HAFNIUM - Post-Exploitation Analysis from Microsoft Exchange

[@arandomboredindividual7855]

the thumbnail looks like its from a movie, great work John!

[@deepergodeeper7618]

when nerds attack coming this summer

[@andymcnab326]

Hes not pulling a stupid face for once well done John

[@jbgaud]

it's fun to see how this thing works after speding two days patching all my exchange servers. Thanks.

[@karimmohamed3744]

I wasn't feeling good at all today. This video revamped me and bumped me up. Thanks John for not being just educational. But, entertaining and fun to watch too. Sending love and hoping ur having a great day

[@scottanderson2871]

Been a software dev for a long time. Never seen this type of analysis done before... and watching this was absolutely fascinating.

[@rtisd]

Finishing up my final year in cybersecurity in college and videos like these make me so much more intrigued about this field, and that much more excited and motivated to learn more. Thank you for all the hard work you put into these!

[@nosignal5735]

What's the name of your college? If u don't mind telling me

[@zikkthegreat]

whole, gigantic powershell script, as a big ol’ format string? that’s neat

[@Mbro-dq2do]

How John doesn't have millions of followers is beside me. Thank you for all this info John. Being 45 I missed the boat in the early 2000's but a year in Im hooked. Thanks to YOU David Bombal and Network Chuck you guys have helped this construction old guy immensely

[@rileymccoy8154]

This high of production quality and you were able to put this out the same day you were prodding around. I appreciate the work you're doing, its extremely informative so thank you.

[@ruxxuc2091]

I want to thank you John because you took me to another stage in the cyber world

[@Xilhion]

Thanks for bringing awareness to such hacks. Right after the video, i checked the last few customers that still has on-premises exchange, and 75% of them were affected. We could mitigate the risk and apply fixes before anything worse happened. Thanks for this John Hammond.

[@insoYT]

This is interesting stuff. We've had so many interesting (& super dangerous) exploits and vulnerabilities in last few years. At 22:30 , it's a trick to add timestamps into URL. That's probably easiest way to make sure responses are not cached at any point. Of course it could be just lazy coding and used for monitoring purposes. But little bit later John downloaded the payload (or w/e it turned out be) without the timestamp in URL. I'd always recommend to download payloads with exact same syntax. It's way too easy for malware developer to try to mislead here. If they had some nasty next stage, they could make it look like just like a boring and usual looking malware. And misleading the analysis is absolutely part of the game.

[@Aerogamer158]

You’re a good guy. Don’t let the others bring you down just because you’re compiling open source information and sharing it in a logical and comprehensive manner. Though I consider myself a home brewed IT craptastistic person, I appreciate the information given every time you put up a video.

[@Cyberducky]

I don't know how you do it but whenever I watch one of your videos about malware analysis the time simply passes so quickly. Very entertaining thank you!

[@netanel135]

I never commented on youtube videos before, but, I really want to thank you John Hammond for all the good work you're doing. You are F awesome and please keep it up. BTW, you are my favorite cyber-related KZbinr!

[@St3amPunk]

I'm absolutely Stoked for the NahamCon CTF!!!!

[@Zed0086]

Best instructor I have come across. New subscriber here! Thank you good sir!

[@rainworldenthusiast]

This is such an excellent primer for this sort of work, and you make it so entertaining! Looking forward to binging all your videos over the next couple of days :)

[@potatoonastick2239]

I thoroughly enjoyed the premiere + live chat replay feature here, as well as the content itself obviously. Keep up the good work my dude, im already recommending your channel to my friends!!!

[@Ylmorko]

I'm watching this as I going through our exchange server logs looking for backdoors :D a nice coincidance

[@Cavemannnnnn]

goodluck lol

[@jiu]

Same… already patched some servers

[@Lexxrt]

Title Contains: Post Exploitation Me: Oh Yeah, This is gonna be good

[@TheH2OWeb]

Thank you John !! Once again, I had fun and learned as much as I could (only some but that's in the right direction). You're awesome !

[@RonKirschler]

At around 20:54 the $dt is used to ensure cdn caching is bypassed. So the code on the cdn is static, but as soon as it is changed, the client is supposed to request a new copy.

[@DCLEE-co3dj]

Hopefully no one tries to salem witch trial you for mis speaking because you are human after all.. I'm happy you are sharing public info for education. If someone gets upset about it then they must have ill intentions with that information. Keep up the great work!

[@fumfsmdb]

Your videos are great! I'm glad I found your channel. You have great information in a lot of topics I cover at work.

[@lethil]

As someone who knows next to nothing on malware analysis I had a funny feeling mimikatz would turn up haha. I have learnt so much from these exploration videos only knowing intro level programing and just learning cyber security, it was awesome to see the obsfucation techniques and layers built into this and connected so many dots for me. Awesome video.

[@fastmover45]

can you do a longer deep dive into this sort of stuff in the future this is just magic and easy to digest

[@TheAnurag69]

Addicted to this content. How can I watch this whole video without any break? Inner me : You found new love !

[@MrBlackFiction]

Nice, You helped me a lot to understand the Threat!

[@potatoonastick2239]

Also the powershell explosion + guy fawkes mask was hilarious :D

[@xaviercho7063]

i love all these type of videos, can't wait for more such that solarwinds or more of this helps!

[@angelsepulveda9211]

Thanks John. As a newbie, this was great. Love how you broke it up and explain this so much!!!!

[@SentientMuffin]

Got mind blown by that huge Powershell script made only for building an fstring piece by piece. Insane stuff!

[@revenevan11]

Man, around 45:00 min in you weren't even exaggerating about that being an epiphany 😂 What a cool obfuscation technique!

[@jonharper5919]

Creating shellcode in a piece of malware that base64 encodes to McBAD is next level. Bravo to that 👏 👏

[@n-i-n-o]

Great reversing. Subscribed

[@uniquechannelnames]

Hey I signed up for a CTF randomly on CTFtime, and was pleasantly surprised to see it was one you created! Lol, I'm looking forward to it!

[@Horstlicious]

So how did it go?

[@AustralianCyberOps]

Excellent work John, love your work mate!

[@SwissPGO]

Great video & I'm installing my fax machine again ;-)

[@fractalmultiverse]

Great content John. Education and humour smashed. Big thumbs up for this one. Thanx

[@tanveeraalam3271]

Thank you for your efforts and time, I really appreciate it.

[@atsekbatman]

It's been a pleasure, John!

[@bbowling619]

Im never going to move up from my current position because....my current job has nothing to do with this subject. I am literally addicted to this madness that John keeps on about. I literally cannot quit doing it. Lol .. and so i will integrate this with my ongoing studies (beer drinking) as well as continue to try to keep up.

[@rxhango]

Great Analysis

[@TheRogueBro]

Seems like an easy way to get around this set of scripts in particular would be to have your environment variable something non-standard.

[@Puma2113]

"I know this is really painful on 'human being' eyeballs" John just confirmed he is a robot.

[@VajrangParvate]

Quick one: The long dot separated number strings at 1:04:50 such as "1.3.6.1.5.5.7.3.2" or "1.3.6.1.4.1.311.20.2.2" are SNMP MIB OIDs (en.wikipedia.org/wiki/Object_identifier).

[@fhacim6568]

Wonderful as always, great video!

[@acevlt]

Great Video!!! Can't wait for more.

[@SageTheProfessor]

Thank you John. As always you are very helpful and I appreciate you going through the reverse engineering process. See you on the next one! --Sage

[@PerfectKlaus]

Amazing work, thank you for sharing

[@brianstarr]

T`han`ks for making the video! Good stuff down the rabbit hole. UGH, Empire is scary.

[@mikejones4012]

Thank u! This has been a fun one. Unfortunately not out of the water yet. 🥶

[@nikolas8741]

This is professional evilness thanks for showing us this John this is very interesting to me! Big like

[@owns3]

interesting. Thanks for sharing!

[@TexasTimelapse]

Thanks for doing this. Very interesting.

[@facelesshacker1528]

Thanks John, learnt a lot.

[@Ayush-vy2kq]

You're doing a great job Hammond

[@logiciananimal]

The natural etc. strings are the join types in SQL, presumably part of SQLite

[@gp6723]

great content, as usual !

[@savoyblue777]

Thank you John Very intresting

[@icantfindaproperusername]

Most GREAT channel between others

[@logiciananimal]

Us application security folks know about "format string vulnerabilities" from our C application experience, but this one is interestingly different and yet also suggests that name. :)

[@Red4mber]

OMG, that puzzle script is so cool

[@jamalkhan815]

Great work man!!!

[@anders6671]

Great video, thanks for sharing this!

[@1wk407]

these videos are so fun!

[@K2_Chris]

Thanks for the good laugh when you copy and paste that big file! :) I would have done the same thing haha

[@akazaka3578]

This was awesome man thanks!

[@palva01]

Thank you, learned alot

[@user-lk5qz4wx4q]

John always has to ctrl v or ctrl f something big and THEN realizes that he's made a mistake...LOL

[@israeltakaw112]

John, you make it very entertaining even though it makes my brain ache!

[@tetetsky]

Thank you, this is very helpful!

[@nonoyourbizness8437]

this is what my org got hit by- i really appreciate the analysis!

[@brianbitange6650]

Now I just like your content before watching! Its that good!!

[@custume]

video looks great

[@janisberzins5919]

That is some next level PS scripting! Thanks for the video, John. I really enjoyed it.

[@GilligansTravels]

Man that was fun and I love the recon of it

[@rahuldogra9271]

Crazy Thumbnail John!!

[@minhquang3126]

Cool thumbnail, cool video, cool person, could not asked for more :D

[@TinkerTech]

Techcraft? That sounds so ominous 😮 When somebody asks me if I have any hobbies, I just say that I like T.I.T.S. in my spare time. Which OF COURSE stands for tinkering in tech services.

[@jasoncollum7506]

Not sure if it was mentioned...but the hig versus low would have shown up in the web logs and help identify instances with higher permissions (Administrator) versus lower permissions (non-Administrator).

[@beyerchr]

Thanks!

[@BugsMoney007]

This 1Hr of video teaches more than what I have learnt in past 25 years of my life. Truly appreciate the knowledge you shared and for free.

[@sanathkumar1006]

Thumbnail looks 🔥

[@internetdoggo4839]

I like what ya’ did with the thumbnail

[@RIGeek.]

Given all the references to IEX, I guess something that can be done that could make you immune to a few of these would be to use a non-standard windows install folder.

[@daneilyan6419]

The image in the photo makes John look like some secret agent

[@JohnRickey-b5w]

Hello dear friend, I wish you success and health ❤

[@Sebastian-db6ur]

great, had fun

[@Ladaria_VoD]

That actually killed the video encoder.

[@lokeshgs7866]

ThankYou Jon for this detailed Video. Do you also help us with some video to fix the issue?

[@ДмитроМінтенко-м7и]

Hi, cool thumbnail!

[@JTwisted]

Bro, just want you to know, you are awesome!

[@PythonisLove]

your videos are great

[@CoenraadLamprecht_coenster711]

Welldone

[@Yarisken12]

More than 10.000 lines of powershell ... created when they notified the exchange exploit ... this is done by a huge team of professionals.

[@fastmover45]

as a computer profesional i love these videos please keep doing the good work you are do.

[@gabrote42]

46:23 This is impressive. That has to be some of the most bullshit obfuscation techniques I have ever seen. And you got it. Bless you

[@samuelbarber5097]

54:30 THE HOLY ONE STRINGS ALL HALE THE STRING GOD

[@bbowling4979]

So what I'm getting from this is to have an obfuscated IEX at the end as a false "wire" to cut, then embed the real IEX in the middle. Got it.