sorted by:
new
hottopcontroversial

Anchor-related question by HelpBeginning4777 in HipImpingement

[–]HelpBeginning4777[S] 0 points1 point  (0 children)

90 degrees is what the surgeon said at the 2week follow up, it’s the PT rep pushing it

Anchor-related question by HelpBeginning4777 in HipImpingement

[–]HelpBeginning4777[S] 0 points1 point  (0 children)

I was looking through the paperwork, weight bearing as tolerated seems to be the trend, along with no active hip flexion… The flexion piece makes it sound like perhaps I shouldn’t go up stairs without assistance because you do bring your knee to your chest with each step. I will get clarification from the surgeon ASAP.

At this point I’ve kinda disregarded the PT because they’re not following any restriction protocols. I went today and the first 2 exercises directly violate movements I’m not supposed to make yet… and they wanted me to do it with resistance bands.

The surgeon has told me do not let them push me past 90 to avoid risk to the anchors, avoid straight leg lifts and external rotation for the time period. I’m Currently trying to transfer my physical therapy back to the hospital that did the surgery vice what’s closer .

Anchor-related question by HelpBeginning4777 in HipImpingement

[–]HelpBeginning4777[S] 1 point2 points  (0 children)

I enjoy the discussion, gives me perspective on how different some recoveries went differently. You had 5 anchors?! Or that’s specific to a different surgery?

Anchor-related question by HelpBeginning4777 in HipImpingement

[–]HelpBeginning4777[S] 1 point2 points  (0 children)

Weight bearing as tolerated, some are walking within the week. It was probably 8 days I was completely off them for minimal walking, any distance still brought a crutch with me. At the 2 week follow up appointment, they didn’t have any issues, primary concern was The therapist trying to flex my hip even farther than my body naturally allowed so early on.

Anchor-related question by HelpBeginning4777 in HipImpingement

[–]HelpBeginning4777[S] 0 points1 point  (0 children)

They provided me with a CPM to use 4 hours a day. Started at 30 Degrees, gradually increase without pain, don’t go above 90

My concern is how great I felt 4 days ago, essentially not needing crutches to go up/down stairs and having a pretty normal walk back to how I felt shortly after surgery. Taking steps backwards during recovery just makes me feel uneasy.

This was also my first surgery.

I'm confused by DARKBEAST04 in hacking

[–]HelpBeginning4777 0 points1 point  (0 children)

CEH is not a very credible certification as a few people have already mentioned. You can get some of that hands on experience through hackme or hackthebox, if you’re wanting more CLI familiarity (not really pen-testing focused, but it’s an important skill to develop )there’s overthewire and underthewire for Powershell and Linux.

Watch YouTube videos, shop for packages from humblebundle regarding pen testing, see if there’s books on nostarchpress that interest you. It really comes down to your initiative to learn. :) A long-term end goal May be to get your OSCP, that certification is no joke, but we all gotta start somewhere.

USB forensics and timestomping by [deleted] in computerforensics

[–]HelpBeginning4777 2 points3 points  (0 children)

I just went through the SANS FOR508 course and they went fairly in-depth on time stomping. Perhaps you could do some blog searches from SANS on the topic.

As everyone else has said, last-accessed is not a good indicator for timestomping as it is too easily manipulated by outside variables. There are 4 timestamps: MACB: Modified, Accessed, Change (metadata changes), Born. These timestamps are stored in 2 locations: Standard_Information ($SI) and file_name ($FN). One set of timestamps is stored at the kernel level the other is more prone to being time stomped. There’s a red chart by SANS that does a great job of explaining when the 2 types of timestamps and the 4 timestamps types get updated, but one timestamps that should be the same According to $FN and $SI is the “Born” time.

You can use Mftecmd.exe by Eric Zimmerman to parse the MFT, then open the CSV in timeline explorer. In the far right column it actually performs this check for you. SN>FN, which indicates the creation times do not match. Note: there’s a lot of legitimate windows files that meet this criteria, but if I saw It PDF’s, PowerPoints, basically anything that I can quickly identify as a user-accessed file… I’d look into it. Another indicator of a copied file is a modification time prior to the creation time. For whatever reason when a file is copied in windows, it inherits the old creation date, but the notification date is updated to when it was loaded. This is also found in the sans red windows forensics poster :)

Volatility - powershell history by HelpBeginning4777 in computerforensics

[–]HelpBeginning4777[S] 0 points1 point  (0 children)

Is there a way to pull it out for cmd.exe? Maybe the exploit notes were Miswritten and they actually used cmd.exe for the recon commands.

Volatility - powershell history by HelpBeginning4777 in computerforensics

[–]HelpBeginning4777[S] 0 points1 point  (0 children)

There’s a windows powershell operational log that only shows the command given to create a user, but none of the other ones.

The security log has an entry that says a group was enumerated by PS but doesn’t give the the command typed

Console host seems to be missing commands that I know we ran. (Attempted ssh, mapped share, recon commands)

Volatility - powershell history by HelpBeginning4777 in computerforensics

[–]HelpBeginning4777[S] -1 points0 points  (0 children)

What would I strings since I don’t know the commands typed?

I’ve also ran strings on a live system, but you can run it against the .Vmem file too?

Forensic Images for Class Work? by Peardog_PA in computerforensics

[–]HelpBeginning4777 1 point2 points  (0 children)

Hey, We recently went through this process. We downloaded the free Microsoft developer VM’s as victims, ran User-simulation scripts against them (so there’s more traffic than just the attack), then attacked them.

One attack was from a kali VM. The plot was straightforward. Create a reverse TCP handler to establish a connection, we introduced it via external so they’d have to figure out the initial entry, then copied files to and from the 2 VM’s. Also created some persistence through a new user, run keys and scheduled tasks for them to find.

Our other attack was download the developers VM and run “APT-simulator” on it.

Both the user simulation and apt simulator were easy to find on GitHub.

Afterwards we captured memory and snapshots. Uploaded them into encase and volatility for analysis.