HTB Sherlock: Campfire-2

Campfire-2

HackTheBox Sherlock. Companion box to Campfire-1, same FORELA environment and the same compromised workstation. This time the technique is AS-REP roasting instead of kerberoasting, and the job is to confirm the attack from the Domain Controller Security logs alone, no workstation artifacts provided.

Task 1: AS-REP roasting timestamp#

Q: When did the ASREP Roasting attack occur, and when did the attacker request the Kerberos ticket for the vulnerable user?

Filtered DC Security logs for EventID 4768 (Kerberos TGT request). One entry stood out with Ticket Encryption Type 0x17, RC4. Answer: 2024-05-29 06:36:40

Task 2: Targeted user account#

Q: Please confirm the User Account that was targeted by the attacker.

Same 4768 event, Account Name field.

Answer: arthur.kyle

Task 3: Account SID#

Q: What was the SID of the account?

Same 4768 event, User ID field with the target’s SID.

Answer: S-1-5-21-3239415629-1862073780-2394361899-1601

Task 4: Compromised workstation IP#

Q: It is crucial to identify the compromised user account and the workstation responsible for this attack. Please list the internal IP address of the compromised asset to assist our threat-hunting team.

Same 4768 event, Client Address field. Same IP as Campfire-1’s compromised workstation, 172.17.79.129.

Answer: 172.17.79.129

Task 5: Attacker account identification#

Q: We do not have any artifacts from the source machine yet. Using the same DC Security logs, can you confirm the user account used to perform the ASREP Roasting attack so we can contain the compromised account/s?

No workstation artifacts to lean on, so stayed in the DC Security logs. Right after the 4768 from the same source IP, a 4769 (Kerberos service ticket request) showed up with Account Name happy.grunwald@FORELA.LOCAL. Same workstation.

Answer: happy.grunwald