HTB Sherlock: Campfire-1

Campfire-1

HackTheBox Sherlock. Alonzo Spire spots weird files on his workstation and flags the SOC. Suspicion is kerberoasting; the job is to confirm it from three sources: Domain Controller Security logs, PowerShell-Operational logs from Alonzo’s workstation, and Prefetch files off the same box.

Task 1: Kerberoasting activity timestamp#

Q: Analyzing Domain Controller Security Logs, can you confirm the UTC date & time when the kerberoasting activity occurred?

Knowing it’s kerberoasting and that Alonzo found suspicious files on his box, filtered the DC security logs for EventID 4769 (Kerberos service ticket request). Plenty of hits for Account Name alonzo.spire@FORELA.LOCAL. One stood out: a service ticket request for a SQL service with Ticket Encryption Type 0x17, RC4, which is a weak encryption allowing the offline cracking.

Answer: 2024-05-21 03:18:09

Task 2: Targeted service name#

Q: What is the Service Name that was targeted?

Same 4769 event. Service Name field pointed to MSSQLService, the account running the SQL service whose ticket got requested.

Answer: MSSQLService

Task 3: Workstation IP address#

Q: It is really important to identify the Workstation from which this activity occurred. What is the IP Address of the workstation?

Same event, Client Address field: 172.17.79.129, supposedly Alonzo’s workstation.

Answer: 172.17.79.129

Task 4: AD enumeration tool#

Q: Now that we have identified the workstation, a triage including PowerShell logs and Prefetch files are provided to you for some deeper insights so we can understand how this activity occurred on the endpoint. What is the name of the file used to Enumerate Active directory objects and possibly find Kerberoastable accounts in the network?

Moved to the PowerShell-Operational logs from Alonzo’s workstation. Multiple hits for powerview.ps1. Execution policy blocked it once, but the attacker got around that with powershell -ep bypass.

Answer: powerview.ps1

Task 5: Script execution time#

Q: When was this script executed? (UTC)

EventID 4104 logs the actual script block content. First occurrence of 4104 linked to the powerview.ps1 script marks the start of execution.

Answer: 2024-05-21 03:16:32

Task 6: Kerberoasting tool path#

Q: What is the full path of the tool used to perform the actual kerberoasting attack?

Ran the Prefetch files through PECmd (PECmd.exe -d [PATH]\Windows\prefetch --csv ./out) and loaded the CSV in Timeline Explorer. Filtered the window to the attack timeframe from Task 1 and 3, and other than the Windows binaries, Rubeus.exe stands out.

Answer: C:\Users\Alonzo.spire\Downloads\Rubeus.exe

Task 7: Credential dump time#

Q: When was the tool executed to dump credentials? (UTC)

Same Rubeus.exe entry from Task 6, Run Time column.

Answer: 2024-05-21 03:18:08

Detection notes#

Signatures worth alerting on, in order of how this attack actually surfaced:

• EventID 4769 with Ticket Encryption Type 0x17 (RC4) requested for a service account, especially against a SQL service ticket. AES-capable environments shouldn’t be issuing RC4 tickets.
• PowerShell launched with -ep bypass, right after a policy-blocked attempt.
• Prefetch execution evidence for Rubeus.exe from the user Downloads folder.

Log-source map#