---
# System prepended metadata

title: Final Challenge

---

# Final Challenge

*We should put notes about ip addresses, hashes, network structure, etc. In here as we work.*

## Tasks

1. Solve the problem
2. Create a PPT write-up


## Timeline

- 12/5/2020: email sent and opened in PC1, Update.exe dropped, executed psexec
- 2/5/2020: psexec used to drop Update.exe on pc
- 2/14/2020: SQL Injection attack
- 2/18/2020 9:53:17pm: `toor` user set password on pc3
- 2/18/2020 10:31 Suspicious user agent HTTP request - Havij, PC-1
- 2/18/2020 10:53pm: `virus/` directory created on mis-pc
- 2/18/2020 10:46am: Reverse shell dropped on web server 
- 2/18/2020 10:46am: Mulitpart HTTP Requests - PC-2
- 2/21/2020 1:20:54am: Password update for `webusr` on webserver

- 1/22/2019 19:15: Telnet server started on jack_fisher Mis_pc

- February 18 2018: last update of Apex One smart scan pattern on PC3




| Source | Time Stamp            | Interesting Host | Description                                     |
| ------ | --------------------- | ---------------- | ----------------------------------------------- |
|        |                       |                  |                                                 |
|        |                       |                  |                                                 |
| DDAN   | 02/05/2020 3:28:54 PM | Staff-PC1        | C:\Users\administrator.ATD\Downloads\update.exe |
|        |                       |                  |                                                 |
|        | Text                  | Text             | Text                                            |


## Objects

### `update.exe`
172.61.100.200## 
File path: C:\\Windows\System32\

### `virus/`

`C:\ProgramData\Trend Micro\ASMP\temp`



### `conn_ie.bat`
user: jack_fisher
Created: 22 January 2019 19:13:17

### `task_delete`
Created: Jan172019 10:21:20pm
Modified: March152015 8:17:02pm
Accessed: Jan202019 1:42:13am

# Network Structure

![](https://i.imgur.com/UcEdsH4.png)

# Credentials

| Resource         | Username          | Password   |
| ---------------- | ----------------- | ---------- |
| SVR-Web          | jack_fisher       | Pa$w0rd    |
| SVR-NFS          | root              | Pa$$w0rd   |
| All other PCs    | atd\administrator | Pa$$w0rd   |
| DDI and DDAn     | admin             | Admin1234! |
| Apex One/Central | root              | Admin1234! |
| Deep Security    | MasterAdmin       | Admin1234! |

# Stuff to do

- [ ] Investigate DDI
- [ ] Create a timeline
- [ ] Investigate Endpoints


# Endpoints

## PC 3

- Real-time scan was manually disabled
    - ![](https://i.imgur.com/33e5bNM.png)
- No internet available to atd.corp
- 

## MIS-PC

There's a user named `toor` on MIS-PC, that seems to be malicious. Administrators group

jack_fisher
q:q!
ZZkjk

Contents on desktop

config.txt

```
svr-dc
23
3000
jack_fisher
Pa$$w0rd
ipconfig
```


### Raman & I's DDI and DDN findings

Staff-PC1: C:\Users\administrator.ATD\Downloads\update.exe
           02/05/2020 3:28:54 PM
           DDAN
           
           
    02/18/2020 10:31:12 Identified suspicious user agent in HTTP Response 
    Source: 192.168.203.201 (Staff-PC1)
    Victim: 192.168.203.10 (SVR-WEB)


    02/18/2020 10:17:49 SQL injection 
    Source: 192.168.203.202
    Victim: 192.168.203.10 (SVR-WEB)

    02/14/2020 13:14:18 Command injection attack
    Outfile: shell.php
    Source: 192.168.203.202
    Victim: 192.168.203.10 (SVR-WEB)


    02/14/2020 10:30:12 SQL injection 
    Source: 192.168.203.202
    Victim: 192.168.203.10 (SVR-WEB)
            
            Created: 10:46
            Mod:11:07 AM


### How did attackers gain access to the environment?

- Phishing email // link 'HERE'

### What did attackers do within the environment? What methods/techniques were used to move laterally across the network?

- PsExec // lateral movement
- Opened a connection to server-DC
- Gained access to WebServer through SQLi from PC2

### Was there any successful data exfiltration? What methods were used to collect data & exfiltrate them?

- Yes
- SQL statements

### What tools have the attackers used during their attack? Can you create IOC, YARA or Suspicious Objects for those tools?

- PsExec
- SQLi
- Havij -- suspicious user agent
- Yes
- Cain & Abel

### Is there any obvious misconfiguration of Trend Micro products, which could have prevented this incident?

- Web Reputation actions set to 'detect' rather than 'prevent' for the Servers.
- All of the Servers has WR disabled
- Anti-Malware // process memory scan disabled
- Behavior Monitoring disabled.

### Are there any recommendations to make for customer's environments?

- Utilize Web Reputation policies.
- Ensure Deep Security policies are configured properly for the servers.
- Ensure Apex One policies are configured properly for endpoints.


### TIMELINE OF EVENTS
**When did the attack begin?**
- Email was sent (02/05/2020)

**What happened next?**
- Lateral movement // PsExec (02/06/2020 -- 2:05pm)
- SQLi on PC2 occurred giving access to the Web Server machine (02/14/2020 -- 10:30am)
- Reverse shell dropped on web server (02/18/2020 -- 10:46am)
- `toor` user set password on pc3 (02/18/2020 -- 9:53pm)
- `virus/` directory created on mis-pc (02/18/2020 -- 10:53pm)

### Questionable Events
- Last update of Apex One smart scan pattern on PC3 (02/18/2018)
- Telnet server started on jack_fisher Mis_pc (01/22/2019 -- 7:15pm)