How Hackers Hide

Help the channel grow with a Like, Comment, & Subscribe!
Check out the affiliates below for more free or discounted learning!

📧Contact me! (I may be very slow to respond or completely unable to)

[jb_lofi]

John, you're an inspiration and got me into the cybersec industry. Don't be ashamed about your code quality; what matters is it works to the required standard. If you wanted or needed to write top-notch code all the time even for a quick solution out in the field, you'd be a programmer.

[DarkFaken]

Hey John, you don't need to apologise or feel embarrassed about your script. It's definitely not perfect and I'm sure given the time you could come up with something better. However you did an amazing job to put this video together and showcase your handy tool, you're giving so much back to the community, don't be so hard on yourself.

[gnulnx]

John: I'm embarrassed about my code.
*The code is actually better than 99% of my codes*

[beni]

This looks really cool. Im a CS major interested in Cybersecurity and after seeing this, I totally want to give that coding problem a try. I can't say how efficient i'd make it, but it looks like something ive never done before and that's how I like it. To be honest it would be a really good project to add to my resume too haha.

[jimmyc]

im right with you on loving obfuscation. It may seem silly, but its so cool to see the weird and wacky ways people disguise what theyre doing. Thanks for the awesome video :D

[TeenNewsLive]

TLDR: They use glob* wildcards to match the target application they're trying to run instead of calling it outright. The target app in this case would be the schedule task app. This helps with circumventing automatic static analysis.

[pedallknife]

This is awesome, and never hesitate to show code, because (most of us) aren't even near you level! Thanks for this John!

[NKCSS]

One way to make it faster and more plesant, is to treat each folder separately; no need to do the whole loop again when one part of the path changes; then you can offer choices for each section.

[kicks]

This is fun... I can completely understand as a researcher why this is exciting despite those "interesting" conversations. Defensive sec people love to downplay the capability of a simple trick until it works everywhere where it supposedly shouldnt. I share the same level of enthusiasm as you for neat tricks like this... 👍👍

[LxciferXIII]

Honestly its a lot easier to just make your commands look like typical network traffic. Admin can be gained without touching disk a lot of the time, once you have an admin account a good portion of commands blend into the background. Its more data exfil that requires an advance level of obfuscation.

[schlaus_kwab]

don't scold yourself, Ricky, this was fun and educational to watch. Thanks for sharing cool stuff

[QuickFixHicks]

I don't think its a bad idea, because the question is "How many people actually look at the logs like they're suppose to?" I want to start getting into making more projects like you made. The code wasn't perfect but you saw your vision out.

[leandrolej]

How Reloaded, Razor1911, Fitgirl etc etc can "hide" for so long time ?

[nimoo]

I learnt this technique from you. Thank you sir for this video. ❤

[iblackfeathers]

you can use your program that enumerates through all the different wildcard possibilities and instead make them as directories on your system after replacing the question marks with a different character.
find which pathways are targeted the most and create these empty directories to the point where explicit pathways are necessary.
using wildcards will produce numerous outputs and becomes less practical that calling out specific and explicit pathways.

[everything-omzx]

dont listen to people ur the best my brother we love u. :)

[grayshell]

this is quite neat, thanks for the update John

[SeveredSanctum]

Well looking at the output of your shortest code:



Is always the shortest path that populates:

To optimize it you would just have to tell your loops to only check the end parts of the script, as when you performed the full look up, It was also cycling:



which does not need to be checked.

[nicholasdacri]

Whenever I hear John’s voice I get really relaxed! So I will keep advocating for his asmr :D

[patrickshepherd]

Couple things:

a) I'm so sorry, but I can't help but see you as the child of Seth Rogen and Ed Sheeran. Lol please forgive me.

b) I LOVE this channel. I finished a phd in cs a year ago, but my work is all social simulation stuff, nothing to do with security. I did have to do buffer overflows and reverse engineering assembly just a little bit, but that was only one class. I always wondered about the details of a lot of things we heard about, but there were never any examples. This channel is every worked example I could ever ask for!

I know just enough to follow along with what you're doing most times, and watching you work through everything is SO INSTRUCTIVE. I've learned a ton already, and I've been binging your videos for a couple weeks. No plans to stop any time soon; I'm gonna start some CTF challenges myself because of all this.

Thanks dude! Keep up the awesome work!