TickTock

https://app.hackthebox.com/sherlocks/TickTock

Gladys is a new joiner in the company, she has recieved an email informing her that the IT department is due to do some work on her PC, she is guided to call the IT team where they will inform her on how to allow them remote access. The IT team however are actually a group of hackers that are attempting to attack Forela.

附件 提取码:8e68 Md5: cb3956227c7ff470441b275432e00624

Task

• Task 1 - What was the name of the executable that was uploaded as a C2 Agent?
• Task 2 - What was the session id for in the initial access?
• Task 3 - The attacker attempted to set a bitlocker password on the C: drive what was the password?
• Task 4 - What name was used by the attacker?
• Task 5 - What IP address did the C2 connect back to?
• Task 6 - What category did Windows Defender give to the C2 binary file?
• Task 7 - What was the filename of the powershell script the attackers used to manipulate time?
• Task 8 - What time did the initial access connection start?
• Task 9 - What is the SHA1 and SHA2 sum of the malicious binary?
• Task 10 - How many times did the powershell script change the time on the machine?
• Task 11 - What is the SID of the victim user?

Data

此题目为 Windows 取证，可以从以下部分入手

• Check list

Registry hive
MFT
Windows Event logs
Other Logs
Profile History Data (APP、Command、Browser)
prefetch

解压后得到一个目录，内有以下文件 三个文本文件记录了C 目录的结构信息。

Registry hive

Collection/C/Windows/System32/config # 先把 NTLM dump下来

impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY local

Impacket v0.11.0 - Copyright 2023 Fortra

[*] Target system bootKey: 0x81291263122d9530f0893f526c3e4d38
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
forela-wkstn-gold:1001:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42:::
gladys:1003:aad3b435b51404eeaad3b435b51404ee:217e50203a5aba59cefa863c724bf61b:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x75252b223522bbd9ca9695571293980e45d804e9
dpapi_userkey:0xe74459cd65b97108dd5bd7a8410a29b4e4e41980
[*] Cleaning up...

MFT 文件

https://ericzimmerman.github.io/ MFTECmd.exe MFTExplorer.exe

PS> MFTEcmd.exe -f ".\Collection\C\$MFT" --json export\mft\ --csv export\mft\

MFTECmd version 1.2.2.1

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/MFTECmd

Command line: -f .\Collection\C\$MFT --json export\mft\ --csv export\mft\

File type: Mft

Processed .\Collection\C\$MFT in 9.3341 seconds

.\Collection\C\$MFT: FILE records found: 120,652 (Free records: 11,126) File size: 128.8MB
        CSV output will be saved to export\mft\20231222084212_MFTECmd_$MFT_Output.csv
        JSON output will be saved to export\mft\20231222084212_MFTECmd_$MFT_Output.json

得到 csv 和 json 文件

Windows 事件日志文件 .evtx

https://github.com/WithSecureLabs/chainsaw

• 导出

find . -name '*.evtx' | while read line; do chainsaw dump $line --json --output ./export/evtx/$(echo -e $line.json | awk -F '/' '{print $NF}') ;done

chainsaw hunt --skip-errors -s ~/.ztm/Forensics/chainsaw/sigma -r ~/.ztm/Forensics/chainsaw/rules -m ~/.ztm/Forensics/chainsaw/mappings/sigma-event-logs-all.yml -o ./export/evtx/chainsaw_hunt.log Collection/C/Windows/System32/winevt/logs/

日志文件 .log

find . -name '*.log' | while read line; do cp $line export/logs/; done

Profile History Data (APP、Command、Browser)

Collection/C/Users/gladys/AppData/ Collection/C/Users/gladys/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadline/ConsoleHost_history.txt

prefetch 预取目录

Collection/C/Windows/prefetch

现在收集已有的信息

Task 1 - What was the name of the executable that was uploaded as a C2 Agent?

merlin.exe

首先查看 gladys 主目录，并没有发现什么东西

想到后门可能会被 Windows defender 杀掉，查看 WDF 日志

Task 2 - What was the session id for in the initial access?

-2102926010

一时猜不到是什么会话 id，但应该和应用相关。在日志文件中发现 TeamView

查看日志，发现 Session id

Task 3 - The attacker attempted to set a bitlocker password on the C: drive what was the password?

reallylongpassword

攻击者试图设置 bitlocker 的行为会被 Sysmon 捕获，查看 Sysmon 事件日志 cat Microsoft-Windows-Sysmon%4Operational.evtx.log | grep '"CommandLine' Base64 解码 echo ... | base64 -d

Task 4 - What name was used by the attacker?

fritjof olfasson

查找 TeamView 日志，发现新的接入者

Task 5 - What IP address did the C2 connect back to?

52.56.142.81

C2 的回连 IP 可以分析 C2 文件，或者通过系统 Sysmon 抓取。 在 Event Logs 中发现 Collection/C/Windows/System32/winevt/logs/Microsoft-Windows-Sysmon%4Operational.evtx 查看 chainsaw 转储后的内容

Task 6 - What category did Windows Defender give to the C2 binary file?

VirTool:Win32/Myrddin.D

可以在 Windows Defender 日志中看到

Task 7 - What was the filename of the powershell script the attackers used to manipulate time?

Invoke-TimeWizard.ps1

Powershell 脚本首先想到 Powershell 命令历史

Task 8 - What time did the initial access connection start?

2023/05/04 11:35:27

可以在 TeamView 日志中看到

Task 9 - What is the SHA1 and SHA2 sum of the malicious binary?

ac688f1ba6d4b23899750b86521331d7f7ccfb69:42ec59f760d8b6a50bbc7187829f62c3b6b8e1b841164e7185f497eb7f3b4db9

Windows Defender 日志中可以看到 merlin.exe 部分会标记恶意程序的 SHA

Task 10 - How many times did the powershell script change the time on the machine?

2371

攻击者使用 Powershell 脚本修改事件，因此首先查看安全事件中的 4616 事件 cat Security.evtx.log | grep 4616 但是不对，猜测可能还有其他的修改时间行为，于是过滤一下有 Powershell 的。 cat Security.evtx.log | grep 4616 -C 10 | grep powershell | wc

Task 11 - What is the SID of the victim user?

S-1-5-21-3720869868-2926106253-3446724670-1003

可以在 System event log 中找到