Investigating Windows Writeup

Summary

Category: Blue Team: Digital Forensics & Incident Response

Prerequisites: openvpn, xfreerdp (or xfreerdp3). Everything else runs natively on the target (net, taskschd.msc, wf.msc, winver, Explorer, Event Viewer, Notepad).

Access: RDP as Administrator. No exploitation. Every step is read-only enumeration on the target.

0. Access

Run in a terminal and leave open.

bash

sudo openvpn ~/Downloads/<VPN_CONFIG>.ovpn

Prompts for your sudo password. Wait for Initialization Sequence Completed before continuing, and confirm "Connected" on the THM access page.

Start the machine on the room page and wait for the IP to appear. The box does not answer ICMP and takes a few minutes to boot so do not treat silence as failure.

bash

xfreerdp /v:TARGET_IP /u:Administrator /p:'<RDP_PASSWORD>' /dynamic-resolution +clipboard /cert:ignore

Single-quote the password so the shell does not interpret !. On current Kali the binary may be xfreerdp3.

Everything below runs on the target, inside the RDP session.

Task 1

Q1 Windows version and year

bash

Win+R  →  winver

Q2 Which user logged in last

bash

net user
net user Jenny
net user John
net user Administrator

Read the Last logon, Password last set, and Local Group Memberships fields.

Q3 When John last logged on

bash

net user John

Q4 IP the system connects to at startup

The IP is displayed on the terminal window immediately after you start the lab machine in the line Connecting to **.**.*.*...

Or:

bash

Win+R  →  regedit  →  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Read the autostart command's arguments (PsExec-style invocation) for the destination IP.

Q5 Accounts with administrative privileges

bash

net localgroup administrators

Q6 Name of the malicious scheduled task

bash

Win+R  →  taskschd.msc  →  Task Scheduler Library

Inspect each non-platform task, then read its configured command:

bash

Task Scheduler → select the task → Actions tab

Candidates to inspect: check logged in, Clean file system, falshupdate22, update windows. Ignore the two Amazon Ec2 Launch entries, npcapwatchdog, BADR, and BadrClient (platform / lab agents).

Q7 File the task ran daily

Read the Start a program action of Clean file system. Optionally open the script to identify it:

bash

notepad C:\TMP\nc.ps1

.ps1 files are associated with Notepad by default, so running the task opens the script rather than executing it. The script is a copy of powercat (https://github.com/besimorhino/powercat) identify it by its function powercat first line and embedded help text.

Q8 Port the file listened on

Read the argument after -l in the task's action line. In powercat's parameter block -l is the Listen switch and the bare number binds positionally to -p / Port.

Q9 When Jenny last logged on

bash

net user Jenny

Q10 Date of the compromise

bash

Explorer → This PC → Local Disk (C:)
Explorer → This PC → Local Disk (C:) → TMP

Sort by Date modified. C:\TMP is not a standard Windows directory the baseline at root is PerfLogs, Program Files, Program Files (x86), Users, Windows.

Q11 First time Windows assigned special privileges to a new logon

bash

Win+R  →  eventvwr.msc  →  Windows Logs → Security

Filter to Event ID 4672 (Special Logon) and take the earliest entry inside the compromise window.

Q12 Tool used to get Windows passwords

bash

Explorer → C:\TMP
notepad C:\TMP\mim-out.txt

Identify by the binary name and the format of its paired output file.

Q13 Attacker's external C2 IP

bash

notepad C:\Windows\System32\drivers\etc\hosts

A clean Server 2016 hosts file is comments only every uncommented line is a modification. Look for the entry pointing a well-known public hostname at routable (non-RFC1918) space.

Q14 Extension of the shell uploaded via the website

bash

Explorer → C:\inetpub\wwwroot

Sort by Date modified and look for the file dropped inside the compromise window.

Q15 Last port the attacker opened

bash

Win+R  →  wf.msc  →  Inbound Rules

Sort by name/creation and look for rules with an empty Group field, a prose justification-style name, and Program: Any + Remote Address: Any.

Q16 DNS poisoning target

bash

notepad C:\Windows\System32\drivers\etc\hosts

Same file as Q13 read the hostname on the poisoned line, not the IP.

← all writeups next writeup →