HTB Sherlock: Reaper

Reaper

HackTheBox Sherlock. DFIR box built around NBNS spoofing and NTLM credential theft on the FORELA network: a rogue device impersonates a workstation, grabs a hash off the wire, then rides it into a share on the DC.

Task 1: What is the IP Address for Forela-Wkstn001?#

Pulled it from NBNS Refresh packets in the pcap.

Answer: 172.17.79.129

Task 2: What is the IP Address for Forela-Wkstn002?#

Same approach, NBNS Refresh packets again.

Answer: 172.17.79.136

Task 3: What is the username of the account whose hash was stolen by attacker?#

Filtered Windows Security logs for EventID 4624 (Logon). One Logon Type 3 stood out, Account Name arthur.kyle.

Answer: arthur.kyle

Task 4: What is the IP Address of Unknown Device used by the attacker to intercept credentials?#

Answer: 172.17.79.135

Task 5: What was the fileshare navigated by the victim user account?#

Back to the pcap, filtered SMB2 traffic in Wireshark. Found a request to access the trip share.

Answer: \\DC01\Trip

Task 6: What is the source port used to logon to target workstation using the compromised account?#

Same 4624 event as Task 3, Source Port attribute.

Answer: 40252

Task 7: What is the Logon ID for the malicious session?#

Same 4624 event, Logon ID attribute.

Answer: 0x64A799

Task 8: The detection was based on the mismatch of hostname and the assigned IP Address. What is the workstation name and the source IP Address from which the malicious logon occur?#

Same 4624 event: Workstation Name and Source Network Address fields. The name in the logon is FORELA-WKSTN002, but that host is supposed to sit at 172.17.79.136 (Task 2). The logon instead came from 172.17.79.135 — the mismatch between the claimed hostname and the real source IP is what tripped the detection.

Answer: FORELA-WKSTN002, 172.17.79.135

Task 9: At what UTC time did the malicious logon happen?#

TimeCreated on the same logon event.

Answer: 2024-07-31 04:55:16

Task 10: What is the share Name accessed as part of the authentication process by the malicious tool used by the attacker?#

Filtered for EventID 5140 (File Share). The attacker’s tool authenticates against the admin IPC$ share as part of its normal flow.

Answer: \\*\IPC$