This is a very NEAT technique, did you stumble upon this technique in the wild being used by some bad actors?, how did you come up with it, Its really nice. I LOVED IT

Im really happy to see you grow, I have recommended you to a "thousand" others and now I see u got 1.3 m subs which is AMAZING. Keep on what ur doing! Greetings!

This video is eye-opening! It's crazy to see how hackers can use something as innocuous as environment variables to hide malicious PowerShell commands. The level of sophistication in cyber attacks is just mind-boggling. Understanding these tactics is crucial for staying safe online. Thanks for the insightful breakdown! Time to up my cybersecurity game.

Great video, seems like a good way to obfuscate commands!

love the content!! keep killing it! what keyboard are you using in the newish setup?

If you have variables that only have the user name as a variable path, you could for example use string splitting on \ to get more options.

Thanks for the great video John, I would like to see what kind of setup you are using (home lab, personal rig, laptop etc.). Can you do a home lab, everyday carry video? I think it will be very interesting and inspiring for the community

Great stuff. I would like to know how this looks in the event logs. Does it just show the env variables or does it show the cmdlet being run?

TNX bro

As i understand reverse engineering, which is very little admitedly. This is how hackers optimize building ROP gadgets. If you get a fixed number of bytes to add to the execution stack, you make sure that what is added is entirely built from other sections of the static mapped memory, because specific strings of assembly will be in fixed locations to reference. So instead of creating code that takes several bytes you just point to a chunk of that already in memory, thereby keeping the exploit within that limited stack space required to maintain the overflow or use after free or whatever tactic the codespace was permitted to hit the stack without the kernel overflowing. Stringing multiple gadgets together creates a ROP chain which is the set of functions you need the exploit to do.

Did this idea come from a sample or just random thought ? Also nice to have more of the red team POV stuff. I've been trying to improve on red side since I've been made part of purple team and stuff like this is helping me make the mental shift.

THANKS YOU

Please bring a video on the new xz malware discovered

Its Because PSModulePath include another Environment Variable (%ProgramFiles%)

Watching right now❤

YES!😃

So helpful

John please make a video on the xz utils vulnerability and on Jia Tan😭

this is a great idea... now i just need to translate python to PS to make it work on any Windows environment. Usually I don't have python available on Windows systems during tests.

You disappeared off my algorithm then I tried to remember ur name when I saw the xz hack and then I see u have 1.3 milli subs, you had 350k last time I watched a vid, killin it!!!

Cool video keep it up

where do you get windows iso to run in vmware or virtualbox, the official site offers 22GB zip which is unreasonable

One form of obfuscation could even be caps, powershell should be case insensitive

This video is interesting and enthusiastic 😁😂

Love you, dude. I am continuously hacked. Dangerous stalker. I have managed to thwart him a few times thanks to vids like this, many are yours! 🌹

I am new to coding so all of this has been informative but very confusing to me. I need to start from the beginning of your videos I guess lol

You have built a nice very pythonic conditional christmas tree 😊😊

is this really useful if my environment is hardened?

It's worrying the lack of Jurassic Park references.

fun!

It would be fun to run this on PowerShell Core in Linux or Mac 😂

leaking my sauce man :( - +10/10 video

You are naughty boy John

Going to watch the video. Will ask if I want to know something

Use a debugger bro :D

The icons are so big😅

Activate Windows got me

make a video on how to detect hacking script which is in encoded javascript , i saw a pastebin post which can hack peoples crypto from g2a account scamming people via encode js code malicious

Why is there so many ai written comments on this….

please 1 video how to hacked gmail password please please new video 🙏🙏🙏🙏🙏🙏

i tried brute-forcing dvwa with hydra but wont work. I had to build a custom script can someone send me the command

420😄

I'm not trust snyk.

I guess first

video content is good, but python code quality terrible

I guess I am first😀

Python... wtf

😂 powershell_command = 'Write-Output 420'

On a mission to bypass windows defnder. I found myself taking a powershell script Editing it a bit and to mt luck. I was able to get a shell and bypass defender. But that was me havifn to copy paste the powershell code ibto powershell. I wanted a clickable or executable.. Ya. Good luck 😅 I had to then create another file to excute the ps1 powershell payload i created. You cant just double click on it and run it. So i created a .bat file and slapped aome code in it.. to execute the ps1 powershell payload from my ppwershell script. It worked. Bypassed defender as well. I then added more code to execute the ps1 payload first then add an esclusion to windows defender to a future .exe windows meterpreter file and location that doesnt even exist yet. Then i created the meterpreter payload and uploaded it and ran it from mt basic shell. Boom! Full shell! Thats the most gangster thing i ever done as a begginer hacker. I think thats pretty advanced. Im on a fully updated windows 10.