Cyber Mayhem Blue Team Gameplay: Process Monitoring with Snoopy (LD_Preload)

[@the_unknown8808]

Whats going on youtube, this is Ippsec. This day is great.

[@_DeProgrammer]

This is the best. I love watching ippsec play this game mode. I hope he does more. Learn so much in these vids. thanks htb and ippsec you guys rock!

[@thepoop3622]

Honestly bro!!

[@sethadkins546]

1:12:32 plot twist: that's his plan all along, he's essentially DDoSing the box

[@jaybachre6976]

Finally a blue team stuff.

[@thepointlessvideo100]

"Let's do him a solid and give him a shell" - Love this Ippsec haha

[@jonathanbouchard720]

These videos are literally the best! We need more Cyber Mayhem with IppSec!

[@ryukilla137]

Loving this so much, but keep laughing every time he tries to rm stuff lol

[@samlrodriguez]

The part where the attacker removes his pcap file is great: "He. He removed my pcap. That is rude... Why would do that sir. Why." 🤣

[@hackersworld2974]

love the terminal color combination

[@xternl_]

I love the trolling part, not-today! Hugs

[@spheleleshandu3334]

When he gave him the root shell 🤣🤣🤣🤣

[@chriswhite6250]

this video made me feel good inside.

[@Nadesican]

Wow. I think you trolled yourself more than you trolled your opponents!

[@gkpln3]

You srand hook didn’t change the output since srand *accepts* the seed as a parameter, not returns it. What you did was just hijacking its call and preventing it from setting the seed. Great video btw!

[@TheKSH991]

Ippsec please do more gameplay in cyber mayhem , this is very entertaining to watch

[@sethadkins546]

23:07 This dude really do be using sudo as root

[@Pvnth-R]

You inputted "root ALL=NOPASSWD: ALL" but it is "root ALL=(ALL:ALL) ALL". You got it mixed with sudo, haha!

[@rodrigo_dmatoss]

Thank you for this amazing content!

[@niex269]

Really informational. Thanks.

[@xMacTac]

Looking out of my cardboard castle waving the blue flag

[@Drakopiou]

This is awesome, did hackthebox are the first to create this type of "battleground"? I need to complete some more machines/challenges before to jump in

[@b3twiise853]

I hear thm has king of the hill

[@ippsec]

​@@b3twiise853 There was plenty before that. Atack and Defend is not new.... SANS NetWars has done it for years online and offline. There were some other platforms before then that I forget that tried it aswell.

[@Drakopiou]

@@ippsec Thanks a lot for the explanation, you make me learn so much on your last gameplay video!

[@tzachihazan3459]

i mean you can go blue team all the way and ship logs to helk it could be nice

[@ippsec]

That is coming. I generally like one topic per video and this one was LD_Preload

[@nikohegeheiskanen]

@@ippsec Man i cant wait this is great :D as much as i love the usual videos all this blue team stuff is refreshing 👍

[@tzachihazan3459]

Nice ! cant wait for that video and since you like show diffrent tools look at that github.com/fireeye/ThreatPursuit-VM

[@0xc0ffee_]

Can't you just grab the id_rsa and permanently have access to the box? Also, can't you just remove a file that would fail the checks so the enemies would lose points?

[@niteshsurana]

31:55 - TROLL: Renaming NANO to VI and VI to NANO on one of the boxes for lulz IT HURT XD

[@evanratliff468]

I need help i see no start button for the machines so when i nmap (sudo nmap -p- _________________) The host is down i tried to contact customer support but it said my login information is wron can some body help me with the start button (im not in retired Machines i am not a vip)

[@user-nb6cx6vc3u]

go to machines, then click on the machine you want. next click spawn machine. make sure your vpn and connection stuff is all correct. furthermore, the machine could be configured to not accept ping requests.

[@mohamedahmed-xw8hz]

I think it will be great if you can do zeek/bro and ELK stack on docker container inside your kali and ship all logs to it via filebeat/auditbeat

[@ippsec]

That is coming. I generally like one topic per video and this one was LD_Preload

[@mohamedahmed-xw8hz]

@@ippsec glad to hear that, really appreciate you man, you are awesome, learn a lot from you

[@eseseis7251]

mv cron cron.back compile a backdoor.c to cron run cron full path, mv cron.back cron or ntp, and have your back nc listen o 123 :) this idea can derivate to much more. i did it with the AV itself, so av would always skip itself. thats the problem of linux.

[@lixiao4259]

good trick

[@RicondaRacing]

That might not be the only script running when you copy and paste terminal commands

[@Flashback_Jack]

Oo-boon-too.

[@karuppasamykaruppasamy4686]

Which website best for learn programming

[@armandkruger911]

Are you allowed to install additional software? Install fail2ban and add a regex to look for 404 inside the access.log and block his IP

[@zenox1792]

no thats against the rules smart ass

[@d4rckh122]

Nice 👍😌

[@johnvardy9559]

How i become a SOC analyst could y help me?

[@itsecurity6471]

Can you use KL to do this?

[@Death_User666]

more blue team

[@tymekl1509]

gj ippsec!

[@mf-11111]

Thanks You #HackTheBox !!!

[@jkazoba]

"Let's see"

[@thinkingonyx847]

I think I remember we got destroyed this game 😅

[@jorgevilla6523]

lol so troll you gave him root hahaha

[@GamerHacker-wc8rs]

I feel so stupid

[@eseseis7251]

not.today or mv or echo > file.php or chown, or chattr

[@b3twiise853]

Not-today lol

[@ankeshkumarno1]

Battleground mobile India hack please