Cyber Mayhem Blue Team Gameplay: Process Monitoring with Snoopy (LD_Preload)

[@the_unknown8808]

Whats going on youtube, this is Ippsec. This day is great.

[@_DeProgrammer]

This is the best. I love watching ippsec play this game mode. I hope he does more. Learn so much in these vids. thanks htb and ippsec you guys rock!

[@thepoop3622]

Honestly bro!!

[@jaybachre6976]

Finally a blue team stuff.

[@sethadkins546]

1:12:32 plot twist: that's his plan all along, he's essentially DDoSing the box

[@thepointlessvideo100]

"Let's do him a solid and give him a shell" - Love this Ippsec haha

[@yeowoobi525]

Loving this so much, but keep laughing every time he tries to rm stuff lol

[@jonathanbouchard720]

These videos are literally the best! We need more Cyber Mayhem with IppSec!

[@samlrodriguez]

The part where the attacker removes his pcap file is great: "He. He removed my pcap. That is rude... Why would do that sir. Why." 🤣

[@spheleleshandu3334]

When he gave him the root shell 🤣🤣🤣🤣

[@hackersworld2974]

love the terminal color combination

[@caliblasian]

this video made me feel good inside.

[@xternl_]

I love the trolling part, not-today! Hugs

[@Nadesican]

Wow. I think you trolled yourself more than you trolled your opponents!

[@sethadkins546]

23:07 This dude really do be using sudo as root

[@niteshsurana]

31:55 - TROLL: Renaming NANO to VI and VI to NANO on one of the boxes for lulz IT HURT XD

[@TheKSH991]

Ippsec please do more gameplay in cyber mayhem , this is very entertaining to watch

[@rodrigo_dmatoss]

Thank you for this amazing content!

[@evanratliff468]

I need help i see no start button for the machines so when i nmap (sudo nmap -p- _________________) The host is down i tried to contact customer support but it said my login information is wron can some body help me with the start button (im not in retired Machines i am not a vip)

[@user-nb6cx6vc3u]

go to machines, then click on the machine you want. next click spawn machine. make sure your vpn and connection stuff is all correct. furthermore, the machine could be configured to not accept ping requests.

[@gkpln3]

You srand hook didn’t change the output since srand *accepts* the seed as a parameter, not returns it. What you did was just hijacking its call and preventing it from setting the seed. Great video btw!

[@Pvnth-R]

You inputted "root ALL=NOPASSWD: ALL" but it is "root ALL=(ALL:ALL) ALL". You got it mixed with sudo, haha!

[@niex269]

Really informational. Thanks.

[@xMacTac]

Looking out of my cardboard castle waving the blue flag

[@tzachihazan3459]

i mean you can go blue team all the way and ship logs to helk it could be nice

[@ippsec]

That is coming. I generally like one topic per video and this one was LD_Preload

[@nikohegeheiskanen]

@@ippsec Man i cant wait this is great :D as much as i love the usual videos all this blue team stuff is refreshing 👍

[@tzachihazan3459]

Nice ! cant wait for that video and since you like show diffrent tools look at that github.com/fireeye/ThreatPursuit-VM

[@eseseis7251]

mv cron cron.back compile a backdoor.c to cron run cron full path, mv cron.back cron or ntp, and have your back nc listen o 123 :) this idea can derivate to much more. i did it with the AV itself, so av would always skip itself. thats the problem of linux.

[@lixiao4259]

good trick

[@mohamedahmed-xw8hz]

I think it will be great if you can do zeek/bro and ELK stack on docker container inside your kali and ship all logs to it via filebeat/auditbeat

[@ippsec]

That is coming. I generally like one topic per video and this one was LD_Preload

[@mohamedahmed-xw8hz]

@@ippsec glad to hear that, really appreciate you man, you are awesome, learn a lot from you

[@johnvardy9559]

How i become a SOC analyst could y help me?

[@karuppasamykaruppasamy4686]

Which website best for learn programming

[@0xc0ffee_]

Can't you just grab the id_rsa and permanently have access to the box? Also, can't you just remove a file that would fail the checks so the enemies would lose points?

[@armandkruger911]

Are you allowed to install additional software? Install fail2ban and add a regex to look for 404 inside the access.log and block his IP

[@zenox1792]

no thats against the rules smart ass

[@Flashback_Jack]

Oo-boon-too.

[@Death_User666]

more blue team

[@itsecurity6471]

Can you use KL to do this?

[@RicondaRacing]

That might not be the only script running when you copy and paste terminal commands

[@Drakopiou]

This is awesome, did hackthebox are the first to create this type of "battleground"? I need to complete some more machines/challenges before to jump in

[@b3twiise853]

I hear thm has king of the hill

[@ippsec]

​@@b3twiise853 There was plenty before that. Atack and Defend is not new.... SANS NetWars has done it for years online and offline. There were some other platforms before then that I forget that tried it aswell.

[@Drakopiou]

@@ippsec Thanks a lot for the explanation, you make me learn so much on your last gameplay video!

[@d4rckh122]

Nice 👍😌

[@jkazoba]

"Let's see"

[@jorgevilla6523]

lol so troll you gave him root hahaha

[@thinkingonyx847]

I think I remember we got destroyed this game 😅

[@fm0x1]

Thanks You #HackTheBox !!!

[@eseseis7251]

not.today or mv or echo > file.php or chown, or chattr

[@tymekl1509]

gj ippsec!

[@GamerHacker-wc8rs]

I feel so stupid

[@b3twiise853]

Not-today lol

[@ankeshkumarno1]

Battleground mobile India hack please