Red Failure

HackTheBox

Task: analyze a PCAP from a red team engagement to find leftover persistence mechanisms. Solution: extract HTTP objects (PS1 loader, DInjector DLL, encrypted shellcode), deobfuscate PowerShell to recover AES password, decrypt shellcode, decode shikata_ga_nai encoder to reveal a net user command creating a backdoor admin account.