HTB Sherlock: Hunter

Task 13

Upon failing their initial attempt to exfiltrate data, the SOC team observed further FTP data being sent to a cloud environment. It is believed that the attackers spun up an instance on the cloud and ran another FTP server hastily to exfiltrate the collected data. Please try to find more information regarding the adversary's infrastructure, so the Threat Intel team can better understand which group might be behind this attack. What is the remote path on the adversary's server where they stored the exfiltrated data?

The FTP traffic showed that the attacker exfiltrated three files to a cloud environment. The remote path appeared in the FTP commands immediately before the file transfers.

The answer is /home/theyoungwolf/xchjfad/uk_campaigns

Task 16

What specific CVE did the attacker exploit to gain access to the sensitive content?

The exfiltrated data included a KeePass database and a KeePass process dump. If the attacker already knew the KeePass password, they would not need to dump the KeePass process. This suggested that the attacker exploited a KeePass vulnerability to recover the password from memory.

CVE-2023-32784 affects KeePass 2.x before 2.54 and can allow recovery of the cleartext master password from a memory dump, even when the workspace is locked or KeePass is no longer running. Using Autopsy, I found that the KeePass version in the KAPE acquisition was 2.53.1, which is vulnerable to CVE-2023-32784.

The answer is CVE-2023-32784

Task 8

We believe the attacker enumerated installed applications on the system and found an application of interest. We have seen some alerts for a tool named Process Hacker. Which application were they interested in?

Based on the evidence above, the application of interest was KeePass.

The answer is KeePass

Task 12

The attackers tried to exfiltrate the data to their FTP server but couldn't connect to it. The threat intelligence team wants you to collect more TTPs (Tactics, Techniques, and Procedures) and IOCs (Indicators of Compromise) related to the adversary. It would be really helpful for the TI team if you could provide some useful information regarding the attacker's infrastructure being used. Can you find the domain name and the password of their FTP server?

The answer is ypmlads.ftp.fileserver:UionskHGTLDS

This password also worked for the ZIP file, so I extracted the files and analyzed them. The keepassproc.dmp file was a memory dump of the KeePass process and contained the material needed to recover the KeePass database password.

Task 17

Find a way to access the sensitive information. The information was related to development of an internal application. What is the suggested name for this app?

The config.json file revealed the suggested name for the internal application.

The answer is C-Comms

Task 18

We believe the attacker had access to the Social Security Number (SSN) of a partner's employee due to the data exfiltrated. Please confirm the SSN number of Arthur Morgan from zeeindustries?

The Internal Comms App config.json file contained the SSN for Arthur Morgan.

The answer is 762-67-5421

Task 19

We believe the domain admin credentials were leaked during this incident. Please confirm the Domain Admin password.

The KeePass database contained the Domain Admin password.

The answer is PapxxuW5Ly8t3KSl8G1k

Task 15

The security team highlighted that information pertaining to a sensitive project may have been exfiltrated by the attackers and are now worried about the threat of extortion. Which directory did the attacker manage to stage and then exfiltrate?

From the previous analysis of the exfiltrated data, I already knew that the attacker exfiltrated the REDACTED_SENSITIVE directory. I used MFTECmd to parse $MFT and Timeline Explorer to analyze the results.

The answer is C:\Users\alonzo.spire\Documents\REDACTED_SENSITIVE

Task 9

What was the name of the initial dump file?

The attacker dumped the memory of the KeePass process to recover the password. The extracted dump was named keepassproc.dmp, but that was not the original dump name. I continued using $MFT data and Timeline Explorer to identify the original filename.

There were two entries with the .dmp extension: keepassproc.dmp and a shortcut named pid9180.dmp.lnk. The shortcut indicated that the original dump file was likely pid9180.dmp, because the name included the process PID and matched the naming style of a process dumping tool such as Process Hacker.

The answer is pid9180.dmp

Task 14

For how long did the tool used for exfiltrating data run before being closed? (Answer in seconds)

The tool used for exfiltration was FileZilla Client. To determine how long FileZilla ran, I checked both SRUM data and UserAssist data, since FileZilla is a GUI application.

SRUM returned four entries for FileZilla Client. I cross-checked them against the network capture timeline to identify the relevant execution window.

In the network capture, FTP traffic started at 2023-06-21 12:20:16 and ended at 2023-06-21 12:23:04, which roughly matched two SRUM entries that ended at 12:24:00. However, submitting the duration from those entries was incorrect.

I then switched to UserAssist data.

The runtime was 10 minutes and 48 seconds, which is 648 seconds.

The answer is 648

Task 4

When was whoami command executed on the system by the attacker? (UTC)

The whoami command displays the currently logged-in user. Its execution can be identified through Prefetch artifacts. I used PECmd to parse the Prefetch files.

The answer is 2023-06-21 11:19:59

Task 3

What's the SHA1 hash of the exe which gave remote access to the attacker?

After identifying the execution time of whoami, I checked the Prefetch data again to find any executable that ran around the same time.

A suspicious executable named OWUJOMCY.EXE ran shortly before whoami. This was likely the executable that provided remote access to the attacker.

I confirmed this by checking files loaded by OWUJOMCY.EXE in the Prefetch data. cmd.exe was loaded, confirming that this executable allowed the attacker to run commands on the system.

To get the SHA1 hash of the executable, I searched for it in Amcache data using AmcacheParser.

The answer is 23873bf2670cf64c2440058130548d4e4da412dd

Task 2

When did the attacker gain a foothold on the system? (UTC)

The attacker’s foothold time can be determined from the Prefetch execution time of OWUJOMCY.EXE.

The answer is 2023-06-21 11:19:34

Task 5

We believe the attacker performed enumeration after gaining a foothold. They likely discovered a PDF document containing RDP credentials for an administrator's workstation. We believe the attacker accessed the contents of the file and utilised them to gain access to the endpoint. Find a way to recover contents of the PDF file and confirm the password.

I searched for PDF files in $MFT using Timeline Explorer.

The file internal_documentation.pdf looked promising. Similar to the SillyEli challenge, I used the Windows Search index to recover the PDF contents.

I used sidr from this repository to parse Windows.edb and search for the PDF contents.

PS E:\Tools\sidr> .\sidr.exe -f csv E:\HTB\Sherlock\hunter\C
Processing ESE db: E:\HTB\Sherlock\hunter\C\ProgramData\Microsoft\search\data\applications\windows\Windows.edb
WARNING: The database state is not clean.
Processing a dirty database may generate inaccurate and/or incomplete results.
 
Use windows\system32\esentutl.exe for recovery (/r) and repair (/p).
Note that Esentutl must be run from a version of Windows that is equal to or newer than the one that generated the database.
E:\Tools\sidr\FORELA-WKSTN002_File_Report_20260509_071827.024389900.csv
E:\Tools\sidr\FORELA-WKSTN002_Internet_History_Report_20260509_071827.024628500.csv
E:\Tools\sidr\FORELA-WKSTN002_Activity_History_Report_20260509_071827.025114500.csv
 
 
Found 1 Windows Search database(s)

I opened FORELA-WKSTN002_File_Report_20260509_071827.024389900.csv in Timeline Explorer, searched for internal_documentation.pdf, and found the file contents.

The answer is JollyRancherATForela22

Task 6

At what time did the adversary initially authenticate utilizing RDP? (UTC)

To find the RDP authentication time, I reviewed the Security event logs in the KAPE acquisition. I used EvtxECmd to parse Security.evtx and Timeline Explorer to analyze the events.

RDP authentication generates event ID 4624, which indicates a successful logon. A LogonType of 10 indicates a remote interactive logon. I filtered for event ID 4624 and looked for Logon Type: 10.

The answer is 2023-06-21 11:44:52

Task 10

The attackers downloaded a custom batch script from their C2 server. What is the full C2 domain URL from where it was downloaded?

Because the downloaded file was a batch script, I searched for .bat files in $MFT using Timeline Explorer.

Only one suspicious entry was found: Scout.bat in C:\Users\alonzo.spire\Pictures. The file was not present in the acquisition, so I again used the Windows Search index to look for its contents.

The content did not contain anything useful. I returned to $MFT and checked activity around the time the batch file was created.

A certutil.exe Prefetch file was created right after the batch file. This suggested that the batch file was downloaded using certutil.exe. I confirmed this by checking the Prefetch data for certutil.exe, which showed that Scout.bat was loaded.

certutil.exe stores downloaded metadata and a copy of the downloaded file in C:\Users\<User>\AppData\LocalLow\Microsoft\CryptnetUrlCache. In that directory, I found metadata containing the URL from which the batch file was downloaded.

The answer is http://oakfurnitures.uk/ovxlabd/campaign/uk_orgs/scout.bat

Task 11

What is the MD5 hash of the batch script?

A copy of the batch script was stored in the Content folder under CryptnetUrlCache. I used Get-FileHash to calculate the MD5 hash.

PS E:\HTB\Sherlock\hunter\C\Users\alonzo.spire\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content> Get-FileHash .\A3CEB2B928510B461A9B19D9B4B8D5B6 -Algorithm MD5
 
Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
MD5             93F595357E23C5FCE3ED694DAFA7C0A3                                       E:\HTB\Sherlock\hunter\C\User...

The answer is 93F595357E23C5FCE3ED694DAFA7C0A3

Task 7

The security team has located numerous unusual PowerShell scripts on the host. We believe the adversary may have downloaded the tooling and renamed it to stay hidden. Please confirm the original name of the malicious PowerShell script utilised by the attacker.

I searched $MFT and Timeline Explorer for .ps1 files under the alonzo.spire user directory.

Most entries were not useful. The only suspicious file was clean.ps1 in C:\Users\alonzo.spire\Pictures. Searching the Windows index for the file contents did not return anything useful, so I looked for script execution traces instead.

I parsed the PowerShell event logs with EvtxECmd and reviewed the results in Timeline Explorer.

A script block showed that a file was downloaded from https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1 and saved as clean.ps1.

The answer is PowerView.ps1

Task 1

What is the MITRE technique ID of the tactic used by the attacker to gain initial access to the system?

I knew the attacker used OWUJOMCY.EXE, which was dropped in C:\Windows, to gain initial access to the system. The next question was how the attacker dropped and executed it.

The executable ran at 2023-06-21 11:19:34. I reviewed Security event logs around that time to look for clues.

These entries all occurred at 2023-06-21 11:19:34, which matched the execution time of OWUJOMCY.EXE.

One notable detail was that immediately after FORELA\alonzo.spire logged on, NT AUTHORITY\SYSTEM also logged on at the same timestamp. This suggested that the attacker may have used PsExec to execute a service as SYSTEM and drop the executable.

Based on this PsExec forensics article, I checked HKLM\SYSTEM\CurrentControlSet\Services for any service whose binary path pointed to OWUJOMCY.EXE.

A service named tFdj had the binary path C:\Windows\OWUJOMCY.EXE.

From MITRE ATT&CK’s PsExec page, the relevant technique for executing binaries through services on a remote system is T1569.002.

The answer is T1569.002