---
# System prepended metadata

title: CyberDefender - CorporateSecrets (Part 3)
tags: [Endpoint Forensics, CyberDefender]

---

# CyberDefender - CorporateSecrets (Part 3)
Challenge: https://cyberdefenders.org/blueteam-ctf-challenges/33
Part 1: https://hackmd.io/@SBK6401/r18z7VIm6
Part 2: https://hackmd.io/@SBK6401/ByFhEE8X6
Part 4: https://hackmd.io/@SBK6401/H1rAEV87p

:::spoiler TOC
[TOC]
:::

## Tools: 
* FTK Imager
* Registry Explorer
* RegRipper
* HxD
* DB Browser for SQLite
* HindSight
* Event Log Explorer
* MFTDump


## ==Q19==
> Which user installed LibreCAD on the system?
### Exploit
我是直接看該檔案在哪個user的資料夾來判斷，當然這個做法有點問題

:::spoiler Flag
Flag: `miriam.grapes`
:::
## ==Q20==
> How many times "admin" logged into the system? 
### Recon
呈第14題
### Exploit
不過我不知道為甚麼答案是21，然後我只有找到20個，看了4672也沒有紀錄(怪怪的)
![圖片.png](https://hackmd.io/_uploads/Syfldc8Xa.png)

:::spoiler Flag
Flag: `21`
:::
## ==Q21==
> What is the name of the DHCP domain the device was connected to? 
### Recon
直接看`SYSTEM/ControlSet001/Services/Tcpip/Parameters/Interfaces/`
![圖片.png](https://hackmd.io/_uploads/HJqjU5IQ6.png)

:::spoiler Flag
Flag: `fruitinc.xyz`
:::
## ==Q22==
> What time did Tim download his background image?
(Oh Boy 3AM . Answer in MM/DD/YYYY HH:MM format (UTC).) 
### Recon
原本的直覺是像第18題一樣把db file export出來看他的網路操作行為，不過其實可以直接看他下載的file，看他的create time就好
### Exploit
![圖片.png](https://hackmd.io/_uploads/SJfBFLvXa.png)

:::spoiler Flag
Flag: `04/05/2020 03:49`
:::
## ==Q23==
> How many times did Jim launch the Tor Browser?
### Exploit
直接把Jim的NTUSER.dat export出來後用timeline explorer看userassist，不過我不確定為甚麼答案是2，因為我查到的都是3
![圖片.png](https://hackmd.io/_uploads/rJz_098Q6.png)
![圖片.png](https://hackmd.io/_uploads/ByTKR9UmT.png)
還有另外一個方法是看prefetch，從FTK中export出`TOR.EXE-4B50033F.pf`，用PECmd.exe解析，但這個更怪了，結果顯示只有執行過一次，所以prefetch參考就好
:::spoiler
```bash
$ ./PECmd.exe -f TOR.EXE-4B50033F.pf
PECmd version 1.5.0.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/PECmd

Command line: -f TOR.EXE-4B50033F.pf

Keywords: temp, tmp

Processing TOR.EXE-4B50033F.pf

Created on: 2023-11-06 17:15:55
Modified on: 2020-04-16 04:52:40
Last accessed on: 2023-11-06 17:17:52

Executable name: TOR.EXE
Hash: 4B50033F
File size (bytes): 88,080
Version: Windows 10 or Windows 11

Run count: 1
Last run: 2020-04-16 04:52:30

Volume information:

#0: Name: \VOLUME{01d60963b1096880-ecb16432} Serial: ECB16432 Created: 2020-04-03 02:58:03 Directories: 11 File references: 71

Directories referenced: 11

00: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1
01: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER
02: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER
03: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA
04: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR
05: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR
06: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS
07: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\GLOBALIZATION
08: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\GLOBALIZATION\SORTING
09: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32
10: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\EN-US

Files referenced: 58

00: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\NTDLL.DLL
01: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\TOR.EXE (Executable: True)
02: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\KERNEL32.DLL
03: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\KERNELBASE.DLL
04: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\LOCALE.NLS
05: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\ADVAPI32.DLL
06: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\MSVCRT.DLL
07: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\SECHOST.DLL
08: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\RPCRT4.DLL
09: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\SHELL32.DLL
10: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\CFGMGR32.DLL
11: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\UCRTBASE.DLL
12: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\SHCORE.DLL
13: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\COMBASE.DLL
14: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\BCRYPTPRIMITIVES.DLL
15: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\WINDOWS.STORAGE.DLL
16: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\SHLWAPI.DLL
17: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\GDI32.DLL
18: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\GDI32FULL.DLL
19: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\MSVCP_WIN.DLL
20: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\USER32.DLL
21: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\WIN32U.DLL
22: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\KERNEL.APPCORE.DLL
23: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\POWRPROF.DLL
24: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\PROFAPI.DLL
25: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\WS2_32.DLL
26: \VOLUME{01d60963b1096880-ecb16432}\$MFT
27: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\IPHLPAPI.DLL
28: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\LIBSSP-0.DLL
29: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\LIBEVENT-2-1-6.DLL
30: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\ZLIB1.DLL
31: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\LIBWINPTHREAD-1.DLL
32: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\LIBSSL-1_1-X64.DLL
33: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\TOR\LIBCRYPTO-1_1-X64.DLL
34: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\CRYPTSP.DLL
35: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\RSAENH.DLL
36: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\BCRYPT.DLL
37: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS
38: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\CRYPTBASE.DLL
39: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\IMM32.DLL
40: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\TORRC-DEFAULTS
41: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\TORRC
42: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\MSWSOCK.DLL
43: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\STATE
44: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CONTROL_AUTH_COOKIE.TMP (Keyword: True)
45: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\GEOIP
46: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\GEOIP6
47: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CACHED-CERTS
48: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\EN-US\KERNELBASE.DLL.MUI
49: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CACHED-MICRODESC-CONSENSUS
50: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CACHED-MICRODESCS
51: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CACHED-MICRODESCS.NEW
52: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\UNVERIFIED-MICRODESC-CONSENSUS
53: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\STATE.TMP (Keyword: True)
54: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\NSI.DLL
55: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\DHCPCSVC6.DLL
56: \VOLUME{01d60963b1096880-ecb16432}\WINDOWS\SYSTEM32\DHCPCSVC.DLL
57: \VOLUME{01d60963b1096880-ecb16432}\PROGRAM1\BROWSER\TORBROWSER\DATA\TOR\CACHED-MICRODESC-CONSENSUS.TMP (Keyword: True)


---------- Processed TOR.EXE-4B50033F.pf in 0.04772100 seconds ----------
```
:::

:::spoiler Flag
Flag: `2`
:::
## ==Q24==
> There is a png photo of an iPhone in Grapes's files. Find it and provide the SHA-1 hash. 
### Recon
看了第一個hint才知道有stego的成分在裡面，首先要找到藏圖片的檔案是哪一張，我判斷是`samplePhone.jpg`這一張
### Exploit
有了圖片之後就是最擅長的misc基本操作，結果在binwalk的時候發現有附加檔案在裡面，就直接foremost提出來
```bash
$ binwalk -e samplePhone.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
5962          0x174A          PNG image, 1000 x 1000, 8-bit/color RGBA, non-interlaced
6003          0x1773          Zlib compressed data, best compression
$ foremost -v samplePhone.jpg
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Tue Nov  7 01:32:54 2023
Invocation: foremost -v samplePhone.jpg
Output directory: /mnt/d/NTU/CTF/CyberDefenders/CorporateSecrets/Exported File/output
Configuration file: /etc/foremost.conf
Processing: samplePhone.jpg
|------------------------------------------------------------------
File: samplePhone.jpg
Start: Tue Nov  7 01:32:54 2023
Length: 164 KB (167947 bytes)

Num      Name (bs=512)         Size      File Offset     Comment

0:      00000011.png         158 KB            5962       (1000 x 1000)
*|
Finish: Tue Nov  7 01:32:54 2023

1 FILES EXTRACTED

png:= 1
------------------------------------------------------------------

Foremost finished at Tue Nov  7 01:32:54 2023
$ cd output/png
$ file *
00000011.png: PNG image data, 1000 x 1000, 8-bit/color RGBA, non-interlaced
```
![圖片.png](https://hackmd.io/_uploads/BJMD8sUX6.png)

:::info
也可以像[^wp]直接用`$ binwalk --dd=".*" samplePhone.jpg`，一樣可以解壓縮出原本的圖片
:::

:::spoiler Flag
Flag: `537fe19a560ba3578d2f9095dc2f591489ff2cde`
:::
## ==Q25==
> When was the last time a docx file was opened on the device?
(An apple a day keeps the docx away. Answer in UTC, YYYY-MM-DD HH:MM:SS) 
### Recon
我原本的直覺是想可以parse \$MFT或是該檔案的lnk去看他的改動時間，但很不幸的MFT沒有這筆資料(?)，另外也沒有lnk檔案，所以只能通靈，以下解題過程是參考解完的hint
### Exploit
直接看RecentDocs的資訊就找的到了，該紀錄在Jim的NTUSER.DAT中，`Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs`
![圖片.png](https://hackmd.io/_uploads/SJvJlOw7p.png)

:::spoiler Flag
Flag: `2020-04-11 23:23:36`
:::
## ==Q26==
> How many entries does the MFT of the filesystem have?
### Exploit
我是直接在`/root`的地方export出\$MFT file，然後去看magic header(`FILE0`)的數量有多少(`219811`)，但這樣不準確(不清楚為甚麼)，我記得之前[@Jimmy說過](https://hackmd.io/@SBK6401/HJ-hG7Kzp#Lab---Offset-43110400d)
> $MFT長度一段就是1024 Bytes(0x400)

所以我想說可以把最後出現的位置除已0x400可能就是答案$\to 0xd6aac00/0x400=219819.0$
![圖片.png](https://hackmd.io/_uploads/BkUuMwDmp.png)
* 方法一
    不過以上的方法是確實可行的，因為計算entries不是只要看有多少有紀錄的File，而是整個\$MFT有多少空間，意思是我們要看最後位址是多少再除以0x400，而不是只算到最後一個FILE0的地方就直接除已0x400
    ![圖片.png](https://hackmd.io/_uploads/SJCs2DwX6.png)
    該檔案的最後位址是在0xd6bfff0
    $(0xd6bfff0+0x10)/0x400 = 219904.0$
    加上0x10是因為要算出完整的0x400才算一個，也就是我們要算最後一個就要padding
* 方法二
    後來參考[^wp]才知道比較正確的解法
    1. clone [mftdump](https://github.com/mcs6502/mftdump/blob/master/mftdump.py)
    2. create python 2 environment
    3. dump mft file
        ```bash
        $ conda activate py27
        $ python mftdump.py "MFT" > MFTdumpOutput.txt
        ```
    4. 看解出多少entries再扣掉最前面兩行不算的部分
        ![圖片.png](https://hackmd.io/_uploads/HJ20owwQp.png)
        ![圖片.png](https://hackmd.io/_uploads/SkmssPvXa.png)
        $219906-2=219904$

:::spoiler Flag
Flag: `219904`
:::
## ==Q27==
> Tim wanted to fire an employee because they were ......?(Be careful what you wish for)
### Exploit
呈第15題，直接看Tim的瀏覽紀錄就會知道了

:::spoiler Flag
Flag: `stinky`
:::
## Reference
[^wp]:[CyberDefenders: CorporateSecrets](https://forensicskween.com/ctf/cyberdefenders/corporatesecrets/)