Postpwned Ramblings

Hint: We believe that there is an SSH Password inside password protected 'ZIP' folder. Can you crack the 'ZIP' folder and get the SSH password? I almost went back and watched every episode of Mr. Robot before starting this challenge, but I was too eager to do that. I downloaded the zip file with wget and extracted it using unzip and the provided password. This may get confusing later, but luckily they named the target zip file without the "0" in the name. First thing's first, we need to do what the hint says, crack the zip file. Lucky for us, Kali has a built-in zip cracker that can use either a brute force attack, or a dictionary attack. If you’re following my articles by published date, you should already have rockyou.txt. If not, please refer to the "0ld is g0ld" guide. Since I haven't used fcrackzip before, the first thing I do is check the man pages for it. man fcrackzip Since I'm going to leverage rockyou...

Hint:   Old algorithms are not a waste, but are really precious...  0ld is G0ld, hrm. At first glance, I'm thinking I may have to dust off my Basic or COBOL, or some other "older" language. The hint seems a little weird, not sure if it's an ESL (English as a Second Language) thing or something lost in translation, or if that is supposed to mean something to me. I have no idea at this point, so I'm just going to dive in! Time to use wget to download the zip file and get it extracted. I use the unzip command to extract 0ld_is_g0ld.zip. I enter the password from the website and proceed. Using ls , I can see it gave me a PDF file. Let's see if we can open it! I use xdg-open "0ld is g0ld.pdf" and it launches Document Viewer with a password prompt. Nah, can't be this easy, let's try the same password for the zip file. Nope. As I was still learning Linux and Kali, I decided to use some Google-Fu to find a good PDF...

I just posted a "walkthrough" for a Hack The Box challenge, and I figured I should say something. I originally wrote these for myself - these are my notes from the challenges. Obviously I have formatted them better, went back and took more screenshots, and added some commentary on what I was thinking of to help myself complete the objective. I will do my best to NOT post the flag needed to complete the challenge. I will however, lead you up to the point where you can easily get the flag if you follow my every step. If any of my steps are missing something, please let me know. These are older notes, and I may have missed a step or skipped over something important because I am going through the challenge again, using my notes to complete it again. Perhaps I should do a write up of how I got into Hack The Box...

Hint: Find the flag. When I started this challenge, I took one look at the hint and already started questioning what I was up against. Not wanting to disappoint myself, I fired up my Kali VM through Oracle's VirtualBox and got started. I launched a terminal and used wget to download the zip file. wget  https://www.hackthebox.eu/storage/challenges/misc/inferno.zip I used the built in unzipping command to unzip inferno.zip. unzip inferno. zip I entered the password provided, "hackthebox" and it spit out a txt file. Ok, I was expecting something a little more than this, but hey, maybe it's a super easy flag.  Nevermind… RCdgXyReIjdtNVgzMlZ4ZnZ1PzFOTXBMbWwkakdGZ2dVZFNiYn08eyldeHFwdW5tM3Fwb2htZmUrTGJnZl9eXSNhYFleV1Z6PTxYV1ZPTnJMUUpJTkdrRWlJSEcpP2MmQkE6Pz49PDVZenk3NjU0MzIrTy8uJyYlJEgoIWclJCN6QH59dnU7c3JxdnVuNFVxamlubWxlK2NLYWZfZF0jW2BfWHxcW1pZWFdWVVRTUlFQMk5NRktKQ0JmRkU+JjxgQDkhPTw1WTl5NzY1NC0sUDAvby0sJUkpaWh+fSR7QSFhfXZ7dDpbWnZ...

I just renewed this domain and I realized something - it's been a year since I first started this blog and we are already closing up the first month of 2018 and I don't have much to show for. I haven't put much out here honestly, I have plenty of code snippets and ideas for content, but life has gotten in the way. My original idea was to make this a security centric blog where I would document my studies and write about what I was learning to not only help me better understand the content, but to help anyone else who is interested. I think I would like to continue with the original idea, but also write about my non-security related wins and code snippets. I've recently taken on the role of a Citrix engineer in addition to my other tasks. I'm still pretty new, but I have spotted a few areas for automation and scripting that I would like to explore. So here's to 2018, may I finally get around to writing more often!

I created a PowerShell script to vaccinate systems from Bad Rabbit based on the findings of Amit Serper. I will be turning this into a Compliance Item in SCCM in order to get this to the systems in the company. Using Compliance Items will help us keep track of this and will attempt to rerun this script in the event that permissions ever get changed. It'll also allow for nice reporting for management. Edit: There's a much better way to do this: Using this method, it's much easier just to add a filename and it's relative path to the $files variable. This change makes the script much more scalable and dynamic. Edit 2: It looks like someone much better than me already beat me to this. Anders Rodland has created a Configuration Item and Remediation script nearly identical to mine and a few days before me. Jay Rosenberg from Intezer Labs has written more about Bad Rabbit and its relationship with NotPetya - the article can be read here.

In preparation for migrating our workstations over to Microsoft BitLocker Administration Management (MBAM), I wanted to backup the recovery keys for my team's systems since we're testing and implementing it. In order to do this, I needed to write something that would pull in every computer in an OU in AD, then grab the msFVE-RecoveryInformation class for each object. I know, I know... there's better ways to create the PSObject. I've been mired in writing in PowerShell 2.0 to support the Windows XP systems here at the company. I know, I know... yes, we still have Windows XP. Yes, there are plans on moving to a supported OS. No, I don't know when that will be.