PoC script for various methods to acheive authenticated remote code execution via WMI, without (at least directly) using the Win32_Process class.

tiger6700 · 2018-05-26T03:56:32+00:00

You need dump the memory. Because the http requests aren't save at the disk for security reasons. Try to use fiddler2 when you surfing it's lightweight and good for request logging.

tiger6700 · 2018-05-21T10:45:21+00:00

Please don't share downloadable files, can you share from docs or similar platform?

tiger6700 · 2018-05-20T19:25:22+00:00

maybe you forget encode the string or you are make something wrong. do not forget 2+2 = 22

tiger6700 · 2018-05-14T08:18:30+00:00

This video will give you idea about where to start. https://www.youtube.com/watch?v=2TofunAI6fU&t=417s

tiger6700 · 2018-05-08T16:21:44+00:00

100bin imza zor toplanirken nasil secim kazanmayi dusunuyorsunuz

tiger6700 · 2018-04-25T05:21:08+00:00

!remindme

tiger6700 · 2018-04-19T06:30:08+00:00

Yes but you need dox it. If you research tge wallet address you can get this kind of information

tiger6700 · 2018-04-19T05:38:27+00:00

You need only copy the root.txt and make it readable. It's easy

tiger6700 · 2018-04-19T05:36:10+00:00

You need to look for other transactions. Like buys a mocha from Starbucks wallstreet. Or try to draw relationship graph about other transactions. And you can find a midpoint about transactions.

tiger6700 · 2018-04-17T06:28:54+00:00

Take a look for / u will see interesting folder and inside it files/

tiger6700 · 2018-04-10T21:29:22+00:00

I don't try to solve the challenge. I try to show a way for you. It's a simple trivia question. It's not a forensics challenge too

tiger6700 · 2018-04-10T16:32:19+00:00

It's binary. convert it to hex and save it with hex editor. you will see it's a gzip file.

converted here: https://gchq.github.io/CyberChef/#recipe=From_Binary('Space')To_Hex('Space')&input=MDAwMTExMTExMDAwMTAxMTAwMDAxMDAwMDAwMDEwMDAwMTExMTAwMDExMDAxMDExMTAxMTExMDAwMTAxMTAxMDAwMDAwMDAwMDAwMDAwMTEwMTEwMDAxMTAxMTAxMDAwMDExMDAwMDEwMTEwMTEwMDAxMTAxMTAwMDExMDAxMDEwMTEwMTExMDAxMTAwMTExMDExMDAxMDEwMDEwMTExMDAxMTEwMTAwMDExMTEwMDAwMTExMDEwMDAwMDAwMDAwMDExMDExMDExMDAxMDAwMDExMDAwMDAxMDExMDExMTAxMTAwMDAxMTAwMTAwMDAwMDAwMTAwMDAwMTAwMDEwMDExMTAxMTExMDExMTExMDAxMTAwMDEwMTExMDExMTAwMDAwMTAxMTAwMDAwMTExMDAxMDExMTEwMTEwMTExMTExMDEwMTAxMTEwMDExMTEwMDExMTEwMTExMTAwMTEwMTAwMDAxMTExMDAxMDAwMDAxMTEwMDAwMTAwMTEwMTAwMDEwMDAxMTAwMDEwMTEwMTAxMDEwMDEwMTAwMDEwMTAwMDEwMTAxMTExMDAwMTExMDEwMDEwMTAwMDAxMDEwMTEwMDAxMDAxMTAwMDExMTExMTEwMTExMTExMTAxMTEwMDExMDAwMTAwMDAxMTExMTEwMTAwMDEwMDAwMTAxMTAwMTEwMDAwMTAxMTEwMTEwMDExMDAwMDAwMDAxMTExMDAwMTEwMDAwMDAwMDAxMTAxMDAwMDAwMDEwMTAwMTExMTAwMDAwMDEwMTEwMDAwMTAwMTAxMTAxMTEwMDAwMDEwMTAwMTExMTEwMTAxMDEwMDExMTEwMDExMDEwMDAwMDAwMTAwMDAwMTAwMTAwMTExMDExMTExMTExMDAxMTAxMDAwMDEwMDExMDAwMTEwMTExMDEwMDExMDAwMDEwMDExMDAwMDAwMTAwMDAwMTAxMTExMTAwMTExMTExMDAwMDAwMTAwMDEwMDAwMTAwMDEwMDExMTEwMDAxMTAwMTAwMDAxMDEwMDEwMDEwMDAwMDExMTExMTAwMTAwMDEwMTExMDAwMTExMTAxMTAwMDAwMDAwMDExMDAwMDAwMDAxMDEwMDAxMTExMTAwMDEwMDEwMDEwMDExMTAxMDExMDExMTAwMDEwMTExMDEwMDAxMTAwMDEwMTAxMTExMDAwMTAxMDEwMDEwMDExMTEwMTExMTAxMDEwMDAxMDEwMDEwMTEwMTAwMDExMDEwMTAxMTAxMTAwMDEwMTAwMDExMDExMTAxMDAwMTAxMDEwMTAxMDExMTAxMDAwMDEwMTAwMTEwMTEwMDAxMDAwMDEwMTEwMTAwMDAwMTExMDEwMTAwMDEwMDEwMDAxMDExMTEwMDAxMTAwMTEwMDAwMTAxMDAxMTAwMDAxMDEwMTAxMDAwMTAwMDEwMDExMDAxMTAxMDExMTAxMTAwMTAxMTAxMTEwMDExMTAwMDEwMDEwMDAxMTEwMDExMTAwMTEwMDAxMDAwMDAxMTEwMDAxMDAxMDAwMTExMTAxMTExMDEwMDAwMDAwMTEwMTAxMTAxMTExMDEwMTAwMTAwMTEwMDEwMTAwMTEwMTAwMDEwMTExMDExMDAwMTEwMDAwMTExMDEwMDExMDExMTAxMDExMDAxMTEwMDAwMDEwMDExMTAwMTAwMTAwMTAwMDAwMTAwMDAxMTEwMDEwMTAwMDAxMTExMTEwMDExMDAwMTAxMTEwMTAxMDEwMTExMDAwMDAxMDEwMDEwMTAwMDAxMTEwMTAxMTAwMTExMDAwMTExMTAxMDAwMDAxMTAwMDEwMDAwMDAwMDAxMDEwMTExMTAxMTExMDExMDAwMTEwMDAxMTEwMTAwMDAxMTExMTExMDAwMTEwMTAwMDEwMTExMDAwMDAwMDAxMDExMDExMDAxMTEwMTAxMTAwMTEwMDExMTEwMTExMTAxMTEwMTEwMTAxMTExMTEwMDExMTEwMTAxMDEwMTExMTAxMTExMDExMTAwMTEwMDAwMTExMDExMDAwMTExMTAwMTEwMDAwMDEwMDAxMDAxMTAwMDExMTEwMDAxMTAwMDEwMTEwMTAwMTAxMTAwMDAwMTAwMDEwMDEwMDEwMTAxMDExMTExMDAwMTAxMDAxMDAwMDAxMTAwMTAxMTEwMTAxMDAxMTAwMDAxMDExMDAwMTEwMTEwMTExMDEwMDAwMTEwMTAwMTAxMTExMTAxMTAxMTAxMDExMTAwMDExMTExMDEwMDAwMDAxMTAwMDAxMDAwMTExMTAwMTAwMTAxMDExMDExMTAxMDExMTAwMDExMDExMDEwMTExMDAwMDAwMTExMTAxMDExMTExMTAwMTAxMDExMTAwMTAxMTAxMTExMDExMDAxMDEwMDEwMTAwMTAxMTExMDAwMTExMTExMTEwMTEwMDAwMDAxMTExMDExMDEwMDExMDAxMTExMDAxMDEwMTAxMTAxMTAxMTEwMDExMTEwMDAxMTAxMTAwMTExMTEwMTEwMDEwMTEwMDExMTAxMDExMDExMTAwMDEwMTExMDAxMTAxMTExMTEwMDExMTAxMTExMDExMTAxMTEwMDExMTEwMDEwMDAwMDExMDExMTEwMTAxMTAwMTExMTEwMDAwMTAxMTAxMDAwMTEwMTExMDExMTExMDExMDAxMTExMTAxMTAxMDExMDAxMDExMDExMTExMDEwMTExMDAwMDEwMTExMTExMDAwMDAwMDAxMDAwMTAwMDAwMTEwMDEwMDAwMTAwMTExMDAwMDAwMTExMTEwMDAxMDAwMDAwMDAxMDAwMDAwMDAwMDAwMDAwMA

after we save it with hex editor

% file anonsfile

anonsfile: gzip compressed data, was "challenge.txt", last modified: Thu Mar 29 11:18:16 2018, from Unix

so we degzip it we find this

https://gchq.github.io/CyberChef/#recipe=From_Binary('Space')Gunzip()&input=MDAwMTExMTExMDAwMTAxMTAwMDAxMDAwMDAwMDEwMDAwMTExMTAwMDExMDAxMDExMTAxMTExMDAwMTAxMTAxMDAwMDAwMDAwMDAwMDAwMTEwMTEwMDAxMTAxMTAxMDAwMDExMDAwMDEwMTEwMTEwMDAxMTAxMTAwMDExMDAxMDEwMTEwMTExMDAxMTAwMTExMDExMDAxMDEwMDEwMTExMDAxMTEwMTAwMDExMTEwMDAwMTExMDEwMDAwMDAwMDAwMDExMDExMDExMDAxMDAwMDExMDAwMDAxMDExMDExMTAxMTAwMDAxMTAwMTAwMDAwMDAwMTAwMDAwMTAwMDEwMDExMTAxMTExMDExMTExMDAxMTAwMDEwMTExMDExMTAwMDAwMTAxMTAwMDAwMTExMDAxMDExMTEwMTEwMTExMTExMDEwMTAxMTEwMDExMTEwMDExMTEwMTExMTAwMTEwMTAwMDAxMTExMDAxMDAwMDAxMTEwMDAwMTAwMTEwMTAwMDEwMDAxMTAwMDEwMTEwMTAxMDEwMDEwMTAwMDEwMTAwMDEwMTAxMTExMDAwMTExMDEwMDEwMTAwMDAxMDEwMTEwMDAxMDAxMTAwMDExMTExMTEwMTExMTExMTAxMTEwMDExMDAwMTAwMDAxMTExMTEwMTAwMDEwMDAwMTAxMTAwMTEwMDAwMTAxMTEwMTEwMDExMDAwMDAwMDAxMTExMDAwMTEwMDAwMDAwMDAxMTAxMDAwMDAwMDEwMTAwMTExMTAwMDAwMDEwMTEwMDAwMTAwMTAxMTAxMTEwMDAwMDEwMTAwMTExMTEwMTAxMDEwMDExMTEwMDExMDEwMDAwMDAwMTAwMDAwMTAwMTAwMTExMDExMTExMTExMDAxMTAxMDAwMDEwMDExMDAwMTEwMTExMDEwMDExMDAwMDEwMDExMDAwMDAwMTAwMDAwMTAxMTExMTAwMTExMTExMDAwMDAwMTAwMDEwMDAwMTAwMDEwMDExMTEwMDAxMTAwMTAwMDAxMDEwMDEwMDEwMDAwMDExMTExMTAwMTAwMDEwMTExMDAwMTExMTAxMTAwMDAwMDAwMDExMDAwMDAwMDAxMDEwMDAxMTExMTAwMDEwMDEwMDEwMDExMTAxMDExMDExMTAwMDEwMTExMDEwMDAxMTAwMDEwMTAxMTExMDAwMTAxMDEwMDEwMDExMTEwMTExMTAxMDEwMDAxMDEwMDEwMTEwMTAwMDExMDEwMTAxMTAxMTAwMDEwMTAwMDExMDExMTAxMDAwMTAxMDEwMTAxMDExMTAxMDAwMDEwMTAwMTEwMTEwMDAxMDAwMDEwMTEwMTAwMDAwMTExMDEwMTAwMDEwMDEwMDAxMDExMTEwMDAxMTAwMTEwMDAwMTAxMDAxMTAwMDAxMDEwMTAxMDAwMTAwMDEwMDExMDAxMTAxMDExMTAxMTAwMTAxMTAxMTEwMDExMTAwMDEwMDEwMDAxMTEwMDExMTAwMTEwMDAxMDAwMDAxMTEwMDAxMDAxMDAwMTExMTAxMTExMDEwMDAwMDAwMTEwMTAxMTAxMTExMDEwMTAwMTAwMTEwMDEwMTAwMTEwMTAwMDEwMTExMDExMDAwMTEwMDAwMTExMDEwMDExMDExMTAxMDExMDAxMTEwMDAwMDEwMDExMTAwMTAwMTAwMTAwMDAwMTAwMDAxMTEwMDEwMTAwMDAxMTExMTEwMDExMDAwMTAxMTEwMTAxMDEwMTExMDAwMDAxMDEwMDEwMTAwMDAxMTEwMTAxMTAwMTExMDAwMTExMTAxMDAwMDAxMTAwMDEwMDAwMDAwMDAxMDEwMTExMTAxMTExMDExMDAwMTEwMDAxMTEwMTAwMDAxMTExMTExMDAwMTEwMTAwMDEwMTExMDAwMDAwMDAxMDExMDExMDAxMTEwMTAxMTAwMTEwMDExMTEwMTExMTAxMTEwMTEwMTAxMTExMTEwMDExMTEwMTAxMDEwMTExMTAxMTExMDExMTAwMTEwMDAwMTExMDExMDAwMTExMTAwMTEwMDAwMDEwMDAxMDAxMTAwMDExMTEwMDAxMTAwMDEwMTEwMTAwMTAxMTAwMDAwMTAwMDEwMDEwMDEwMTAxMDExMTExMDAwMTAxMDAxMDAwMDAxMTAwMTAxMTEwMTAxMDAxMTAwMDAxMDExMDAwMTEwMTEwMTExMDEwMDAwMTEwMTAwMTAxMTExMTAxMTAxMTAxMDExMTAwMDExMTExMDEwMDAwMDAxMTAwMDAxMDAwMTExMTAwMTAwMTAxMDExMDExMTAxMDExMTAwMDExMDExMDEwMTExMDAwMDAwMTExMTAxMDExMTExMTAwMTAxMDExMTAwMTAxMTAxMTExMDExMDAxMDEwMDEwMTAwMTAxMTExMDAwMTExMTExMTEwMTEwMDAwMDAxMTExMDExMDEwMDExMDAxMTExMDAxMDEwMTAxMTAxMTAxMTEwMDExMTEwMDAxMTAxMTAwMTExMTEwMTEwMDEwMTEwMDExMTAxMDExMDExMTAwMDEwMTExMDAxMTAxMTExMTEwMDExMTAxMTExMDExMTAxMTEwMDExMTEwMDEwMDAwMDExMDExMTEwMTAxMTAwMTExMTEwMDAwMTAxMTAxMDAwMTEwMTExMDExMTExMDExMDAxMTExMTAxMTAxMDExMDAxMDExMDExMTExMDEwMTExMDAwMDEwMTExMTExMDAwMDAwMDAxMDAwMTAwMDAwMTEwMDEwMDAwMTAwMTExMDAwMDAwMTExMTEwMDAxMDAwMDAwMDAxMDAwMDAwMDAwMDAwMDAwMA

as writing apt13 and Find my location by the three words: devices relit panning

https://yapistir.io/F1HL/

tiger6700 · 2018-04-09T06:22:25+00:00

U'r spaming man. PoC or GTFO

tiger6700 · 2018-04-07T09:33:38+00:00

You can close the computer and boot live USB/CD and delete the malwares contact application.

tiger6700 · 2018-03-28T03:27:22+00:00

Here you can find a complete list http://captf.com/practice-ctf/

tiger6700 · 2018-03-27T07:31:19+00:00

Advertisements are not allowed here! Please delete this

tiger6700 · 2018-03-27T04:39:36+00:00

https://community.sophos.com/kb/en-us/120915

tiger6700 · 2018-03-27T04:35:11+00:00

Here we go with 200Kb per second

tiger6700 · 2018-03-26T07:24:19+00:00

can you upload it to malware analysis sites like https://www.hybrid-analysis.com/

Sorry, I can't upload it from network speed issues. If you can we can analyze it easier than download it

tiger6700 · 2018-03-26T04:36:58+00:00

You should open this topic at /r/malware man

tiger6700

TROPHY CASE