ares@legion:~/HackTheBox/Cicada$ nmap -sVC -A -T4 $target Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-10 13:01 EET Nmap scan report for 10.129.61.174 (10.129.61.174) Host is up (0.042s laten...

port 80 > Dashboard page with ifconfig ( executing commands ), on security page we can download wireshark files, url has data=0,1,2 parameter and we can access any account history > nathan ac...

22/tcp - SSH 80/tcp - HTTP (nginx 1.18.0) - ActiveMQ with basic auth 1883/tcp - MQTT 5672/tcp - AMQP 8161/tcp - HTTP (Jetty) - ActiveMQ Admin with basic auth 61613/tcp - STOMP 61614/tcp - ...

ares@legion:~/HackTheBox$ sudo nmap -sVC -A -T4 10.129.150.227 Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-10 10:33 EET Stats: 0:00:07 elapsed; 0 hosts completed (1 up), 1 undergoing Service...

SMB enumaration > We get sql Creds > use Impacket tool > sql shell link below > make xp_cmdshell work fixing the error> use xp_cmdshell command line to download nc64.exe, execute &g...

Custom Executables Weaponization • Methods of obfuscation Packing Encoding Modifying source Remove extraneous functionality Remove usage statements and signatured strings – Recompilation • A deep ...

Spear Phishing with Malicious Attachment • T1566.001 • A targeted email with a malicious attachment • Requires user execution to get code execution • High risk delivery as attachments are scrutini...

• Self-setup – Gain reputation – Set up DKIM, SPF, PTR record • Third Party – Instant reputation • Open Relay – Don’t leverage if on internet Email With the payload packaged, it is time to deliver...

Effectiveness of defenses vary depending on the language of your payload, Powershell, VBA and C# will trigger AMSI You will NOT deal with AMSI unless you leverage the CLR (.NET) Write malware in ...

• DMARC: Domain-based Message Authentication, Reporting and Conformance – Built on top of SPF and DKIM to allow domain owner to published a policy of requirements for email – Receiving server can c...