Full transcript
0:00Hey, sorry for the scrappy audio and
0:02video today. I am out on travel with
0:05family because it is the holidays, but
0:07hopefully the audio and video isn't that
0:09bad. I know a lot of folks YouTube
0:10comments were saying, "Oh, I missed the
0:11old John Hammond playing Capture the
0:13Flag in the back of his car." So, hey,
0:15this one's for you. But it is the
0:17holidays, which means it's that time of
0:19year again where we get to neglect our
0:21family and play a lot of capture the
0:23flag and do some cyber security stuff.
0:26And it is that time of year again for
0:28the try hackme advent of cyber. For
0:31folks that aren't too familiar with the
0:33advent of cyber, you get to learn cyber
0:35security for free with 24
0:37beginnerfriendly challenges running all
0:39throughout the month of December.
0:40Starting December 1st with over $150,000
0:45in prizes. I'm on the website now. I'll
0:47have a link in the video description if
0:48you're interested. Try HackMe does this
0:50every year and it's phenomenal every
0:52single time. The best part is it is
0:54completely free. Anyone can join. It is
0:57a super fun event with tons of
0:59characters, a whole storyline, a new
1:01challenge every day leading up until
1:03Christmas. This time around, we get to
1:05investigate and outsmart King Malhair's
1:08chaotic holiday schemes. There are
1:10prizes for participants. There are
1:12certificates for participants, and you
1:13get to learn a whole lot of cyber
1:15security stuff. Exploitation with
1:16kernel, web app security, fishing,
1:19malware, AWS, some cloud work, and it's
1:21all getting started super duper soon. It
1:23is on try hackme and of course link in
1:26the video description. But I did want to
1:27let you know try hackme is still doing
1:30their black Friday deal and it is their
1:32best deal of the entire year. It is 40%
1:35off their annual subscription. That does
1:38end December 1st, the start of the new
1:40month, but it converts to 35% off
1:43through the end of Advent of Cyber. If
1:45you've been thinking about learning
1:46cyber security, this is the best time of
1:48the year to join. And I'd encourage you,
1:50hey, upgrade to that annual
1:52subscription. definitely take advantage
1:53of this deal. You can use the code John
1:56BF, my first name John Jhn, and the
1:59letters BF for Black Friday to get that
2:02Black Friday discount. Link below in the
2:04video description. Anyway, back to
2:06Advent of Cyber. Completely free,
2:07beginner friendly, perfect for anyone
2:09with zero cyber security experience
2:11wanting to dive in. This is without a
2:13doubt Tryhack's biggest Advent of Cyber
2:16event yet. And there's a super cool
2:18story line here. The snow falls over
2:21Wereville. But the spirit of Smus is
2:24under siege. Mskiddy is gone and King
2:26Malhair is spreading chaos from Hopsack
2:29Island, hijacking present systems and
2:31joy itself. So, we've got to play along
2:34with every challenge that's released
2:36each day throughout the month of
2:37December. You can see a little teaser
2:39for each of them here, but you'll note
2:41there is a warm-up challenge already
2:43available for us. So, for this video, I
2:45want to get started with the prep track.
2:47This is where we can see all the sweet
2:49stuff from Try Hackme really shine.
2:51Because look, there are over 6 million
2:53people that play on Try Hackme. Over 6
2:56million learners worldwide. And the
2:58coolest thing about Tryh Hackme is that
3:00all of it is available right away.
3:03Instant access. It's all in the browser.
3:05You don't need to install any software
3:07or have any specific sort of hardware.
3:09You can just dive in. There are
3:10structured learning paths just like
3:12this. And you're doing real hacking, not
3:14just theory, but hands-on practical
3:16stuff. It's gamified learning. So, of
3:18course, there's a leaderboard and
3:20prizes. And take a look at some of
3:22these. These are wild. Five MacBook
3:24Airs, try hackme subscriptions, iPhones,
3:27Apple Airpods, monitors, swag gift
3:29cards, flipper zeros, keyboards, rubber
3:32duckies, defcon tickets, the list goes
3:34on and on. And these are chosen at
3:36random. All the participants, everyone
3:38that joins the fun here, they're
3:40contacted at the end of the month in
3:41January. Anyway, let's get to the fun
3:44stuff. Oh, you do get a certificate,
3:45though. That's going to be pretty
3:46awesome to share on LinkedIn. Prove your
3:48achievement. All right, let's get to it.
3:49Let me click check. I did read all that.
3:51Dead at least. Super speedy. Oo, had a
3:54cutesy little notification there. Let me
3:56take a look at how to use Try Hackme.
3:58We'll speedrun through this because
3:59maybe a lot of folks already know how to
4:01do this, but you'll be able to start a
4:03whole virtual machine or interact with
4:05the environment just beside this playth
4:07through here. The tryhackme attack box
4:09can spin up in a split screen sort of
4:11display so that you'll be able to
4:12interact with the task and the challenge
4:14all beside your environment. Let me turn
4:17off those sound notifications here and
4:19let's get to the story line. The snow is
4:21falling inville, home of the best
4:23festival company. And we're preparing
4:25for Smamus, the annual cyber security
4:27celebration. But something's not right.
4:29King Malhair is entering the game.
4:32before we can join the Sockmiss response
4:34team, we got to work through 10 short
4:36missions to be able to make sure we're
4:38ready. So, in each of these little
4:40challenges below, we can go ahead and
4:42click view site in the top right corner.
4:44And that way, we could follow along.
4:46This one is called Password Pandemonium.
4:48And remember, at the top, we'll have to
4:49click view site, and that'll spin it up
4:51in the split screen display. So, look at
4:53this. As you log in to the best festival
4:56company workstation, apparently there
4:58are some weak passwords. Even McKitty's
5:00old credentials were password 123 with
5:03some elite speak at sign0 fancy pass,
5:06right? So this is a simple task. We just
5:08need to update with a new password. Let
5:10me go ahead and click the button to
5:12update password. And to be honest, I
5:14really like to use a password manager.
5:16Personally, I've been using Proton Pass
5:17lately. So maybe a quick little
5:19shortcut, but even just using a Proton
5:21Pass or any other password manager
5:23browser extension, I could generate a
5:25new password and we could make however
5:26many things we'd like. But using a
5:28passphrase or some strong memorable
5:30password helps us be able to type that
5:32if we ever need to. Or you could make it
5:34something completely random with however
5:37many characters you want. Personally, I
5:38really like using some sort of
5:40passphrase. Still using the special
5:42characters and symbols. So I can copy
5:44this. Let's submit that as our new
5:46password. And that meets all the
5:48criteria that we need for security. Let
5:50me click submit. And now we have a flag
5:52or password, the specific key and token
5:55that we could submit on the scoreboard.
5:57Let me scroll back down to that
5:59submission box. I'll hit paste and then
6:01we have that one done. Let's keep
6:03cruising. Challenge two is all about a
6:05suspicious chocolate.exe.
6:08Okay, remember let's click view site and
6:10we don't need to remember any password
6:11here. No, thank you, Prave. A shiny USB
6:14drive labeled the sockmiss party
6:16playlist appears on your desk. Inside it
6:18is a mysterious file called
6:20chocolate.exe. Like a Windows executable
6:23file, right? It looks festive, but who
6:25sent it? In this challenge, you'll scan
6:27the file using a simulated virus total
6:29to be able to determine it whether or
6:30not it is malicious. So, all we got to
6:32do is press the scan button here. My
6:35face might be in the way. Once I click
6:37that button, though, we can see the
6:38results. Looks like Malhair Trojan is
6:41being detected from Malhair Labs. And a
6:44lot of other vendors or a lot of the
6:45other antivirus engines that something
6:47like Virus Total Bite used to check is
6:49this file malicious or malware or not.
6:52Well, they're saying it's clean. Oh,
6:53thank you, Echo. I appreciate you
6:54jumping in. That's their cool AI
6:56assistant that they're helping out with.
6:57But in this scenario, only one out of 50
7:00vendors detected this chocolate.exe file
7:04as being malicious. Truth be told, I
7:06would probably air on the side of
7:08caution here. Like if anything thought,
7:10hey, that's malicious. I'm going to
7:12still be a little bit vigilant. I'm
7:14probably not going to run that. I'd say
7:15that's malicious. So, I'll click submit.
7:17And there it is. You caught the first
7:19whiff of Malhair's mischief. That file
7:22chocolate.exe was baked. And here's our
7:24flag. THM. Not so sweet. We could copy.
7:27Go ahead and paste this in and mark that
7:29challenge as done. Excellent. Now we've
7:32got the attack box for challenge three.
7:35Let's click view site once again to get
7:37into that environment. You step into the
7:39best festival company's attack box. A
7:41secure virtual environment built for
7:43training. So we probably want to learn a
7:45little bit of the command line here,
7:46like being able to type and enter
7:48specific programs or commands we want to
7:50run inside of a virtual machine, like
7:52the attack box. And notes here we could
7:54use help to see the available commands.
7:56And it even prompts us here we could use
7:58ls to list files. Use cd to like change
8:01directory into a different folder and
8:03then cat to display or type out any
8:06specific file. So let's change directory
8:08into challenges just as it said. Let's
8:10use ls to list stuff or try to see what
8:13files are there. And then we can cat out
8:15or display type and show on the screen
8:18our welcome.ext. There it is. Now we
8:21have our flag THM ready to hack and we
8:24can submit that with the copy button
8:26here to paste this in and check our
8:28work. Another one done. What do we got
8:30for challenge 4, the cmd conundrum?
8:33Let's click view site. McKitty's
8:35workstation shows signs of tampering,
8:37suspicious files moved, logs wiped, and
8:39a strange folder named mystery data. Now
8:42let's use the Windows command prompt to
8:44uncover what's hidden. So, this is going
8:45to have a couple different commands to
8:47run. Like rather than the Linux side of
8:49the house that we were in in the
8:51previous challenge from the attack box
8:53when we use something like ls to list
8:55files ls without caps lock on Windows
8:58and cmd.exe or that old school Windows
9:01command prompt doesn't actually have
9:03support for that. They use diir to list
9:06out directory contents. You can even use
9:08different arguments or parameters like
9:10diir slash like a forward slash to
9:13denote some other configuration switch
9:15and we'll use slash a to specify I want
9:18all files even some special hidden
9:20files. There's nothing here now but
9:22maybe if we were to change directory or
9:25move into this mystery data folder or
9:28directory. Let's use diir/ a once again.
9:31There we go. Now we have a hidden
9:33flag.ext and we can't use cat in this
9:36situation. We'll have to use type
9:38because again the Windows command prompt
9:40cmd.exe
9:41doesn't know what cat is. Type is the
9:44proper command for that. And we'll type
9:45out our hidden flag.ext. I'll hit enter.
9:48And where is mixitty? Let's copy and
9:51paste. And we're done. Nice. Let's keep
9:54cruising. What's challenge five look
9:56like? Okay, Linux. Back to a Linux
9:58command line. Let's hit view site here.
10:00Now we're using some other arguments and
10:02parameters just like we did in the
10:04Windows world, but with Linux. You don't
10:06always see like a forward slash slash a
10:09like we did with DIR. We're going back
10:11to ls, but they normally use just a
10:13hyphen, a minus symbol, a dash or attack
10:16to then list hidden messages, hidden
10:19files in the directory. So, let's ls see
10:22where we are right now. Looks like we
10:23could move into the home directory or we
10:26could use an absolute path just like
10:28they mentioned here with the Linux file
10:30system noting it starts with a forward
10:32slash. So let's CD just to that absolute
10:35path rather than the relative path I was
10:38using just from one position one
10:40directory and folder to the next. I
10:42could just cd mixkitty but now I want to
10:45cd/home/mixkitty
10:47and we're going all the way from the
10:49whole file system. Let's ls. We only see
10:52readme.ext but let's use ls tacl. And
10:55that lists with a long format here. You
10:58can see even some of the permissions who
11:00owns the file when it was created. But
11:02let's use ls tac a which now shows the
11:06hidden files. Remember that all and we
11:08can combine these ls tac l and a to see
11:12the long format of all files in Linux. A
11:16file that is preceded with a dot or a
11:18period at the very beginning usually
11:20means that's a hidden file. It's not
11:22going to be displayed by default when
11:23you just ls or list stuff right from the
11:26start. So since we know the name of that
11:28file now we could cat Linux world cat
11:32our secret message. We display that and
11:34we have our flag thm trust no bunny.
11:38Cool. Let's copy that. Paste it in and
11:40let's keep going. Well done. We're
11:42almost at the end here. Let's get to
11:43challenge six. Let's click view site to
11:46display that. And ooh we have like a
11:47simulated have I been pawned database.
11:50The leak in the list. Rumors swirl that
11:53the best festival company's data has
11:55been leaked. Emails are bouncing and the
11:57staff is panicking. Mskiddy suspects his
11:59account might have been part of a
12:01breach. So, we could use tools like the
12:03real have I been pawned website and they
12:05include a link here for that. This is
12:07Troy Hunt's super cool utility have I
12:09been pawned? Just a website have I
12:11beenponed.com that sort of aggregates a
12:13lot of real world actual real data
12:17breaches to know if your information is
12:19out and about. You could enter your
12:20email address there and see if any of
12:22your records have ever been leaked out
12:24to the whole world because of some
12:25recent hack. Anyway, let's do this with
12:28the simulated have I been pawned utility
12:30in the tryhackme advent of cyber prep
12:33track. We'll need to enter Mskiddy's
12:35email address. Mixkiddy TBFC, the best
12:39festival company. We can just paste that
12:41in and click check. And uh-oh, that has
12:43been pawned. We'll need to identify the
12:46one that is marked compromised, and
12:47that's from hopsc.io. IO. So if I click
12:50this, okay, yep, they are tracking. And
12:52looks like that gave us the flag. We
12:54found THM leaked and found. We can copy
12:57that. Paste it in. And that was another
12:59sweet simple showcase of another utility
13:01that might be helpful for you in your
13:03own cyber security career. Now we're
13:05doing some Wi-Fi stuff. Let me click
13:07view site. The best festival company
13:09drones are looping endlessly over
13:11Weville Square. Someone logged in to the
13:14company router using default
13:16credentials. Oh, okay. Securing Wi-Fi is
13:19critical. Default passwords are like
13:21leaving the front gate wide open. So,
13:24they probably just left admin as the
13:27username and password. So, we could log
13:28in with that just as well. Admin admin.
13:31Type in the username and password. Click
13:33login. And now, let's create another new
13:36strong password. We could do the very
13:37same. Even just fill in something out
13:39like a simple password manager. I'm
13:40going to generate another quick one here
13:42with Proton Pass. Paste that here. Paste
13:45that here. And now we could click save.
13:47And there we go. That's all we needed to
13:49do was change and correct that password
13:52so it's not the default anymore. No more
13:54default credentials. Let's click copy,
13:57paste, and keep cruising. All right,
13:59next up is the app trap. [snorts] Let's
14:01click view site. McKinn's social account
14:04started posting some strange messages
14:07about East. Maybe his mobile application
14:10something on his phone had more
14:11permissions than it should have. like,
14:13uh-oh, some of the things he had
14:15installed had other privileges that it
14:17didn't need, like access to passwords.
14:19So, in a simulated scenario here, we
14:21could click in to each and every one of
14:23these applications on McKinn's phone and
14:26try to see which of them actually have
14:28the password vault access. Clicking
14:31through each of these, looks like East
14:33Misseduler does have password vault
14:35displayed here. That's what we're
14:36looking for. We could just click revoke
14:39and that's it. Simple, small little
14:41task. Now that access is revoked and we
14:44won't be able to see Mskiddy's account
14:46compromised again. Chatbot confession.
14:49Oh, we're doing some AI stuff. Festive
14:51bot was meant to write helpful, cheerful
14:54letters or emails, but it's been
14:56spilling secrets. Some messages even
14:58reveal internal URLs or passwords and
15:01credentials. So, we've got to look
15:03through all of the past messages from
15:06Festive Bot and try to see which of
15:08these are bad, what we don't want to
15:10have leaked by AI. One of these here
15:13looks like a pretty clear URL. https
15:16internal.tbfc.local/admin.
15:20Yeah, that probably is sensitive.
15:22Scrolling down, I see email credentials,
15:25another password that's included here,
15:27and even a service token for an API.
15:30Definitely don't want to have those
15:31leaked. Scrolling through. Those look
15:33like the only ones that are glaring.
15:35Everything else does look a little bit
15:37helpful or at least innocent, right?
15:39Let's click submit. And that's it. Don't
15:40feed the bot. Copy and paste that one.
15:43Okay, we're moving on to challenge 10
15:45here. Bunny's browser trail. Web servers
15:48are showing heavy traffic, but one log
15:50entry sticks out like a user agent. Now,
15:52that's sort of the identifying
15:54fingerprint that your client side web
15:56browser sends to different servers or
15:58websites that it connects to. Let's
16:00click view site so we can interact with
16:01this one. We need to find this unusual
16:04user agent, that header or that data,
16:06that text or string that's included with
16:09some of these communications. We can see
16:10a lot of regular or normal user agents
16:13here, but we're looking for the odd one
16:16out, the bunny OS. And it looks like I
16:19see it here going to an admin panel. And
16:22that is certainly the problematic entry.
16:24So, let me click submit with that one
16:26selected. And there we go. We tracked
16:28that down. Yep, that was our bad entry.
16:30Let's go ahead and copy and paste this
16:32one. But with that, I think we're done.
16:34We can get to the finish line and read a
16:36little bit more about all this stuff. If
16:38I exit split screen view here, we could
16:40see consider yourself warmed up. That
16:43was it. some small simple tasks to be
16:45able to get our feet wet, to be able to
16:47wet our appetite for the real advent of
16:50cyber 2025. And this was cool. This was
16:53handy. These were some sweet little
16:55presentations just to be able to get the
16:56idea for look what we should be doing in
16:58cyber security. Don't leave default
17:00credentials behind. Don't let AI leak
17:02any info. Don't let your passwords be
17:04insecure, email addresses out in data
17:07breaches. This is still all the right
17:09stuff. So, I'm looking forward to Advent
17:12to Cyber 2025, and I hope you are, too.
17:15We did it. The prep track is complete.
17:18Look, I'll be diving into the Advent to
17:20Cyber this year with Try Hackme once I'm
17:22back home from holiday travel time. I'm
17:24going to be showcasing and walking
17:25through one of the day exercises, one of
17:27those daily challenges, and I hope I'll
17:29be able to tackle a whole lot more. But
17:31truly, the event is for you. It's for
17:34you to learn some cyber security stuff,
17:36have a whole lot of community
17:38involvement to be present there with
17:40everyone else involved in this and
17:42sharing your success, getting those
17:43certificates out the door, winning some
17:45sweet prizes, learning cyber security,
17:47and walking through beginner friendly,
17:49free, accessible, and real hands-on
17:52practical hacking and cyber security.
17:54So, check it out. Link below in the
17:56video description. Dive into the Try
17:58HackMe annual subscription. You can use
18:00code JohnBBF to snag some of those Black
18:03Friday discounts. And thank you again
18:04and again for watching this video. I
18:06hope you were able to tolerate my
18:07scrappy video and audio while I'm out
18:09and about. See you for Advent to Cyber
18:112025. Thanks so much for watching. I'll
18:13see you in the next