNS exfiltration decrypted via AES 0:00.
Key Takeaways:
• In the "Golden Persistence" challenge, a suspicious base64-encoded PowerShell command is found in the registry Run key, which reads values to decrypt and execute a payload using RC4 1:40, 5:00.
• Tools like Registry Explorer or Linux reglookup are used to extract registry keys, while CyberChef facilitates the decoding of the encoded strings and the final decryption process 2:56, 15:45.
• The "Automation" challenge involves analyzing a PCAP with excessive DNS traffic, where a fake image file containing a PowerShell script reveals a DNS exfiltration setup 16:35, 22:05.
• A Python script utilizing Scapy parses DNS queries and responses to reassemble encrypted data chunks, which are then decrypted using AES in CBC mode to retrieve the flag 26:07, 35:34.
The presenter highlights the importance of scripting and understanding network protocols for effective forensic analysis and CTF participation 43:20.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hey this is oxtf thanks for joining me today uh today in prep for the 2023 cyber apocalypse we're going to go over two of the forensics challenges from the 2022 cyber apocalypse because you know learning the skills necessary last year is probably going to be helpful going into this year uh we're gonna look at two uh types of challenges one of them is looking at a Windows registry file and finding the persistence and then decoding and breaking down what was going on there and the other one is looking through a pcap and finding some DNS exfiltration and understanding how it's happening decrypting the data and finding the flag in there so all in all hopefully it'll be a fun time and uh let's go ahead and jump in so we're going to look at the challenge golden persistence from last year's uh cy…