OS, Password, IP Addr, Note, Execution, Path of the Executable, Malicious - Forensics
Task
My boss, Muhammad, sent me this dump file of a memory. He told me that this OS has a malware virus that runs automatically. I need to find some more information about this OS, and the hacker also created some files in this OS. He gave me a task to solve this within 24 hours. I am afraid. Will you please help me? My boss sent some questions; please solve them on my behalf. There are total 7 challenges in this series. Best of luck.
Solution
The Forensics category consisted of 7 tasks: OS, Password, IP Addr, Note, Execution, Path of the Executable, and Malicious. The content of individual tasks is included in points 1-7. All tasks in this category were solved based on the KnightSquad.DMP file, which was attached to the first task:
szczygielka@hacks$ file KnightSquad.DMP
KnightSquad.DMP: MS Windows 64bit crash dump, full dump, 771726 pagesTo solve the tasks, we will mainly use WinDbg, Volatility 2, Volatility 3. Both versions of Volatility differ in some commands, so it is worth to pay attention to the information returned by both versions of this software and their capabilities because some commands in Volatility 2 seem to have no equivalents in Volatility 3.
Additionally, in Volatility 2, it is necessary to select an operating system profile, which we will do after the OS task, once we have some information about the system.
Useful cheatsheet for Volatility 2 and Volatility 3:
https://blog.onfvp.com/post/volatility-cheatsheet/
1. OS - What is the OS version?
To find the operating system version we can use the following command in WinDbg's integrated command line:
!analyze -v!
In the output of the command, we get the OS version, which is 7.1.7601.24214.
Flag:
Selecting an operating system profile in Volatility 2
To use Volatility 2 for solving the next tasks, we must determine the profile based on the operating system version. We know that the build number is 7.1.7601.24214 and that it is a 64-bit machine running Windows 7, and that it uses Service Pack 1.
Information on how to correctly determine the Windows machine profile in Volatility 2 can be found here.
We can use the following command to check the list of available profiles for Windows 7 in Volatility 2:
Based on the information received from the OS task, we can select the profile Win7SP1x64.
2. Password - What is the login password of the OS?
To get the password we have to get NTLM hashes. We can use hashdump functionality to get the hashes.
Volatility 2:
Volatility 3:
Let's save found NTLM hashes to the hashes.txt file and use the Hashcatto crack them with rockyou.txt wordlist:
One of the hashes was cracked. Hash which was cracked and recovered password:
Flag:
3. IP Addr - What is the IP address of this system?
To get the IP address we can use netscan functionality.
Volatility 2:
Volatility 3:
The machine's IP address is 10.0.2.15.
Flag:
4. Note - My boss has written something in the text file. Could you please help me find it?
Let's assume that may be a plain text file, i.e. a .txt file. Let's start by searching for all files of this type using filescan functionality.
Volatility 2:
Volatility 3:
Based on the output information, we can suspect that it is the text2.txt file or the text.txt file. To recover a single file, we have to use the address of this file returned in the previous command. Let's try to recover the text2.txt file first.
Volatility 2
In case of use the Volatility 2, we must specify the path where the recovered file will be saved:
Volatility 3
In case of use the Volatility 3, it is not necessary to provide the output path:
The file text2.txtwas recovered successfully. After opening it, we can see that part of the first line is encoded in Base64:
After decoding the string from Base64, we get the flag:
Flag:
5. Execution - My leader, Noman Prodhan, executed something in the cmd of this infected machine. Could you please figure out what he actually executed?
To solve this task, the following information from HackTricks will be helpful:
Commands entered into cmd.exe are processed by conhost.exe (csrss.exe prior to Windows 7). So even if an attacker managed to kill the cmd.exe prior to us obtaining a memory dump, there is still a good chance of recovering history of the command line session from conhost.exe’s memory. If you find something weird (using the console’s modules), try to dump the memory of the conhost.exe associated process and search for strings inside it to extract the command lines.
Volatility 2
In the Volatility 2 there are at least 3 commands related to a command line, they are:
We will check the output of each of them, because their results may be useful also in solving the Path of the Execution task. For the cmdline and cmdscan commands, we want to find all the results for the conhost.exe process.
The cmdline command
Let's use the cmdline command to search for the conhost.exe process:
In this case, this command returned the PIDs of the conhost.exe processes. With PIDs, we can dump the memory of each process, and then search for strings in them, hoping to find commands or other interesting strings (we will do this in Volatility 3).
The cmdscan command
In this case, we can see 2 commands that were executed in the console:
The output indicates that for the process with PID 4580, we can see that two commands have been executed. As in the case of the cmdlinecommand, we can dump the process memory and search for strings.
The consoles command
The consoles command displays the entire screen buffer (input and output), not just the command typed in the console. In this case, it turned out to be significant. After executing the consolescommand, we get the flag. This is because the flag was returned in the output of the executed script windows.bat:
Volatility 3
Unfortunately Volatility 3 does not have plugins that would be equivalent to the commands cmdscan and consoles. We can only use the cmdlinecommand:
The flag is present in each of the above processes. Since the procdump command available in Volatility 3 recovers the .exe file along with the associated DLLs, we will use the memmap command to retrieve it. For example, let's dump the process with PID number 4888:
Using strings on the dumped process we get the flag:
Flag:
6. Path of the Executable - What is the path folder of the executable file which execute privious flag?
Volatility 2
In the task Execution, in the output of executing the cmdscan and consoles commands in Volatility 2, there was a full path of the executed windows.bat script, that is:
Flag:
7. Malicious - What is the malicious software name?
Let's remind the content of the first task:
My boss, Muhammad, sent me this dump file of a memory. He told me that this OS has a malware virus that runs automatically. I need to find some more information about this OS, and the hacker also created some files in this OS. He gave me a task to solve this within 24 hours. I am afraid. Will you please help me? My boss sent some questions; please solve them on my behalf. There are total 7 challenges in this series. Best of luck.
So we are most likely looking for some malware that runs automatically.
In Volatility 2 we can use the autoruns plugin to find software that runs automatically:
Command in Volatility 2 to check autostart files is as follows:
The MadMan.exe file looks quite suspicious. To dump the suspicious MadMan.exe file, we need its location in memory. We can check it with the command:
For the second returned address, we get the actual MadMan.exe executable. Command to dump the MadMan.exe file:
After uploading the MadMan.exe file or its hash for analysis at VirusTotal, we can see that the file is malicious:
Flag:
Last updated