---
# System prepended metadata

title: HR-1

---

DB leakage
![](https://i.imgur.com/nbcsvn9.png)



**System File Leakage
![](https://i.imgur.com/GXtgU35.png)


webshell
Attacker IP
10.101.0.231

Time
2022-11-13T11:10:01

URI
/wp-admin/update.php

Webshell Path
/tmp/eUotTkHK.zip

惡意登入
![](https://i.imgur.com/fch9vEI.png)


Time-based SQL Injection



解題: Upload Webshell OK

解題:System File Leakage OK

解題： IT Log Cleared OK

解題：HR、IT、RD Log Cleared OK

解題：System File Leakage OK

解題：DMZ-Intranet Network Scan 已上傳
1023
1
192.168.0.80
192.168.1.0/24
解題：Lateral Movement - Pass the Hash OK

解題：橫向運動 - MS17-010 OK

解題：Privilege Escalation 已上傳


# HR-1
Process ID
3856

Process Name
xOmSAuikFl.exe

Time
~~2022-11-13T11:25:39~~
~~2022/11/13 11:30:29~~
~~2022/11/13 11:25:40~~
IT
2022/11/13 11:35:14
2022/11/13 11:35:09
3328
powershell.exe
SYSTEM

HR
2022/11/13 11:30:32
2022/11/13 11:30:32
xOmSAuikFl.exe
3856

User
SYSTEM

# IT1
Process ID
3328

Process Name
powershell.exe

Time
~~2022-11-13T11:30:39~~
2022/11/13 11:30:41

User
SYSTEM

# **Lateral Movement - Pass the Hash
![](https://i.imgur.com/6YLnNEU.png)

# USB

2022/11/13 12:05:32	FileCreate	3048	powershell.exe	E:\start.bat
2022/11/13 12:05:32	FileCreate	3048	powershell.exe	E:\CommunicationThroughRemovableMedia.ps1	 
2022/11/13 12:05:32	FileCreate	3048	powershell.exe	E:\autorun.inf

![](https://i.imgur.com/c2CJTDq.png)

2022/11/13 12:08:38	FileCreate	2824	powershell.exe	C:\tmp\usb_dir\start.bat	 
2022/11/13 12:05:32	FileCreate	3048	powershell.exe	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	 
2022/11/13 12:05:32	FileCreate	3048	powershell.exe	E:\start.bat

ANS:
Compressed Filename
usb_dir.zip

Drive Letter
E

Dump Script
~~start.bat~~
~~CommunicationThroughRemovableMedia.ps1~~

Host
IT-1

Inject Script
~~CommunicationThroughRemovableMedia.ps1~~
~~WPSettings.dat~~

WPSettings.dat

Dump Script
DatafromRemovableMedia.ps1

inject
ReplicationThroughRemovableMedia.ps1


# IT數據洩露

IT-1
C:\tmp\DatafromNetworkSharedDrive.ps1
data_dir.zip
ENTERPRISE\ituser
\\192.168.1.21\Share

Compressed Filename
data_dir.zip

Domain User
ENTERPRISE\ituser
\\192.168.1.21\IT

Host
IT-1

Script
DatafromNetworkSharedDrive.ps1

Share Folder Path
~~\\192.168.1.21\Share~~
\\192.168.1.21\IT


# RD數據洩露
DatafromNetworkSharedDrive.ps1
~~\\192.168.1.21\Share~~
\\192.168.1.21\RD
RD-1
ENTERPRISE\rduser




# Phishing Mail



HR-1:192.168.1.103

_time	src_addr	message_id	mail_from	mail_to	subject	to	from	filename
2022/11/13 14:12:38	10.101.0.148	20221113061238.000001@1845815f3016	asharma05@gsb.columbia.edu	hruser@enterprise.com	For Sale !!! 50% off !!!	hruser@enterprise.com	asharma05@gsb.columbia.edu	YKxQgVzPWx.rar
2022/11/13 13:41:37	10.101.0.24	20221113054137.000001@43a406508de4	zyu8@yahoo.com	hruser@enterprise.com	I am a king of the world	hruser@enterprise.com	zyu8@yahoo.com	oWglWaoBtO.rar
2022/11/13 13:22:02	10.101.0.204	20221113052203.000001@338c0f30b275	gareth@covercian.co.uk	hruser@enterprise.com	For Sale !!! 50% off !!!	hruser@enterprise.com	gareth@covercian.co.uk	CnmuuMEAIe.rar
2022/11/13 13:02:29	10.101.0.6	20221113050229.000001@62f89dc5bbac	acritchett@one-economy.com	hruser@enterprise.com	I am a king of the world	hruser@enterprise.com	acritchett@one-economy.com	IEiiZpqCBf.rar
2022/11/13 12:42:55	10.101.0.92	20221113044256.000001@4e1f95c615bc	sarah@spark.net	hruser@enterprise.com	Emergency. Check this file.	hruser@enterprise.com	sarah@spark.net	SpBOgogBSx.rar
2022/11/13 12:33:43	10.101.0.30	20221113043343.000001@3427cb4c41df	pchaynes1063@gmail.com	hruser@enterprise.com	How to you turn this on ?	hruser@enterprise.com	pchaynes1063@gmail.com	TAwiqiAwfK.rar
2022/11/13 12:26:42	10.101.0.95	20221113042643.000001@8c3d7be16b58	william@objecthouse.com	hruser@enterprise.com	How to you turn this on ?	hruser@enterprise.com	william@objecthouse.com	oOWwkUMItQ.rar
2022/11/13 12:13:39	10.101.0.114	20221113041340.000001@28b568cecbca	jvnprakashrao@hotmail.com	hruser@enterprise.com	I am a king of the world	hruser@enterprise.com	jvnprakashrao@hotmail.com	EaBlyfpexE.rar
2022/11/13 12:02:59	10.101.0.197	20221113040259.000001@7c67d013612d	lionel.jean@gemplus.com	hruser@enterprise.com	Welcom to the Gmail!	hruser@enterprise.com	lionel.jean@gemplus.com	bDNBnbJNwJ.rar
2022/11/13 11:45:54	10.101.0.145	20221113034555.000001@26115255ecf6	linkedin@depallens.com	hruser@enterprise.com	How to you turn this on ?	hruser@enterprise.com	linkedin@depallens.com	fyaoAXMIxA.rar
2022/11/13 11:37:55	10.101.0.181	20221113033755.000001@c691d6694d8c	administrator@enterprise.com	hruser@enterprise.com	Nothing Special	hruser@enterprise.com	administrator@enterprise.com	kYXSLPMvZX.rar
2022/11/13 11:33:16	10.101.0.150	20221113033316.000001@adb8353206fb	simone@evectors.it	hruser@enterprise.com	How to you turn this on ?	hruser@enterprise.com	simone@evectors.it	UakxYglkWM.rar
2022/11/13 11:29:40	10.101.0.199	20221113032940.000001@1ba302aa4d7a	LMWesttown@aol.com	hruser@enterprise.com	Trump Never Lose	hruser@enterprise.com	LMWesttown@aol.com	gMlukGrczj.rar
2022/11/13 11:19:47	10.101.0.231	20221113031947.002679@Attacker	administrator@enterpr1se.com	hruser@enterprise.com	Emergency. Check this file.	hruser@enterprise.com	administrator@enterpr1se.com	csBFbDCltQ.rar
2022/11/13 11:16:57	10.101.0.231	20221113031657.002637@Attacker	administrator@enterpr1se.com	hruser@enterprise.com	Emergency. Check this file.	hruser@enterprise.com	administrator@enterpr1se.com	MVkHpqBOeC.rar
2022/11/13 11:13:35	10.101.0.179	20221113031335.000001@290ee60db43a	stighammond@gmail.com	hruser@enterprise.com	For Sale !!! 50% off !!!	hruser@enterprise.com	stighammond@gmail.com	UvkBWTNtgy.rar



Attachment Name
~~YKxQgVzPWx.rar~~
csBFbDCltQ.rar


Callback Host
webshop.xyz.com

Callback Port
~~41515~~
56239

Mail To
hruser@enterprise.com

Message Id
~~20221113061238.000001@1845815f3016~~
20221113031947.002679@Attacker

User
~~SYSTEM~~
hruser
