-
Notifications
You must be signed in to change notification settings - Fork 0
/
index.html
4333 lines (4184 loc) · 204 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="keywords" content="HHC, Holiday Hack Challenge, 2019, writeup, SANS">
<link rel="stylesheet" href="css/sans_19.css">
<script src="https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/run_prettify.js"></script>
<title>Holiday Hack Challenge 2019</title>
</head>
<body>
<div id="toc">
<h2>Table of Contents</h2>
<h3><a href="#intro">Introduction</a></h3>
<h3><a href="#obj01">Objective 1</a></h3>
<ul>
<li><a href="#obj01">Turtle Doves</a></li>
</ul>
<h3><a href="#obj02">Objective 2</a></h3>
<ul>
<li><a href="#obj02">Unredact Threatening Document</a></li>
</ul>
<h3><a href="#obj03">Objective 3</a></h3>
<ul>
<li><a href="#obj03_1">Bushy Evergreen</a></li>
<li><a href="#obj03_2">Evaluate Attack Outcome</a></li>
</ul>
<h3><a href="#obj04">Objective 4</a></h3>
<ul>
<li><a href="#obj04_1">Sugarplum Mary</a></li>
<li><a href="#obj04_2">Determine Attacker Technique</a></li>
</ul>
<h3><a href="#obj05">Objective 5</a></h3>
<ul>
<li><a href="#obj05_1">Sparkle Redberry</a></li>
<li><a href="#obj05_2">Determine Compromised System</a></li>
</ul>
<h3><a href="#obj06">Objective 6</a></h3>
<ul>
<li><a href="#obj06">Prof. Banas: Splunk</a></li>
</ul>
<h3><a href="#obj07">Objective 7</a></h3>
<ul>
<li><a href="#obj07_1">Access Dorms</a></li>
<li><a href="#obj07_2">Minty Candycane</a></li>
<li><a href="#obj07_3">Access Steam Tunnels</a></li>
</ul>
<h3><a href="#obj08">Objective 8</a></h3>
<ul>
<li><a href="#obj08_1">Alabaster Snowball</a></li>
<li><a href="#obj08_2">Bypass Frido Sleigh CAPTEHA</a></li>
</ul>
<h3><a href="#obj09">Objective 9</a></h3>
<ul>
<li><a href="#obj09_1">Pepper Minstix</a></li>
<li><a href="#obj09_2">Retrieve Scraps from Server</a></li>
</ul>
<h3><a href="#obj10">Objective 10</a></h3>
<ul>
<li><a href="#obj10_1">Holly Evergreen</a></li>
<li><a href="#obj10_2">Recover Cleartext Document</a></li>
</ul>
<h3><a href="#obj11">Objective 11</a></h3>
<ul>
<li><a href="#obj11_1">Kent Tinseltooth</a></li>
<li><a href="#obj11_2">Open Sleigh Shop Door</a></li>
</ul>
<h3><a href="#obj12">Objective 12</a></h3>
<ul>
<li><a href="#obj12_1">Wunorse Openslae</a></li>
<li><a href="#obj12_2">Filter Weather Data</a></li>
</ul>
<h3><a href="#epilogue">Epilogue</a></h3>
</div>
<div id="writeup">
<h1 style="text-align: center;" id="intro">Holiday Hack Challenge 2019</h1>
<div id="headline">
<div><img src="img/intro/avatar.png" height="250px"></div>
<div><img src="img/intro/elfu.png"></div>
<div style="margin-left: 40px;"><img src="img/intro/gobear.gif" height="150px"></div>
</div>
<h2 style="text-align: center;">KringleCon 2: Turtle Doves</h2>
<h2 style="text-align: center;">Writeup by Kumaus</h2>
<p>
Who can say no to an invitation to visit Santa at Elf University during KringleCon 2?
This is my first real attempt at a Holiday Hack Challenge, after some off-line
experimentation with the older challenges to learn the ropes (excellent resource!!!).
Bags were packed in a rush, I hopped on the famous North Pole train and arrived
after an arduous journey at ELFU railway station.
</p>
<div class="quote">
<div class="name">Santa:</div>
Welcome to the North Pole and KringleCon 2! <br>
Last year, KringleCon hosted over 17,500 attendees and my castle got a little crowded.
We moved the event to Elf University (Elf U for short), the North Pole’s largest venue.
Please feel free to explore, watch talks, and enjoy the con!
</div>
<p></p>
<img src="img/intro/me_and_Santa.png" class="centered">
<p>
After a warm welcome by Santa himself, I started having a hop around Elf University.
In the main quad, I bumped into Santa again, who had a matter of some urgency to discuss.
</p>
<div class="quote">
<div class="name">Santa:</div>
This is a little embarrassing, but I need your help.<br>
Our KringleCon turtle dove mascots are missing!<br>
They probably just wandered off. Can you please help find them?
To help you search for them and get acquainted with KringleCon, I’ve created some
objectives for you. You can see them in your badge.
Where's your badge? Oh! It's that big, circle emblem on your chest - give it a tap!
We made them in two flavors - one for our new guests, and one for those
who've attended both KringleCons. <br>
After you find the Turtle Doves and complete
objectives 2-5, please come back and let me know. Not sure where to start?
Try hopping around campus and talking to some elves. If you help my elves with
some quicker problems, they'll probably remember clues for the objectives.
</div>
<p>
This is the beginning of a long wild dove chase ...
</p>
<img src="img/intro/map.PNG" class="centered" width="900px">
<p>
The map shows a rough representation of ELFU campus and where the elves can be found.
Red passages are not open initially and require something to be done. The gray pathways
are the fast underground steam tunnel links which become available after helping
Krampus get his lifetime cookie supply in objective 8.
</p>
<div class="note">
After the event, I added notes such as this
one to indicate improvements and further insights taken from Andy Smith's excellent
<a href="https://www.youtube.com/watch?v=M0_E4Iaj-v4&list=PLoEpvlpUwwkY3j0GzACuudBuhLNi8XW4B&index=1">
video walkthrough</a>.
</div>
<h2 id="obj01">Objective 1: Turtle Doves</h2>
<div class="objective">
Find the missing turtle doves.
</div>
<p>
After wandering around the university for a littl ewhile trying to get my bearing,
I naturally ended up in the Student Union for a beer and a warm fire. To my great
disappointment, beer was not available, just T-shirts, Splunk, Google and a strange booth
labelled SANS. Sans beer, je pense ... but at least there was a fireplace. And next to
the roaring fire, the two missing turtle doves were sitting, enjoying themselves.
Great sense, actually, finding a cozy place instead of freezing their feet next to
Santa in the arctic quad. I can really understand why they ran away. Got to break it
to Santa now.
</p>
<img src="img/obj_01/turtle_doves.png" class="centered">
<h2 id="obj02">Objective 2: Unredact Threatening Document</h2>
<div class="objective">
Difficulty:1<br>
Someone sent a threatening letter to Elf University.
What is the first word in ALL CAPS in the subject line
of the letter? Please find the letter in the Quad.
</div>
<p>
The letter is hidden behind a tree in the upper left corner of the quad (I know "upper"
sounds completely wrong, but one can hardly say northwestern corner ... after all this is
the north pole).
</p>
<div style="text-align: center;">
<img src="img/obj_02/letter.png" height="250px">
<img src="img/obj_02/redacted.png" height="270px">
</div>
<p>
The letter was poorly redacted by placing a graphic as a layer above it, making the
text invisible. With proper PDF manipulation tools one can remove the obstructing
images. But the simplest way is to save the document as text
(File → Save as other → Text in the Acrobat Reader).
</p>
<pre>
Date: February 28, 2019
To the Administration, Faculty, and Staff of Elf University
17 Christmas Tree Lane
North Pole
From: A Concerned and Aggrieved Character
Subject: DEMAND: Spread Holiday Cheer to Other Holidays and Mythical Characters… OR
ELSE!
Confidential
Attention All Elf University Personnel,
It remains a constant source of frustration that Elf University and the entire operation at the
North Pole focuses exclusively on Mr. S. Claus and his year-end holiday spree. We URGE
you to consider lending your considerable resources and expertise in providing merriment,
cheer, toys, candy, and much more to other holidays year-round, as well as to other mythical
characters.
For centuries, we have expressed our frustration at your lack of willingness to spread your
cheer beyond the inaptly-called “Holiday Season.” There are many other perfectly fine
holidays and mythical characters that need your direct support year-round.
Confidential
If you do not accede to our demands, we will be forced to take matters into our own hands.
We do not make this threat lightly. You have less than six months to act demonstrably.
Sincerely,
--A Concerned and Aggrieved Character
</pre>
<div class="answer"><b>Answer</b>: DEMAND</div>
<h2 id="obj03">Objective 3: Windows Log Analysis - Evaluate Attack Outcome</h2 id="obj03">
<div class="objective">
Difficulty:1<br>
We're seeing attacks against the Elf U domain! Using
<a href="https://downloads.elfu.org/Security.evtx.zip">the event log data</a>,
identify the user account that the attacker compromised using a password
spray attack.
<em>
Bushy Evergreen is hanging out in the train station and may
be able to help you out.
</em>
</div>
<h3 id="obj03_1">I) Help Bushy Evergreen</h3>
<div class="terminal">
<img src="img/obj_03/bushy_solve.png">
</div>
<div class="quote">
<div class="name">Bushy Evergreen:</div>
Hi, I'm Bushy Evergreen. Welcome to Elf U!
I'm glad you're here. I'm the target of a terrible trick.
Pepper Minstix is at it again, sticking me in a text editor.
Pepper is forcing me to learn ed.
Even the hint is ugly. Why can't I just use Gedit?
Please help me just quit the grinchy thing.
</div>
<div class="hint">
⟶
<a href="http://cs.wellesley.edu/~cs249/Resources/ed_is_the_standard_text_editor.html">ed Editor Basics</a>
</div>
<p>
Truth be told, I had completely forgotten about ed and the terrible mess one can
get into while trying to escape the thing. To help Bushy and get out, simply enter "q"
to quit or "wq" to write and quit.
</p>
<div class="quote">
<div class="name">Bushy Evergreen:</div>
Wow, that was much easier than I'd thought.
Maybe I don't need a clunky GUI after all!
Have you taken a look at the password spray attack artifacts?
I'll bet that DeepBlueCLI tool is helpful.
You can check it out on GitHub.
</div>
<div class="hint">
⟶
<a href="https://www.ericconrad.com/2016/09/deepbluecli-powershell-module-for-hunt.html">Eric Conrad on DeepBlueCLI</a>
</div>
<div class="hint">
⟶
<a href="https://github.com/sans-blue-team/DeepBlueCLI">Github page for DeepBlueCLI</a>
</div>
<h3 id="obj03_2">II) Windows Log Analysis - Evaluate Attack Outcome</h3>
<p>
We are looking for evidence of a <b>password spray attack</b>, which can be defined
as <em>applying the same password to multiple user accounts in an organization to
secure unauthorized access to one of those accounts.</em> As evidence we are given
a file <b>Security.evtx</b> containing security channel event logs from Windows:
privilege allocations, login, logoff, etc.
For some background on Windows event logging and .evtx files, here is a
<a href="https://www.sans.org/reading-room/whitepapers/logging/evtx-windows-event-logging-32949">paper by Brandon Charter</a>
on the topic.
</p>
<p>
Security.evtx can be opened directly with the Windows Event Viewer,
which can show individual logs and do basic filtering, but the analysis is quite
unpleasant. <b>DeepBlueCLI</b> is a command line tool which correlates the events
and draws conclusions. Invoking it on Security.evtx gives following output:
</p>
<pre>
Date : 19.11.2019 13:22:46
Log : Security
EventID : 4648
Message : Distributed Account Explicit Credential Use (<mark>Password Spray Attack</mark>)
Results : The use of multiple user account access attempts with explicit credentials is an indicator of a password spray attack.
Target Usernames: ygoldentrifle esparklesleigh hevergreen Administrator sgreenbells cjinglebuns tcandybaubles bbrandyleaves bevergreen
lstripyleaves gchocolatewine wopenslae ltrufflefig supatree mstripysleigh pbrandyberry civysparkles sscarletpie ftwinklestockings
cstripyfluff gcandyfluff smullingfluff hcandysnaps mbrandybells twinterfig civypears ygreenpie ftinseltoes smary ttinselbubbles
dsparkleleaves
Accessing Username: -
Accessing Host Name: -
[... 11 more]
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : Multiple admin logons for one account
Results : Username: pminstix
User SID Access Count: 2
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : Multiple admin logons for one account
Results : Username: DC1$
User SID Access Count: 12
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : <mark>Multiple admin logons for one account</mark>
Results : Username: <mark>supatree</mark>
User SID Access Count: 2
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : High number of logon failures for one account
Results : Username: ygoldentrifle
Total logon failures: <mark>77</mark>
[... 29 more]
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : High number of logon failures for one account
Results : Username: <mark>supatree</mark>
Total logon failures: <mark>76</mark>
Date : 24.08.2019 02:00:20
Log : Security
EventID : 4672
Message : High number of total logon failures for multiple accounts
Results : Total accounts: <mark>31</mark>
Total logon failures: 2386
</pre>
<p>
The analysis shows that a password spray attack has definitely taken place, and
that 31 accounts were affected. User supatree shows 76 failures and two
successful admin logons, whereas all others show 77 failures. This makes
it very likely that the <b>supatree</b> account was compromised. The other
elf with admin logons, pminstix, did not appear in the password spray attack.
</p>
<div class="answer"><b>Answer</b>: supatree</div>
<h2 id="obj04">Objective 4: Windows Log Analysis - Determine Attacker Technique</h2 id="obj04">
<div class="objective">
Difficulty:2<br>
Using <a href="https://downloads.elfu.org/sysmon-data.json.zip">these normalized Sysmon logs</a>,
identify the tool the attacker used to retrieve domain password hashes
from the lsass.exe process.
<em>
For hints on achieving this objective,
please visit Hermey Hall and talk with SugarPlum Mary.
</em>
</div>
<h3 id="obj04_1">I) Help SugarPlum Mary</h3>
<img src="img/obj_04/sugarplum_terminal.png" style="float:right; width:500px; padding-left:10px;">
<div class="quote">
<div class="name">SugarPlum Mary:</div>
Oh me oh my - I need some help!<br>
I need to review some files in my Linux terminal, but I can't get a file listing.
I know the command is ls, but it's really acting up.
Do you think you could help me out? As you work on this,
think about these questions:
<ol>
<li>Do the words in green have special significance?</li>
<li>How can I find a file with a specific name?</li>
<li>What happens if there are multiple executables with the same name in my $PATH?</li>
</ol>
</div>
<div class="hint">
⟶
<div>
Linux Path: Green words matter, files must be found, and the terminal's $PATH matters.
</div>
</div>
<p>
The ls command is definitely acting up!<br>
The green words in the terminal are useful basic linux commands which may help
in the search for ls:
</p>
<table class="bordered">
<tr><td>file</td> <td>determine filetype</td> </tr>
<tr><td>home/</td> <td>path of user folders</td></tr>
<tr><td>which</td> <td>list filepath of command executabless</td></tr>
<tr><td>find</td> <td>search through folder hierarchy</td></tr>
<tr><td>path</td> <td>$PATH contains the search order of the shell</td></tr>
<tr><td>locate</td> <td>similar to find, may be faster</td></tr>
</table>
<pre>
elf@acc7e121d80e:~$ <span>which ls</span>
<mark>/usr/local/bin/ls</mark>
elf@acc7e121d80e:~$ <span>file /usr/local/bin/ls</span>
/usr/local/bin/ls: Bourne-Again shell script, ASCII text executable, with escape sequences
elf@acc7e121d80e:~$ <span>find / -name ls</span>
<mark>/usr/local/bin/ls</mark>
find: '/root': Permission denied
find: '/var/cache/apt/archives/partial': Permission denied
find: '/var/cache/ldconfig': Permission denied
find: '/var/lib/apt/lists/partial': Permission denied
<mark>/bin/ls</mark>
find: '/proc/tty/driver': Permission denied
find: '/proc/1/task/1/fd': Permission denied
find: '/proc/1/task/1/fdinfo': Permission denied
find: '/proc/1/task/1/ns': Permission denied
find: '/proc/1/fd': Permission denied
find: '/proc/1/map_files': Permission denied
find: '/proc/1/fdinfo': Permission denied
find: '/proc/1/ns': Permission denied
find: '/proc/6/task/6/fd': Permission denied
find: '/proc/6/task/6/fdinfo': Permission denied
find: '/proc/6/task/6/ns': Permission denied
find: '/proc/6/fd': Permission denied
find: '/proc/6/map_files': Permission denied
find: '/proc/6/fdinfo': Permission denied
find: '/proc/6/ns': Permission denied
find: '/etc/ssl/private': Permission denied
elf@acc7e121d80e:~$ <span>echo $PATH</span>
<mark>/usr/local/bin</mark>:/usr/bin:<mark>/bin</mark>:/usr/local/games:/usr/games
elf@1255f6dd0ad9:~$ <mark><span>/bin/ls</span></mark>
' ' rejected-elfu-logos.txt
Loading, please wait......
You did it! Congratulations!
</pre>
<p>
The commands <code>which</code> and <code>file</code> show that the shell
search path leads first to a shellscript named ls in <code>/usr/local/bin</code>.
This underlines just how important a sanitized <code>$PATH</code> is! The "real"
ls command can be determined using <code>find</code> if necessary, and invoking
it with the full path <code>/bin/ls</code> solves SugarPlums problem. As a bonus:
</p>
<img src="img/obj_04/elfu_logos.png" width="500px" class="centered">
<p>some rejected ELFU logos SugarPlum has been playing with can be gleaned.</p>
<div class="quote">
<div class="name">SugarPlum Mary:</div>
<div>
Oh there they are! Now I can delete them. Thanks! <br>
Have you tried the Sysmon and EQL challenge?
If you aren't familiar with Sysmon, Carlos Perez has some great info about it.
Haven't heard of the Event Query Language?
Check out some of <a href="https://www.endgame.com/our-experts/ross-wolf">Ross Wolf's work</a>
on EQL or that blog post by Josh Wright in your badge.
</div>
</div>
<div class="hint">
⟶
<a href="https://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon">Sysmon</a>
</div>
<div class="hint">
⟶
<a href="https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting/">Event Query Language</a>
</div>
<h3 id="obj04_2">II) Windows Log Analysis - Determine Attacker Technique</h3>
<p>
The hint on Event Query Language by SugarPlum Mary leads to an excellent explanation of
this powerful command line tool, complete with abundant example files. However, just to
solve the objective, all this is not really necessary. We are asked to identify a tool
used to get data from the lsass process, so I did a simple text search of sysmon-data.json
for <b>lsass.exe</b>. Only one record matched, with process ID 3440. The next record
timewise features a child process of this (ppid = 3440): <b>ntdsutil.exe</b>.
</p>
<pre>
{
"command_line": "C:\\Windows\\system32\\cmd.exe",
"event_type": "process",
"logon_id": 999,
"parent_process_name": "<mark>lsass.exe</mark>",
"parent_process_path": "C:\\Windows\\System32\\lsass.exe",
"pid": <mark>3440</mark>,
"ppid": 632,
"process_name": "cmd.exe",
"process_path": "C:\\Windows\\System32\\cmd.exe",
"subtype": "create",
"timestamp": 132186398356220000,
"unique_pid": "{7431d376-dedb-5dd3-0000-001027be4f00}",
"unique_ppid": "{7431d376-cd7f-5dd3-0000-001013920000}",
"user": "NT AUTHORITY\\SYSTEM",
"user_domain": "NT AUTHORITY",
"user_name": "SYSTEM"
},
{
"command_line": "ntdsutil.exe \"ac i ntds\" ifm \"create full c:\\hive\" q q",
"event_type": "process",
"logon_id": 999,
"parent_process_name": "cmd.exe",
"parent_process_path": "C:\\Windows\\System32\\cmd.exe",
"pid": 3556,
"ppid": <mark>3440</mark>,
"process_name": "ntdsutil.exe",
"process_path": "<mark>C:\\Windows\\System32\\ntdsutil.exe</mark>",
"subtype": "create",
"timestamp": 132186398470300000,
"unique_pid": "{7431d376-dee7-5dd3-0000-0010f0c44f00}",
"unique_ppid": "{7431d376-dedb-5dd3-0000-001027be4f00}",
"user": "NT AUTHORITY\\SYSTEM",
"user_domain": "NT AUTHORITY",
"user_name": "SYSTEM"
}</pre>
<p>
A nice explanation of how the command
<code>ntdsutil.exe "ac i ntds" ifm "create full c:\\hive\" q q</code> is used to
pull credentials can be found in <a href="https://adsecurity.org/?p=2398#CreateIFM">this blog</a>.
</p>
<div class="answer"><b>Answer</b>: ntdsutil</div>
<h2 id="obj05">Objective 5: Windows Log Analysis - Determine Compromised System</h2 id="obj05">
<div class="objective">
Difficulty:2<br>
The attacks don't stop! Can you help identify the IP address
of the malware-infected system using these
<a href="https://downloads.elfu.org/elfu-zeeklogs.zip">Zeek logs</a>?
<em>
For hints on achieving this objective, please visit the Laboratory
and talk with Sparkle Redberry.
</em>
</div>
<h3 id="obj05_1">I) Help Sparkle Redberry</h3>
<div class="terminal">
<img src="img/obj_05/laser.png">
<img src="img/obj_05/laser_api.png">
</div>
<div class="quote">
<div class="name">Sparkle Redberry:</div>
I'm Sparkle Redberry and Imma chargin' my laser!
Problem is: the settings are off.
Do you know any PowerShell?
It'd be GREAT if you could hop in and recalibrate this thing.
It spreads holiday cheer across the Earth ...<br>
... when it's working!
</div>
<div class="hint">
⟶
<a href="https://blogs.sans.org/pen-testing/files/2016/05/PowerShellCheatSheet_v41.pdf">PowerShell Cheat Sheet</a>
</div>
<p>
For me, this was easily the hardest elf terminal challenge. PowerShell is
a powerfull, but initially counterintuitive language which took some getting
used to. The cheat sheet provided in the hint was a huge help!
</p>
<p>
Starting with the calling card, a trail of hints leads to settings for
<b>angle</b>, <b>refraction</b>, <b>temperature</b> and <b>gas mixture</b>
in the laser API.
The calling card can be read by <code>Get-Content /home/callingcard.txt</code>:
</p>
<div class="framed">
What's become of your dear laser?<br>
Fa la la la la, la la la la<br>
Seems you can't now seem to raise her!<br>
Fa la la la la, la la la la<br>
Could commands hold riddles in hist'ry?<br>
Fa la la la la, la la la la<br>
Nay! You'll ever suffer myst'ry!<br>
Fa la la la la, la la la la
</div>
<pre>
PS /home/elf> <span>Get-History</span>
Id CommandLine
-- -----------
1 Get-Help -Name Get-Process
2 Get-Help -Name Get-*
3 Set-ExecutionPolicy Unrestricted
4 Get-Service | ConvertTo-HTML -Property Name, Status > C:\services.htm
5 Get-Service | Export-CSV c:\service.csv
6 Get-Service | Select-Object Name, Status | Export-CSV c:\service.csv
7 <mark>(Invoke-WebRequest http://127.0.0.1:1225/api/angle?val=65.5).RawContent</mark>
8 Get-EventLog -Log "Application"
9 I have many <mark>name=value variables</mark> that I share to applications system wide.
At a command I will reveal my secrets once you <mark>Get my Child Items</mark>.
</pre>
<p>
The command history spits out the first parameter, <b>angle = 65.5</b>, and also gives
the exact format required to feed the laser API (ignoring this cost me a lot of
time later). Id 9 contains a long line of text giving the next hint. Because
Get-History truncates long lines in its plain form, I used
<code>Get-History | Format-List CommandLine</code> to see everything (adapted
in the listing above). It is interesting that the command history also
includes <code>Get-Service</code> calls, trying to write the results to C:\.
However, <code>Get-Service</code> seems to be blocked on this terminal,
C:\ does not exist (unix file system) and *.csv cannot be found. Strange ...
a red herring maybe?
</p>
<p>
The line with ID 9 poses a riddle hinting at <b>environment variables</b>
(name=value pairs, shared with systemwide applications). In PowerShell, they
are kept in <code>Env:</code>, which functions as a kind of drive.
The second half of the riddle tells to access them via the command
<code>Get-ChildItem</code>, or <code>gci</code> in short:
</p>
<pre>
PS /home/elf> <span>gci Env:</span>
Name Value
---- -----
_ /bin/su
DOTNET_SYSTEM_GLOBALIZATION_I… false
HOME /home/elf
HOSTNAME 038aefb857b4
LANG en_US.UTF-8
LC_ALL en_US.UTF-8
LOGNAME elf
MAIL /var/mail/elf
PATH /opt/microsoft/powershell/6:/usr/local/sbin:/usr/local/bi…
PSModuleAnalysisCachePath /var/cache/microsoft/powershell/PSModuleAnalysisCache/Mod…
PSModulePath /home/elf/.local/share/powershell/Modules:/usr/local/shar…
PWD /home/elf
RESOURCE_ID fe859679-df0b-4c48-af66-a50bd92ede88
<mark>riddle</mark> Squeezed and compressed I am hidden away. Expand me from …
SHELL /home/elf/elf
SHLVL 1
TERM xterm
USER elf
userdomain laserterminal
USERDOMAIN laserterminal
username elf
USERNAME elf</pre>
<p>
The next riddle! To get the full line, use <code>Get-Content</code> or
<code>gc</code> in short:
</p>
<pre>
PS /home/elf> <span>gc Env:riddle</span>
Squeezed and compressed I am hidden away. Expand me from my prison and I will show
you the way. Recurse through all <mark>/etc</mark> and Sort on my <mark>LastWriteTime</mark> to reveal im the
newest of all.
</pre>
<p>
"squeezed and compressed" probably means an archive. To find the most recent item
in /etc and its subdirectories, several commands have to be linked by pipes:
</p>
<table class="bordered">
<tr><td><code>gci /etc -recurse</code></td><td>List /etc and all its subdirectories</td></tr>
<tr><td><code>| sort LastWriteTime -Descending</code></td><td>Sort by last writing time, most recent first</td></tr>
<tr><td><code>| select -First 1</code></td><td>Filter first item on list</td></tr>
</table>
<pre>
PS /home/elf> <span>gci /etc -recurse | sort LastWriteTime -Descending | select -First 1</span>
Directory: /etc/apt
Mode LastWriteTime Length Name
---- ------------- ------ ----
--r--- 1/9/20 1:19 PM 5662902 archive</pre>
<p>
leaving out error messages caused by missing access rights.
A powershell archive called archive, how nice. To expand it into
the home directory, use the command <code>Expand-Archive</code>.
The parameter <code>-PassThru</code> causes the archive contents to be printed.
</p>
<pre>
PS /home/elf> <span>Expand-Archive /etc/apt/archive -PassThru -DestinationPath .</span>
Directory: /home/elf
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 1/9/20 2:16 PM refraction
Directory: /home/elf/refraction
Mode LastWriteTime Length Name
---- ------------- ------ ----
------ 11/7/19 11:57 AM 134 <mark>riddle</mark>
------ 11/5/19 2:26 PM 5724384 <mark>runme.elf</mark></pre>
<p>
Trying to run <b>runme.elf</b> fails, and looking at the directory listing
shows why: execution privileges are not set (no privileges at all, actually).
But how to set them in PowerShell? Theoretically there is a command
<code>Set-Acl</code> to do this, but that is not recognized by the terminal.
Maybe luckily, because PowerShell access right management looks like an
advanced form of medieval torture. Not for the faint-hearted! Instead,
as I found out by trial and error, the terminal appears to accept the linux
<code>chmod</code> command! This does not really make sense, because chmod is
not listed as a PS alias (<code>Get-Alias</code>), and it certainly
does not work on my Win10 PowerShell.
</p>
<pre>
PS /home/elf/refraction> <span>./runme.elf</span>
<mark>Program 'runme.elf' failed to run</mark>: No such file or directoryAt line:1 char:1
+ ./runme.elf
+ ~~~~~~~~~~~.
At line:1 char:1
+ ./runme.elf
+ ~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
+ FullyQualifiedErrorId : NativeCommandFailed
PS /home/elf/refraction> <span>chmod 777 runme.elf</span>
PS /home/elf/refraction> <span>./runme.elf</span>
<mark>refraction?val=1.867</mark>
PS /home/elf/refraction> <span></span>gci .
Directory: /home/elf/refraction
Mode LastWriteTime Length Name
---- ------------- ------ ----
------ 11/7/19 11:57 AM 134 riddle
<mark>------</mark> 11/5/19 2:26 PM 5724384 runme.elf
PS /home/elf/refraction> <span>gc riddle</span>
Very <mark>shallow</mark> am I in the <mark>depths</mark> of your <mark>elf home</mark>. You can find my entity by
using my <mark>md5 identity</mark>:
25520151A320B5B0D21561F92C8F6224</pre>
<p>
After the chmod, a directory listing shows no change to permissions, but
running the file runme.elf magically works. Ours is not to question why,
ours is to do and help Santa. Lets take <b>refraction=1.867</b> and move on.
</p>
<p>
The next riddle clearly refers to the aptly named folder <b>depths</b> in
/home/elf. It is a monster! A deep tree of folders, with many different files.
I cheated a bit here, simply searched for files containing an equal sign
in the text, and got lucky:
</p>
<pre>
PS /home/elf> <span>gci depths -r -force | sls -pattern =</span>
depths/produce/thhy5hll.txt:1:temperature?val=-33.5</pre>
<p>
This command recursively (<code>-r</code>) lists the contents of depth and all its
subfolders, including hidden files (<code>-force</code>) just in case.
<code>sls</code> is shorthand for <code>Select-String</code>, which searches
for a pattern.
</p>
<p>
A more honest approach would have been to divine from the hint that target
is very shallow in the directory tree, i.e. at depth 1. A gci at depth 1
can be done by <code>gci depths | ForEach-Object {gci $_ -File}</code>,
where each folder within depths is listed (excluding all files in depths).
The results are subjected to a <code>Where-Object</code> condition (shorthand ?
or where) testing for the correct MD5 hash. Surprisingly, this works too:
</p>
<pre>
PS /home/elf> <span>gci depths | ForEach-Object {gci $_ -File}
| where {(Get-FileHash $_ -Algorithm MD5).Hash -eq '25520151A320B5B0D21561F92C8F6224'}</span>
Directory: /home/elf/depths/produce
Mode LastWriteTime Length Name
---- ------------- ------ ----
--r--- 11/18/19 7:53 PM 224 thhy5hll.txt
PS /home/elf> <span>gc ./depths/produce/thhy5hll.txt</span>
<mark>temperature?val=-33.5</mark>
I am one of many thousand similar txt's contained within the <mark>deepest of</mark>
<mark>/home/elf/depths</mark>. Finding me will give you the most strength but doing
so will require <mark>Piping all the FullName's</mark> to <mark>Sort Length</mark>.</pre>
<div class="note">
One could also forego the hint and do a full recursion, which is a little simpler:
<pre>
PS /home/elf> <span>dir *.txt -Recurse | Get-FileHash -Algorithm MD5
| where {$_.Hash -eq '25520151A320B5B0D21561F92C8F6224'} | Format-Table -Wrap</span></pre>
</div>
<p>
The third parameter is found: <b>temperature=-33.5</b>. And yet another hint,
leading into the deepest murky depths of depths. Starting from a recursive
listing of depths, the <b><code>FullName</code></b> property of each file
(including the complete path) is accessed by
<code>gci -Directory -r | select FullName</code>.
The <code>-ExpandProperty</code> parameter insures that the output is
just the FullName strings rather than file objects. Also, the recursion
is limited to directories in order to improve speed.
</p>
<pre>
PS /home/elf> <span>gci -Directory -r | select -ExpandProperty FullName
| sort length -descending | select -First 1</span>
/home/elf/depths/larger/cloud/behavior/beauty/enemy/produce/age/chair/unknown/escap
e/vote/long/writer/behind/ahead/thin/occasionally/explore/tape/wherever/practical/t
herefore/cool/plate/ice/play/truth/potatoes/beauty/fourth/careful/dawn/adult/either
/burn/end/accurate/rubbed/cake/main/she/threw/eager/trip/to/soon/think/fall/is/grea
test/become/accident/labor/sail/dropped/fox</pre>
<p>
Piping the resulting list of full path names to <code>sort</code> in order to
find the longest leads to a really huge folder path. This contains only a single
text file, <b>0jhj5xz6.txt</b>:
</p>
<pre>
Get <mark>process information</mark> to include <mark>Username</mark> identification.
Stop Process to show me you're skilled and in this order they must be <mark>killed</mark>:
bushy
alabaster
minty
holly
Do this for me and then you <mark>/shall/see</mark> .
</pre>
<p>
Currently, the folder <b>/shall</b> exists, but is empty. So let's
follow instructions, list all active processes including user name and
kill the sleeping elf processes in the desired order. After the gruesome
deed, the /shall folder is no longer empty:
</p>
<pre>
PS /home/elf> <span>gci /shall</span>
PS /home/elf> <span>Get-Process -IncludeUserName</span>
WS(M) CPU(s) Id UserName ProcessName
----- ------ -- -------- -----------
26.93 0.75 6 root CheerLaserServi
116.98 1.87 31 elf elf
3.55 0.03 1 root init
0.80 0.00 23 bushy sleep
0.82 0.00 26 alabaster sleep
0.71 0.00 27 minty sleep
0.86 0.00 29 holly sleep
3.49 0.00 30 root su
PS /home/elf> <span>Stop-Process -Id 23</span>
PS /home/elf> <span>Stop-Process -Id 26</span>
PS /home/elf> <span>Stop-Process -Id 27</span>
PS /home/elf> <span>Stop-Process -Id 29</span>
PS /home/elf> <span>gci /shall</span>
Directory: /shall
Mode LastWriteTime Length Name
---- ------------- ------ ----
--r--- 1/9/20 10:33 PM 149 see
PS /home/elf> <span>gc /shall/see</span>
Get the <mark>.xml children of /etc</mark> - an <mark>event log</mark> to be found. Group all .Id's
and the last thing will be in the <mark>Properties</mark> of the lonely <mark>unique event Id</mark>.</pre>
<p>
Oh goodie, another riddle! The <b>event log</b> is found by recursively
listing all elements in /etc with suffix .xml. Only a single file is found,
but that is large and ugly. XML operations is where PowerShell really
shines. After packing the file into a single variable and casting to XML,
the structure can be navigated elegantly (supposedly).
</p>
<pre>
PS /home/elf> <span>gci /etc -recurse -include *.xml</span>
Directory: /etc/systemd/system/timers.target.wants
Mode LastWriteTime Length Name
---- ------------- ------ ----
--r--- 11/18/19 7:53 PM 10006962 EventLog.xml
PS /home/elf> <span><mark>[xml]$ev</mark> = gc /etc/systemd/system/timers.target.wants/EventLog.xml</span>
PS /home/elf> <span>$ev</span>
Objs
----
Objs
PS /home/elf> <span>$ev.Objs</span>
Version xmlns Obj
------- ----- ---
1.1.0.1 http://schemas.microsoft.com/powershell/2004/04 {Obj, Obj, Obj, Obj…}
PS /home/elf> <span>$ev.Objs.Obj.Count</span>
1224</pre>
<p>
The EventLog is structured as an array of 1224 <b>Obj</b> event objects under a root <b>Objs</b>.
Each of these event objects has a huge InnerXml structure, which may vary between events.
As an example, the first two levels of the first event are
</p>
<pre class="prettyprint lang-xml">
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0">
<TN RefId="0">
<T>System.Diagnostics.Eventing.Reader.EventLogRecord</T>
<T>System.Diagnostics.Eventing.Reader.EventRecord</T>
<T>System.Object</T>
</TN>
<ToString>System.Diagnostics.Eventing.Reader.EventLogRecord</ToString>
<Props>
<mark><I32 N="Id">3</I32></mark>
<By N="Version">5</By>
<Nil N="Qualifiers" />
<By N="Level">4</By>
<I32 N="Task">3</I32>
<I16 N="Opcode">0</I16>
<I64 N="Keywords">-9223372036854775808</I64>
<I64 N="RecordId">2194</I64>
<S N="ProviderName">Microsoft-Windows-Sysmon</S>
<G N="ProviderId">5770385f-c22a-43e0-bf4c-06f5698ffbd9</G>
<S N="LogName">Microsoft-Windows-Sysmon/Operational</S>
<I32 N="ProcessId">1960</I32>
<I32 N="ThreadId">6648</I32>
<S N="MachineName">elfuresearch</S>
<Obj N="UserId" RefId="1">
...
</Obj>
<DT N="TimeCreated">2019-11-07T09:51:22.6559745-08:00</DT>
<Nil N="ActivityId" />
<Nil N="RelatedActivityId" />
<S N="ContainerLog">microsoft-windows-sysmon/operational</S>
<Obj N="MatchedQueryIds" RefId="2">
...
</Obj>
<Obj N="Bookmark" RefId="3">
...
</Obj>
<S N="LevelDisplayName">Information</S>
<S N="OpcodeDisplayName">Info</S>
<S N="TaskDisplayName">Network connection detected (rule: NetworkConnect)</S>
<Obj N="KeywordsDisplayNames" RefId="4">
...
</Obj>
<mark><Obj N="Properties" RefId="5"></mark>
...
</Obj>
</Props>
<MS>
<S N="Message">Network connection detected:...[snip]...DestinationPortName: ntp</S>
</MS>
</Obj>
...
</Objs></pre>
<p>
According to the hint, the events should be grouped by <b>event ID</b>, which is
located in <code>$ev.Objs.Obj.Props</code> under the tag <code><I32 N="Id"></code>.
So, we select all I32 children with attribute N="Id", and group by element value.
The only unique event ID turns out to be 1. To get the associated event properties,
I selected the event ID tag, moved to the parent node and assigned the child Obj
with N="Properties" to a new variable.
</p>
<pre>
PS /home/elf> <span>$ev.Objs.Obj.Props.I32 | ? N -eq "Id" | group "#text"</span>
Count Name Group
----- ---- -----
<mark>1 1 {I32}</mark>
39 2 {I32, I32, I32, I32…}
179 3 {I32, I32, I32, I32…}
2 4 {I32, I32}
905 5 {I32, I32, I32, I32…}
98 6 {I32, I32, I32, I32…}
PS /home/elf> <span><mark>$unique</mark> = ($ev.objs.Obj.Props.I32 | ? N -eq "Id" | ? "#text" -eq 1).ParentNode.Obj |? N -eq "Properties"</span></pre>
<p>
The event properties are essentially a list of 22 objects with different RefId.
I was not able to find a way to prettyprint this within the terminal, so I
extracted <code>$unique.InnerXml</code> and sent it to an online service.
The object with RefId="1806" turns out to be the one:
</p>
<pre class="prettyprint" lang-xml>
<Obj RefId="18016">
<TNRef RefId="1806" />
<ToString>
System.Diagnostics.Eventing.Reader.EventProperty
</ToString>
<Props>
<S N="Value">
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c
"`<mark>$correct_gases_postbody</mark> = @{`n O=6`n H=7`n He=3`n
N=4`n Ne=22`n Ar=11`n Xe=10`n F=20`n Kr=8`n Rn=9`n}`n"
</S>
</Props>
</Obj></pre>
<div class="note"> A more direct approach would be to use Select-String to
extract all 32 bit integer field with name Id from the logs, and then to group them in order
to find out how many of each type there are. This outputs a table similar to the one above.
Once the correct Id is found, Select-String with the Context argument can be used to examine
the entire event (guessing 10 lines before to 200 lines after the match). The gas mixture can
be found simply by inspection.
<pre>
PS /home/elf> <span>Select-String -Path ./EventLog.xml -Pattern '<I32 n="Id">' | Group-Object -Property Line</span>
PS /home/elf> <span>Select-String -Path ./EventLog.xml -Pattern '<I32 n="Id">1</I32>' -Context 10,200</span> </pre>
</div>
<P>The laser settings are now finally complete:</P>
<table class="bordered">
<tr><td>temperature:</td><td>-33.5</td></tr>
<tr><td>angle:</td><td>65.5</td></tr>
<tr><td>refraction:</td><td>1.867</td></tr>
<tr><td>gases:</td><td>O=6, H=7, He=3, N=4, Ne=22, Ar=11, Xe=10, F=20, Kr=8, Rn=9</td></tr>
</table>
<p>
The final step is to write them to the laser API, which is described
under the link given on the introduction screen:
<code>(Invoke-WebRequest -Uri http://localhost:1225/).RawContent</code>
The following sequence of WebRequests worked for me:
</p>
<pre>
$gases = @{O=6; H=7; He=3; N=4; Ne=22; Ar=11; Xe=10; F=20; Kr=8; Rn=9}
Invoke-WebRequest -Uri http://localhost:1225/api/off
Invoke-WebRequest -Uri http://localhost:1225/api/refraction?val=1.867
Invoke-WebRequest -Uri http://localhost:1225/api/temperature?val=-33.5
Invoke-WebRequest -Uri http://localhost:1225/api/angle?val=65.5
Invoke-WebRequest -Uri http://localhost:1225/api/gas -Method POST -Body $gases
Invoke-WebRequest -Uri http://localhost:1225/api/on
(Invoke-WebRequest -Uri http://localhost:1225/api/output).<mark>RawContent</mark></pre>
<img src="img/obj_05/success.png" class="centered">
<p>
There was a very nasty pitfall / bug at this point which cost me several days:
The success message also comes up in the API if the final WebRequest is sent
without the RawContent property. But for no apparent reason, Sparkle Redberry
does not take note, the achievement does not register and no further hints are forthcoming.
All the RawContent property does is include the HTTP header information in the
response, but it turns out to be essential in the output WebRequest. The only
hint to use RawContent appeared in the history list right in the beginning, where
the angle parameter was found.
</p>
<div class="quote">
<div class="name">Sparkle Redberry:</div>
You got it - three cheers for cheer!<br>
For objective 5, have you taken a look at our Zeek logs?
Something's gone wrong. <br>But I hear someone named Rita can help us.
Can you and she figure out what happened?
</div>
<div class="hint">
⟶
<a href="https://www.activecountermeasures.com/free-tools/rita/">RITA</a>
</div>
<h3 id="obj05_2">II) Windows Log Analysis - Determine Compromised System</h3>
<p>
<a href="https://en.wikipedia.org/wiki/Zeek">Zeek</a> is a network analysis framework
which generates events when "something happens". We are given a folder with 900 logs
on diverse network topics, most of them large and detailled. A full list of log types can
be found <a href="https://docs.zeek.org/en/stable/script-reference/log-files.html">here</a>.
To analyse all this, the previous hint by Sparkle Redberry indicated RITA, an
open-source framework for network traffic analysis. Luckily, the RITA analysis has
already been done by friendly elves and been placed in the Zeek log folder, saving me
the hassle of installing RITA. The
<a href="https://www.activecountermeasures.com/free-tools/rita/">homepage</a>
contains several videos explaining how to use the analysis.
</p>
<img src="img/obj_05/rita_beacons.png" width="100%">
<p>
We are looking for a beacon, i.e. a system opening outside connections very frequently.