ice-wzl – Medium

5 hours ago

Advanced Analysis of the APT28 Malware

APT28, also known as Sofacy, Fancy Bear, and Pawn Storm, is a notorious Advanced Persistent Threat (APT) group that has been actively operating since at least 2007. APT28 is believed to be a state-sponsored group associated with the Russian government, and has been implicated in several high-profile cyber attacks, including…

Apt 28

4 min read

Apt 28

4 min read

1 day ago

Pulling apart Major WanaCry Functions

Introduction: WannaCry, also known as WCry or WannaCrypt, is a notorious ransomware that made headlines in May 2017 after it infected hundreds of thousands of computers in 150 countries. The malware was spread via a worm that exploited a vulnerability in Microsoft Windows operating systems. The WannaCry ransomware encrypted the files…

Malware

3 min read

Malware

3 min read

Jan 31

Local Tunneling with SSH: A Basic Overview

SSH (Secure Shell) is a popular protocol for secure remote access to a server or network. One of its most powerful features is the ability to create a local tunnel between a remote host and the local machine. …

Programming

2 min read

Local Tunneling with SSH: A Basic Overview

Programming

2 min read

Jan 30

SSH Dynamic Tunneling: An In-Depth Guide with Advanced Examples

SSH (Secure Shell) is a powerful tool that enables secure data communication, remote shell services or command execution, and other secure network services between two networked computers. …

Computer Science

4 min read

SSH Dynamic Tunneling: An In-Depth Guide with Advanced Examples

Computer Science

4 min read

Jan 29

Mastering Proxychains

Proxychains is a tool that allows you to route your network traffic through a series of proxy servers. This can be useful for a variety of reasons, such as hiding your true IP address or accessing internal-only resources from an external network. …

Hacking

4 min read

Hacking

4 min read

Dec 19, 2022

HackTheBox Find The Easy Pass

Today we will be tackling an easy binary reversing challenge from HackTheBox, called Find The Easy Pass. This binary is a Windows Executable, thus I will be utilizing my Windows reversing virtual machine to solve this challenge. Upon downloading and unzipping, I dropped the file into PE Studio in order…

Hackthebox

3 min read

Hackthebox

3 min read

Dec 19, 2022

Delivery HackTheBox

Enumeration Let's start off with a nmap: nmap -sC -sV 10.10.10.222 -oA nmap/nmap.partial 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA) | 256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA) |_ 256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519) 80/tcp open http nginx 1.14.2 |_http-title: Welcome |_http-server-header…

Hackthebox

7 min read

Hackthebox

7 min read

Nov 14, 2022

Quest for Virus Total Evasion Pt. 2

Today we will be continuing our quest for Virus Total Evasion by Ghostwriting an msfvenom binary. The process of ghostwriting ranges from exceedingly straightforward to extremely complex. We will attempt to split the middle and take a moderate path forward towards altering our malicious binary. Ghostwriting is the process of…

Hacking

5 min read

Hacking

5 min read

Nov 9, 2022

De-anonymizing Lockbit 3.0

Overview Back in June of 2022, Talos published an exceedingly interesting blog post which centered around de-anonymizing Tor Hidden Services via a variety of techniques. …

Malware

4 min read

Malware

4 min read

Oct 23, 2022

Quest for Virus Total Evasion

Generating a msfvenom payload for use on HackTheBox or TryHackMe is effective provided Defender or other Anti-Virus software is not running on the target. However, what if this is a real work engagement and you need to sneak a payload past some EDR solution? I will begin to explore some…

Malware

4 min read

Malware

4 min read