Zumpyx's Blog

Campfire-1

SherlocksVery Easydfirkerberoasting
← Sherlocks

Campfire-1

Pasted-image-20240711093909.png

Alonzo Spotted Weird files on his computer and informed the newly assembled SOC Team. Assessing the situation it is believed a Kerberoasting attack may have occurred in the network. It is your job to confirm the findings by analyzing the provided evidence. You are provided with: 1- Security Logs from the Domain Controller 2- PowerShell-Operational Logs from the affected workstation 3- Prefetch Files from the affected workstation

Alonzo在他的电脑上发现了奇怪的文件，并通知了新组建的SOC团队。评估情况-据信网络中可能发生了Kerberoating攻击。您的工作是通过分析提供的证据来确认调查结果。您将获得：1-域控制器的安全日志2-受影响工作站的PowerShell操作日志3-受影响工位的预取文件

任务列表

1、分析域控制器安全日志，你能确认kerberoasting活动发生的日期和时间吗？

Analyzing Domain Controller Security Logs, can you confirm the date & time when the kerberoasting activity occurred?

2024-05-21 03:18:09

2 、目标服务名称是什么？

What is the Service Name that was targeted?

MSSQLService

3、识别发生此活动的工作站非常重要。工作站的IP地址是什么？

It is really important to identify the Workstation from which this activity occurred. What is the IP Address of the workstation?

172.17.79.129

4、现在我们已经确定了工作站，我们将向您提供包括PowerShell日志和预取文件在内的分类，以获得更深入的了解，从而了解此活动是如何在端点上发生的。用于枚举Active directory对象并可能在网络中查找Kerberoastable帐户的文件的名称是什么？

Now that we have identified the workstation, a triage including PowerShell logs and Prefetch files are provided to you for some deeper insights so we can understand how this activity occurred on the endpoint. What is the name of the file used to Enumerate Active directory objects and possibly find Kerberoastable accounts in the network?

powerview.ps1

5、这个脚本是什么时候执行的？

When was this script executed?

2024-05-21 03:16:32

6、用于执行实际kerberosting攻击的工具的完整路径是什么？

What is the full path of the tool used to perform the actual kerberoasting attack?

C:\Users\Alonzo.spire\Downloads\Rubeus.exe

7、该工具何时执行以转储凭据？

When was the tool executed to dump credentials?

2024-05-21 03:18:08

分析

kerberoasting 攻击是在 Kerberos 协议的 TGS-REP 阶段，KDC 的TGS 服务返回一个由服务的 NTLM Hash 作为密钥加密的 ST 给客户端，如果使用了 RC4-HMAC 等弱加密类型，可以本地离线爆破，有可能获取 SPN 链接用户的明文密码。

Log

- SECURITY-DC.evtx
- Powershell-Operational.evtx
- prefetch/

在 Kerberos 认证的 TGS-REP 阶段，请求 Kerberos 服务票据操作的事件 ID 为 4796，RC4-HMAC 加密类型为 0x17。而且请求的一般是具体的服务，而不是 DC01$、krbtgt 等。

Pasted-image-20240711102052.png

这里可以看到攻击的时间为：2024-05-21 03:18:09

目标服务名称为：MSSQLService

发生此活动的工作站 IP 为：172.17.79.129

打开 Powershell 操作日志

Pasted-image-20240711102328.png

发现很多 powerview.ps1 的记录，而且 powerview 是有枚举 Kerberoastable 账户的功能的

文件名称：powerview.ps1

脚本的执行时间可以找到第一个执行 powerview 的事件

Pasted-image-20240711151321.png

时间为：2024-05-21 03:16:32

对于执行实际 kerberosting 攻击的工具，需要找到 prefetch 目录，利用 PECmd 提取信息，再使用 TimelineExplorer 分析。

Pasted-image-20240711152457.png

# 切换到 prefetch 目录
PECmd.exe -d . --csv .. --csvf ../prefetch.csv

其中 prefetch.csv 中的信息比较丰富，prefetch_Timeline.csv 的信息只有时间与路径

Pasted-image-20240711153235.png

首先猜测文件时在用户目录，使用过滤器 Does not contain = WINDOWS，先过滤掉 WINDOWS 目录的内容。

Pasted-image-20240711154106.png

找到了 RUBEUS.exe，完整的路径为：C:\USERS\ALONZO.SPIRE\DOWNLOADS\RUBEUS.EXE

执行时间也就是这个预读取的时间：2024-05-21 03:18:08

Hints

  1. In Security Logs, Filter for Event ID 4769. Now Look for any event where the service name is NOT( krbtgt or ends with $ (For e.g DC01$ ) ). The ticket type should be 0x17 which is for RC4 type encryption. The failure code should be 0x0. The event that matches all the above conditions is the event detailing information about the kerberoasting attack activity.
  2. Look for the service name in the Relevant Event identified.
  3. Look for the Client IP Address in the Relevant Event identified.
  4. Use PowerShell logs and filter for event ID 4104. We can see all the contents of the script executed and its name as well.
  5. Look at the first event in event id 4104 list where script blocks were recorded.
  6. Parse the prefetch files using the PEcmd Tool by Eric Zimmerman. The syntax is Pecmd.exe -d “Path of prefetchArtifacts” –csv . –csvf result.csv. This command will create a CSV called result.csv in your current directory from where you are executing the CLI Tool. Open the CSV file in the Timeline Explorer tool(Another Eric Zimmerman tool), then look for any executables executed around the timeline we have established so far. A certain tool name will catch your eye. Then to get the path, go to the Files Loaded column and double-click the value to get a list of files interacted by the executable. It will also include its path.
  7. Look for the “Last Run” Value in the PEcmd output.