Introduction Hello everyone and welcome back to another post from yours truly. Today we’re going to be doing something slightly different actually. I’ve been looking more into detection engineering recently and been wanting to get better at writing detection rules in different formats and whatnot. So today we’re going to be actually looking at a threat intelligence post from Cisco Talos covering some malware from the Chaos ransomware group. Specifically, their msaRAT malware that uses the browser for its C2 communications.
Writeup I’m not gonna lie to you, this one had me stumped for quite a few days, but as per the usual with these things the answer was kinda in my face if I just had dug a little deeper. So let’s go ahead and dig into CBC Task 2. Okay, so the disk image we were looking at last task definitely had some malware installed on the “endpoint” and that malware was generating some network traffic.
Hello everyone and welcome to NSA’s Code Breaker Challenge for 2025! NSA CBC is a yearly event put on by the NSA that is for all intents and purposes a CTF. Challenge topics vary from forensics to reverse engineering and they’re always pretty fun and challenging. Starting off this year it looks like we’re given a disk image that we’ve gotta comb through for something suspicious. So, without further adieu, let’s dive into Code Breaker Challenge 2025.
Hello and once again welcome back to the Intro to Red Team series, we’ll be handling this easy Linux box today. I’ll be going into this blind as always and we’ll see if I get stuck anywhere, so let’s just dive into it and get after it.
Our Nmap Scan Alright here we see the results of our classic nmap scan, ports 22 and 55555 open. 55555 isn’t recognized, but we can see form the fingerprint it may be some type of web application let’s go ahead and see.
And here we are back to the Intro to Red Team track here on Hack the Box. Today we’ve got an easy Windows box. We’re going to be trying from here on out to do as much in adventure mode as we can, only really switching to guided if we’re really stuck. So without anymore yapping from me, let’s get into todays box.
NMAP scan results Looks like we have an Apache Tomcat running on probably Windows Server 2012?