HTB Sherlock: Reaper

Reaper

HackTheBox Sherlock. DFIR box built around NBNS spoofing and NTLM credential theft on the FORELA network: a rogue device impersonates a workstation, grabs a hash off the wire, then rides it into a share on the DC.

Task 1: Wkstn001 IP address#

Q: What is the IP Address for Forela-Wkstn001?

Pulled it from NBNS Refresh packets in the pcap.

Answer: 172.17.79.129

Task 2: Wkstn002 IP address#

Q: What is the IP Address for Forela-Wkstn002?

Same approach, NBNS Refresh packets again.

Answer: 172.17.79.136

Task 3: Stolen hash username#

Q: What is the username of the account whose hash was stolen by attacker?

Filtered Windows Security logs for EventID 4624 (Logon). One Logon Type 3 stood out, Account Name arthur.kyle.

Answer: arthur.kyle

Task 4: Rogue device IP#

Q: What is the IP Address of Unknown Device used by the attacker to intercept credentials?

Answer: 172.17.79.135

Task 5: Victim’s fileshare access#

Q: What was the fileshare navigated by the victim user account?

Back to the pcap, filtered SMB2 traffic in Wireshark. Found a request to access the trip share.

Answer: \\DC01\Trip

Task 6: Malicious logon source port#

Q: What is the source port used to logon to target workstation using the compromised account?

Same 4624 event as Task 3, Source Port attribute.

Answer: 40252

Task 7: Malicious session Logon ID#

Q: What is the Logon ID for the malicious session?

Same 4624 event, Logon ID attribute.

Answer: 0x64A799

Task 8: Hostname/IP mismatch#

Q: The detection was based on the mismatch of hostname and the assigned IP Address. What is the workstation name and the source IP Address from which the malicious logon occur?

Same 4624 event: Workstation Name and Source Network Address fields. The name in the logon is FORELA-WKSTN002, but that host is supposed to sit at 172.17.79.136 (Task 2). The logon instead came from 172.17.79.135 — the mismatch between the claimed hostname and the real source IP is what tripped the detection.

Answer: FORELA-WKSTN002, 172.17.79.135

Task 9: Malicious logon time#

Q: At what UTC time did the malicious logon happen?

TimeCreated on the same logon event.

Answer: 2024-07-31 04:55:16

Task 10: Attacker tool’s share access#

Q: What is the share Name accessed as part of the authentication process by the malicious tool used by the attacker?

Filtered for EventID 5140 (File Share). The attacker’s tool authenticates against the admin IPC$ share as part of its normal flow.

Answer: \\*\IPC$