AOC23 | Days 13-18

CHALLENGE INFORMATION

Platform: TryHackMe
Event: Advent of Cyber 2023
Days: 13-18

Day-13

To the Pots, Through the Walls

Storyline

Following a proposed merger and a series of suspicious activities, McHoneyBell and The B Team are tasked with improving the defensive security posture of the Best Festival Company. As security researchers on the team, our objective is to investigate proactive security measures and mitigation strategies to safeguard the company’s systems against future malicious attacks.

Overview

The Best Festival Company and AntarctiCrafts are dealing with security breaches caused by a suspected insider threat. We are tasked with helping the company transition from a victim to a defender by utilizing the Diamond Model of Intrusion Analysis to profile the adversary, identify their infrastructure and capabilities, and implement proactive defensive measures.

This challenge introduces the Diamond Model and defensive security infrastructure. We explore the four facets of the model – adversary, victim, infrastructure, and capability – and learn how to counter threats using threat hunting and vulnerability management. The technical focus is on deploying defensive tools, specifically firewalls and honeypots:

Firewalls

Honeypots

The ultimate goal is to apply these configurations to expose a hidden website and retrieve a flag by modifying firewall rules via a provided script.

Questions and Answers

Question-1: Which security model is being used to analyse the breach and defence strategies?

diamond model

# Connection
# username:
vantwinkle
# password:
TwinkleStar

# Firewall configuration
# on the host running the webserver

# check the `uncomplicated firewall` status
sudo ufw status 

# set the default policies
sudo ufw default allow outgoing
sudo ufw default deny incoming

# add firewall rule with port number and protocol
sudo ufw allow 22/tcp

# deny a particular ip address
sudo ufw deny from 192.168.100.25

# deny a particula ip address coupled with an interface
sudo ufw deny in on eth0 from 192.168.100.26

# enable the service
sudo ufw enable

# check/verify the status
sudo ufw status verbose

# reset the changes
sudo ufw reset

# Honeypot configuration
pentbox-1.8

# Honeypot installation with PenTBox
sudo ./pentbox.rb

# Menu select > 2 (Network tools)
# Menu select > 3 (Honeypot)
# Menu select > 2 (Manual Configuration)
# Menu select > 8080 (Port to OPEN)
# Menu select > "Santa has gone for the Holidays. Tough luck." (false message to show)
# ...

# check from lhost if page is online > request is shown and alert is triggered on the server

Question-2: Which defence capability is used to actively search for signs of malicious activity?

threat hunting

Question-3: What are our main two infrastructure focuses? (Answer format: answer1 and answer2)

firewall and honeypot

Question-4: Which firewall command is used to block traffic?

deny

Question-5: There is a flag in one of the stories. Can you find it?

THM{<redacted-flag>}

Question-6: If you enjoyed this task, feel free to check out the Network Device Hardening room.

No answer needed

Day-14

The Little Machine That Wanted to Learn

Storyline

The CTO has sabotaged the toy-making pipeline by infecting key elves, resulting in the production of defective toys. To resolve this, McSkidy has introduced control elves to measure and compare the toys to isolate the source of the problem. Because this manual comparison is inefficient, the objective is to implement machine learning to optimize the detection of the problematic elves.

Overview

This challenge introduces the fundamentals of machine learning by tasking us with creating a neural network to detect defective toys in a production pipeline. We learn the differences between various ML structures, focusing specifically on neural networks and supervised learning, where a labeled dataset is used to guide the model toward correct answers.

We also explore the internal architecture of a network – including input, hidden, and output layers – and the two-step process of training: the feed-forward loop for generating predictions and back-propagation for updating weights based on error margins.

To prevent overtraining, we apply dataset splitting, dividing data into training, validation, and testing sets to ensure the model learns general principles rather than simply memorizing answers.

To implement the solution, we use a Python script with libraries such as NumPy, Pandas, and Scikit-learn. We begin by loading the toy datasets and encoding categorical data, such as color schemes, into integers. We then split the data, normalize the features using a standard scaler to ensure consistent input ranges, and initialize a Multi-Layer Perceptron (MLP) classifier.

After training the model on the training set and validating its accuracy against the validation set, we use the trained network to predict defects in a separate, unlabeled testing dataset. The final goal is to achieve a prediction accuracy of over 90% to secure the flag.

Questions and Answers

Question-1: What is the other term given for Artificial Intelligence or the subset of AI meant to teach computers how humans think or nature works?

machine learning

Question-2: What ML structure aims to mimic the process of natural selection and evolution?

genetic algorithm

Question-3: What is the name of the learning style that makes use of labelled data to train an ML structure?

supervised learning

Question-4: What is the name of the layer between the Input and Output layers of a Neural Network?

hidden layer

Question-5: What is the name of the process used to provide feedback to the Neural Network on how close its prediction was?

back-propagation

Question-6: What is the value of the flag you received after achieving more than 90% accuracy on your submitted predictions?

THM{<redacted-flag>}

Question-7: If you enjoyed this room, we invite you to join our Discord server (opens in new tab) for ongoing support, exclusive tips, and a community of peers to enhance your Advent of Cyber experience!

No answer needed

Day-15

Jingle Bell SPAM: Machine Learning Saves the Day!

Storyline

Employees at Best Festival Company are being targeted by a surge of phishing emails designed to steal credentials, suggesting that the existing spam detector was intentionally sabotaged, possibly by an employee named McGreedy. To resolve this, we must assist McSkidy in developing a new spam email detector using machine learning, utilizing a provided sample dataset to train the model.

Overview

This challenge demonstrates how to build a spam email detection model using a Machine Learning pipeline within a Jupyter Notebook environment. We will follow a structured process to transform raw text data into a predictive model, ultimately classifying emails as either spam or ham.

To achieve this, we first collect a dataset of emails and preprocess the text using CountVectorizer, which converts words into a numerical token count matrix that a model can understand.

We then split this data into training and testing sets to ensure the model can be validated on unseen data. For the classification task, we employ a Multinomial Naive Bayes classifier, which determines the probability of an email being spam based on the frequency of specific keywords.

Finally, we evaluate the model’s performance using a classification report to analyze precision, recall, and accuracy before testing the model against a set of new emails to verify its real-world effectiveness.

Questions and Answers

Question-1: What is the key first step in the Machine Learning pipeline?

data collection

Question-2: Which data preprocessing feature is used to create new features or modify existing ones to improve model performance?

feature engineering

Question-3: During the data splitting step, 20% of the dataset was split for testing. What is the percentage weightage avg of precision of spam detection?

0.98

Question-4: How many of the test emails are marked as spam?

3

Question-5: One of the emails that is detected as spam contains a secret code. What is the code?

I_HaTe_BesT_FestiVal

Question-6: If you enjoyed this room, please check out the Phishing module.

No answer needed

Day-16

Can’t CAPTCHA this Machine!

Storyline

McGreedy has locked McSkidy out of the Elf(TM) HQ admin panel and implemented a CAPTCHA on the login page to block automated brute force attacks. To regain access, we must help McSkidy develop a custom brute force script that integrates machine learning to automatically solve the CAPTCHA challenges, allowing the automated attack to proceed.

Overview

This challenge demonstrates how red teams can leverage Machine Learning (ML) to bypass security controls, specifically by cracking CAPTCHAs to facilitate a brute force attack on an admin portal. We learn that Convolutional Neural Networks (CNNs) are ideal for this task because they can automatically extract important features from image data through a process of convolution (summarizing the image) and pooling (statistical reduction). These features are then processed through fully connected layers to classify the image into a specific character.

To achieve the objective, we follow these technical steps:

The ultimate result is a highly accurate, task-specific CAPTCHA-cracking engine that allows us to successfully brute force the admin credentials and regain access to the HQ admin portal.

Practical

# start a Docker container that has TensorFlow and AOCR already installed for you
docker run -d -v /tmp/data:/tempdir/ aocr/full

# get the container's id
docker ps

# connect to the container
docker exec -it CONTAINER_ID /bin/bash

# go to the ocr dir
cd /ocr/

# -------------------------------------------

# get the raw image from the url
curl http://hqadmin.thm:8000/

# ... parsing, mapping stuff

# create a dataset for a tensorflow record that can be used for training
aocr dataset ./labels/training.txt ./training.tfrecords

# training the model
cd labels && aocr train training.tfrecords

# test the model
aocr test testing.tfrecords

# -------------------------------------------

# hosting the model -- export

# export the trained model from the docker container
cd /ocr/ && cp -r model /tempdir/

# exit the docker
exit

# get the container id
docker ps

# kill the container
docker kill CONTAINER_ID

# run TensorFlow Serving in a Docker container
# start the Serving container
docker run -t --rm -p 8501:8501 -v /tmp/data/model/exported-model:/models/ -e MODEL_NAME=ocr tensorflow/serving
# you can connect to the model through the API hosted on: http://localhost:8501/v1/models/ocr/

# -------------------------------------------

# Brute forcing the admin panel
cd ~/Desktop/bruteforcer && python3 bruteforce.py

Questions and Answers

Question-1: What key process of training a neural network is taken care of by using a CNN?

Feature Extraction

Question-2: What is the name of the process used in the CNN to extract the features?

Convolution

Question-3: What is the name of the process used to reduce the features down?

pooling

Question-4: What off-the-shelf CNN did we use to train a CAPTCHA-cracking OCR model?

Attention OCR

Question-5: What is the password that McGreedy set on the HQ Admin portal?

ReallyNotGonnaGuessThis

Question-6: What is the value of the flag that you receive when you successfully authenticate to the HQ Admin portal?

THM{<redacted-flag>}

Question-7: If you enjoyed this room, check out our Red Teaming learning path!

No answer needed

Day-17

I Tawt I Taw A C2 Tat!

Storyline

Following a series of diverse security events – including prompt injection, malware analysis, and machine learning attacks – the Santa Security Operations Centre (SSOC) must now synthesize these anomalies to identify the broader scope of the breach. To establish an investigation timeline and define the boundaries of the incident, we focus on network traffic statistics. By analyzing network load and data transfer patterns, we aim to create a hypothesis and gain a high-level overview of the ongoing attack.

Overview

The SSOC team is tasked with analyzing network traffic to identify anomalies and threats. We are tasked with supporting the team by processing network flow data to provide rapid statistical insights for an investigator named McSkidy. The objective is to identify suspicious communication patterns, such as potential Command and Control (C2) channels and Denial of Service (DoS) attacks, without the resource-heavy requirement of full packet captures.

We use the SiLK (System for Internet Level Knowledge) suite to analyze binary flow files. We begin by using rwfileinfo to examine file metadata and rwcut to filter and read specific flow records.

To identify high-level anomalies, we employ rwstats to find top talkers and frequently used ports. We refine our search using rwfilter to isolate traffic on specific ports, such as DNS (port 53) and HTTP (port 80), piping the results into rwstats and rwcut to analyze request frequency and TCP flags.

Through this process, we identify two major security events:

C2 over DNS

SYN Flood Attack

Practical

# binary flow at /home/ubuntu/Desktop/suspicious-flows.silk

# check the SiLK version
silk_config -v

# display the flow file properties
rwfileinfo suspicious-flows.silk

# reading the flow files -- `rwcut` reads binary flow records and prints those selected by the user
# display the first five record lines
rwcut suspicious-flows.silk --num-recs=5

# display the last five record lines
rwcut suspicious-flows.silk --tail-rec=5

# selecting -- extract particular columns
# options
# source IP: sIP; destination IP: dIP -- source port: sPort; destination port: dPort
# duration: duration; start time: sTime; end time: eTime
rwcut suspicious-flows.silk --fields=protocol,sIP,sPort,dIP,dPort --num-recs=5

# NOTE: protocol section is displayed in binary form (ICMP=1; IPv4=4; TCP=6; UDP=17)

# filtering -- `rwfilter` -- multiple filters for each column -- requires the output to be post-processed --> doesn't display result on the terminal --> mostly used with rwcut --> `rwfilter suspicious-flows.silk` will throw an error

# filter all UDP records, pass the output to rwcut, display the first five records
# --pass=stdout must be set to process the output with pipe and rwcut
rwfilter suspicious-flows.silk --proto=17 --pass=stdout | rwcut --num-recs=5
rwfilter suspicious-flows.silk --proto=17 --pass=stdout | rwcut --fields=protocol,sIP,sPort,dIP,dPort --num-recs=5
# filtering options:
# protocols: `--proto` -- values between 0-255
# port filters: any port:`--aport`; source port:`--sport`; destination port:`--dport`; possible values: 0-65535
# ip filters: any ip address:`--any-address`; source address:`--saddress`; destination address:`--daddress`
# volume filters: number of the packets:`--packets`; number of the bytes:`--bytes`

# quick statistics -- `rwstats`
# --count: limit the number of records printed -- top 10 destination ports
# --values=records,packets,bytes:show measurement in flows, packets and bytes
# --values=sIP-Distinct,dIP-Distinct:show the number of unique IP addresses that used the filtered field
rwstats FILENAME --fields=dPort --values=records,packets,bytes,sIP-Distinct,dIP-Distinct --count=10

## list the top 10 talkers on the network
rwstats suspicious-flows.silk --fields=sIP --values=bytes --count=10 --top

# list the top communication pairs -- not working!!!
rwfilter FILENAME --fields=sIP,dIP --values=records,bytes,packets --count=10

# filter all dns traffic (either as source or destination port)
rwfilter suspicious-flows.silk --aport=53 --pass=stdout | rwstats --fields=sIP,dIP --values=records,bytes,packets --count=10

# view the frequency of the requests -- on both sides
rwfilter suspicious-flows.silk --saddress=175.175.173.221 --dport=53 --pass=stdout | rwcut --fields=sIP,dIP,stime | head -10
# the other side
rwfilter suspicious-flows.silk --saddress=175.219.238.243 --dport=53 --pass=stdout | rwcut --fields=sIP,dIP,stime | head -10

# check other interactions on the network by the suspicious host
rwfilter suspicious-flows.silk --any-address=175.175.173.221 --pass=stdout | rwstats --fields=sIP,dIP  --count=10

# check the other ip it interacted with
rwfilter suspicious-flows.silk --any-address=205.213.108.99 --pass=stdout | rwstats --fields=sIP,sPort,dIP,dPort,proto  --count=10

# check who is involved in port 80 traffic
rwfilter suspicious-flows.silk --aport=80 --pass=stdout | rwstats --fields=sIP,dIP  --count=10

# reveal the one that created the load by focusing on the destination port
rwfilter suspicious-flows.silk --aport=80 --pass=stdout | rwstats --fields=sIP,dIP,dPort  --count=10

# view the frequency and flags fo the request to see if there is any abnormal pattern
rwfilter suspicious-flows.silk --saddress=175.215.236.223 --pass=stdout | rwcut --fields=sIP,dIP,dPort,flag,stime | head

# view all the packets sent by that specific host
rwfilter suspicious-flows.silk --saddress=175.215.236.223 --pass=stdout | rwstats --fields=sIP,flag,dIP --count=10

# check the destination's answers
rwfilter suspicious-flows.silk --saddress=175.215.235.223 --pass=stdout | rwstats --fields=sIP,flag,dIP --count=10

# check if the host has interacted with other hosts on the network
rwfilter suspicious-flows.silk --any-address=175.215.236.223 --pass=stdout | rwstats --fields=sIP,dIP  --count=10

Questions and Answers

Question-01: Which version of SiLK is installed on the VM?

3.19.1

Question-02: What is the size of the flows in the count records?

11774

Question-03: What is the start time (sTime) of the sixth record in the file?

2023/12/05T09:33:07.755

Question-04: What is the destination port of the sixth UDP record?

49950

Question-05: What is the record value (%) of the dport 53?

35.332088

Question-06: What is the number of bytes transmitted by the top talker on the network?

735229

Question-07: What is the sTime value of the first DNS record going to port 53?

2023/12/08T04:28:44.825

Question-08: What is the IP address of the host that the C2 potentially controls? (In defanged format: 123[.]456[.]789[.]0 )

175[.]175[.]173[.]221

Question-09: Which IP address is suspected to be the flood attacker? (In defanged format: 123[.]456[.]789[.]0 )

175[.]215[.]236[.]223

Question-10: What is the sent SYN packet’s number of records?

1658

Question-11: We’ve successfully analysed network flows to gain quick statistics. If you want to delve deeper into network packets and network data, you can look at the Network Security and Traffic Analysis module.

No answer needed

Day-18

A Gift That Keeps on Giving

Storyline

An investigation into an insider threat has revealed a production server consuming an unexpectedly high amount of resources. We suspect the presence of a cryptominer and have narrowed the issue down to a single unapproved process. Our objective is to locate every instance where this process is embedded within the system and eliminate it to prevent further misuse of company resources.

Overview

We use the top command to monitor system performance and identify a suspicious process named “a” that is consuming 100% of the CPU. Although we attempt to terminate it using sudo kill, the process immediately respawns with a new PID.

After checking the crontabs for both the standard user and the root user and finding no relevant scheduled tasks, we investigate running services using systemctl list-unit-files.

We discover an enabled service with a suspicious name and the description “Unkillable exe,” which is responsible for restarting the malicious process.

To permanently remove the threat, we switch to the root user and use systemctl stop and systemctl disable to halt the service. We then delete the service and process files located in /etc/systemd/system/ and run systemctl daemon-reload to clear any remaining configurations. This successfully restores normal CPU usage and eradicates the persistent process.

Practical

# display the list of processes in real time with their usage
top

# try killing the process
sudo kill 666

# checking the cronjobs
crontab -l

# checking the cronjobs for the root user
sudo su
crontab -l

# check for running services
# list all services -- the service we are looking for must be enabled to respawn the process --> filter for enabled
systemctl list-unit-files | grep enabled

# check the status of the suspicious service
systemctl status a-unkillable.service

# getting rid of the service
# change to root
sudo su

# stop the service
systemctl stop a-unkillable.service

# verify status
systemctl status a-unkillable.service

# disabling the service
systemctl disable a-unkillable.service

# service still present in the system --> remove the files as well
# remove process files
rm -rf /etc/systemd/system/a
# remove service files
rm -rf /etc/systemd/system/a-unkillable.service

# verify cleanup --> should throw an error
systemctl status a-unkillable.service

# make sure no remnants are left --> reload all the service configurations and create the whole service dependency tree again
systemctl daemon-reload

Questions and Answers

Question-1: What is the name of the service that respawns the process after killing it?

a-unkillable.service

Question-2: What is the path from where the process and service were running?

/etc/systemd/system

Question-3: The malware prints a taunting message. When is the message shown? Choose from the options below. 1. Randomly; 2. After a set interval; 3. On process termination; 4. None of the above

4

Question-4: If you enjoyed this task, feel free to check out the Linux Forensics room.

No answer needed