UHC - Spooktrol

00:00 - Intro Hacking a Command and Control Server
01:07 - Running nmap and discovering two different SSH Instances, guessing one is Docker
03:30 - Looking at robots.txt which includes a link to the implant, looking at the error message and discovering its a cpp binary
05:30 - Using Wireshark to discover it makes a DNS Request to Spooktrol.htb, then walking through the C2's handshake
08:45 - Using BurpSuite and socat to proxy the connection of our binary
12:10 - Using BurpSuites find and replace to edit the Task that is getting to our C2
13:00 - Opening up the binary in Ghidra
14:15 - Looking at the decompiled output for the main function, which calls Spooky. Setting a break point on the XOR Function and discovering the first flag
16:45 - Discovering the Case Statement and analyzing Task number 1 (Exec)
19:50 - Stepping through each other task to discover what each function does
22:00 - The Perform Upload function builds a curl command
24:45 - Breaking after the curl string is assembled to show the full command it runs (Using BurpSuite to get to this part of the code)
27:50 - Accessing Task 3 a different way, breaking at the switch statement and editing the JMP.
32:45 - Editing the filename in the PUT Command to perform directory traversal and upload an SSH Key
34:30 - Logging into the C2, and inspecting the database to discover another beacon is running, which is on the Host Operating System
37:00 - Inserting a task into the database to ask the rogue beacon to execute a reverse shell for us
39:25 - Extra Content: Exploiting the box with no reverse engineering! Using an LFI to dump the source code to the application
41:40 - The server.py file has been leaked, grabbing all the other python scripts
43:20 - The application is now running on our box! Can identify the file upload functionality and how to exploit it.
51:45 - Extra Content: Going over the CPP code which shows how the implant works.

[@thev01d12]

Really cool to see your reverse engineering methodology, i wish to see more code analysis and reverse engineering in future content.

[@mistercyber1848]

+, he is a true legend and we want more on this ;)

[@mistercyber1848]

Just freaking genius! My applause

[@dune2493]

Bro Let me tell you a thing genuinely You are a true legend bro❤❤

[@Ms.Robot.]

This went relatively smoothly. Good technique.

[@alessandrodegregori4525]

Great video, Ghidra + gdb for Reverse Engineering is a very smart solution!

[@DoraTheExploder]

There's something that feels especially brutal about intentionally downloading a RAT then vivisecting it and using it's innards to pwn the C2.

[@saranyanandhini4840]

Learned a lot from you ippsec...tq ❤️

[@lonelyorphan9788]

Awesome videos! 🙂 this is my favorite box ever hehe

[@wkppp4732]

Thanks for the vids ipp!

[@Repoot-7]

متابعك من المملكه العربيه السعوديه انت اسطوره❤️❤️

[@21Gabesz]

Damn, I understood maybe the 30-40% of it, hopefully one day I'll watch again this video, and will understand everything.😀

[@lmj1100]

Incredible!

[@SEX_ON_DRUGS]

Fun one. Wish I'd attempted it instead of just watching spoilers :x

[@saranshsarafmr23r06]

When someone asks me where I can learn advance pentesting* Me: yt ippsec 👩‍💻

[@astraflayer4970]

I like video 👍👍

[@neunzehnvierundachtzig]

❤️👏🏼

[@0xgreyhound]

when im trying to run the binary im getting an instant segmentation fault, 0xdf didnt either get a segmentation fault when i tried to the box acouple months back. Any idea why this happens?

[@bhaveshmohinani9055]

Hey Ippsec Thanks for the amazing content...btw am getting segmentation fault while executing the implant binary instead of that parsing error....any nudge on that

[@ippsec]

No idea try on Ubuntu or Parrot?

[@bhaveshmohinani9055]

@@ippsec Thanks

[@LaviArzi]

​@@ippsec worked with an ubuntu 20.04 docker but not with 22.04. great ctf!

[@BSJuliaMagna]

✋: watching malware analysis videos to improve analysis skills 👉: watching malware analysis videos to write better malware (for educational purposes only)

[@alessandrodegregori4525]

😂 for educational purpose OMG, so funny 😉

[@sand3epyadav]

Hii ippsec sir i am a big fan of your videos, we can't leave any your videos, becz you go dip in deeper. But in this time i have money for vip subscription "i m vip user since 6 months" But i have no any visa or mastercard. Because my visa card is hold on your payment bank. I am worry about vip lab. I am crying... any solution or help..... if we miss your lab or videos, we can't alive in this world....

[@hadrian3689]

I think you should contact hack the box for this issue. Ippsec just posts walkthroughs and that’s it. Good luck and hope you resolve it

[@bricktop90]

First

[@sn3w481]

Second