Blue Team Challenges EXPLAINED | with sebh24
Source: YouTube · Hack The Box · published Jan 17, 2023 · 35:24
Sebastian Hague walks through the "Keep the Stream Activated" forensics challenge from HackTheBox, demonstrating how to analyze network traffic to identify a Covenant C2 attack, exfiltrated Active Directory credentials, and encrypted WinRM sessions to recover the flag 0:00-0:44.
Key Takeaways:
• Using NetworkMiner, Seb identifies a malicious internal host (192.168.1.9) communicating with the Domain Controller and extracts suspicious PowerShell scripts and a netcat executable 2:21-4:00.
• Analyzing a drop.ps1 script via Cyber Chef reveals it contains a raw-inflated payload identified as a Covenant C2 launcher, indicating a red team operation 6:45-9:31.
• Wireshark analysis shows the attacker used Netcat to exfiltrate the ntds.dit database and system registry hives from the Domain Controller via port 8080 13:01-17:00.
• By extracting the files from the PCAP and using Impacket's secretsdump, Seb successfully retrieves the administrator's NTLM hash offline 17:01-23:33.
• Using the cracked hash to decrypt captured WinRM traffic with a Python script reveals the final flag hidden in the session data 29:59-30:16.
This walkthrough illustrates essential blue team techniques for investigating network intrusions and decrypting compromised communications.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Incident Response. Commonly maps to: Security Operations, Security Assessment and Testing. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello good afternoon or good morning wherever you are in the world for a minute um so you just had the live webpacking at University CTF 2021 web challenge explained um we're now doing the reverse of that in essence and doing a bit of a talk through one of the challenges from last year and that is blue content forensics explained uh by myself who has said page 24 um or Sebastian Hague if you want to find me on LinkedIn um my role here at the box is the defensive content lead and I've been here for about three months now so I'm fairly new to it so keep your eye out of the blue team content that will be coming at some point anyway without further Ado let's just jump straight into it uh the activities I was covering today is challenge called keep the stream activated and I won't be accessing …