ashemerey_ch1.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Web Server Case\n",
    "===\n",
    "\n",
    "Challenge from http://www.ashemery.com/dfir.html#Challenge1\n",
    "\n",
    "\n",
    "Challenge questions from author:\n",
    "---\n",
    "\n",
    "To successfully solve this challenge, a report with answers to the tasks below is required:\n",
    "\n",
    "1.    What type of attacks has been performed on the box?\n",
    "1.    How many users has the attacker(s) added to the box, and how were they added?\n",
    "1.    What leftovers (files, tools, info, etc) did the attacker(s) leave behind? (assume our team arrived in time and the attacker(s) couldn’t clean and cover their tracks)\n",
    "1.    What software has been installed on the box, and were they installed by the attacker(s) or not?\n",
    "1.    Using memory forensics, can you identify the type of shellcode used?\n",
    "1.    What is the timeline analysis for all events that happened on the box?\n",
    "1.    What is your hypothesis for the case, and what is your approach in solving it?\n",
    "1.    Is there anything else you would like to add?\n",
    "\n",
    "__Bonus Question__: what are the directories and files, that have been added by the attacker(s)? List all with proof.\n",
    "\n",
    "__Important Note__: do not use commercial tools for your own learning benefit.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Memory Triage\n",
    "===\n",
    "\n",
    "Used these environment variables and _vol7.sh_ acript from dfirnotes.net rules [repo](https://github.com/dfirnotes/rules/).\n",
    "```\n",
    "VOLATILITY_FILEIN=memdump.mem\n",
    "VOLATILITY_LOCATION=file:///cases/ashmery/ch1/memdump.mem\n",
    "VOLATILITY_PROFILE=VistaSP2x86\n",
    "OUT_FOLDER=.\n",
    "```\n",
    "\n",
    "Batch processed memdump.mem after identifing Volatility profile to try with _imageinfo_. Reviewed process tree and network connection data for suspicious process patterns. There connections stood out as possibly unusual:\n",
    "\n",
    "```\n",
    "...\n",
    "0x3ef81c18         TCPv6    fe80::3816:d72e:759b:76b9:3306 ff02::1:3:51128      CLOSED           2804     mysqld.exe     \n",
    "...\n",
    "0x3f22c008         TCPv4    192.168.56.101:51157           192.168.56.1:5357    ESTABLISHED      1108     svchost.exe    \n",
    "0x3ffc88f0         TCPv4    192.168.56.101:51160           192.168.56.1:139     CLOSED           4        System         \n",
    "0x3ffd4008         TCPv4    192.168.56.101:51159           192.168.56.1:139     CLOSED           4        System        \n",
    "```\n",
    "\n",
    "In the process tree data, after the Xampp apache/mysql control panel, httpd, ftpd, and mysqld, we see two cmd.exe processes both with parent explorer.exe.\n",
    "\n",
    "```\n",
    "adric@marie:/cases/ashmery/ch1⟫ grep -B5 cmd *pstree.txt                                                       \n",
    ". 0x83faa020:xampp-control.e                         2768    816      2    119 2015-08-23 10:32:17 UTC+0000\n",
    ".. 0x83e4d7c0:httpd.exe                              2796   2768      1     92 2015-08-23 10:32:21 UTC+0000\n",
    "... 0x83fd77a8:httpd.exe                             2880   2796    155    483 2015-08-23 10:32:26 UTC+0000\n",
    ".. 0x83fd5200:FileZillaServer                        2856   2768      5     35 2015-08-23 10:32:25 UTC+0000\n",
    ".. 0x83f9ec70:mysqld.exe                             2804   2768     23    570 2015-08-23 10:32:23 UTC+0000\n",
    ". 0x83e7b7f8:cmd.exe                                  612    816      1     72 2015-08-23 10:30:44 UTC+0000\n",
    ". 0x84259100:cmd.exe                                 1972    816      1     19 2015-09-02 09:28:30 UTC+0000\n",
    "```\n",
    "\n",
    "Parent process of XAmpp Control, VBoxTray, both cmds and the FTK Imager process that likey captured the memory is _explorer.exe_. This suggests these programs were all initiated by an interactive user.\n",
    "\n",
    "```\n",
    "adric@marie:/cases/ashmery/ch1⟫ grep 816 *pstree.txt*\n",
    " 0x83e368e0:explorer.exe                              816    676     22    756 2015-08-23 10:30:34 UTC+0000\n",
    ". 0x83e652a0:VBoxTray.exe                            1816    816      8    114 2015-08-23 10:30:38 UTC+0000\n",
    ". 0x83f68300:FTK Imager.exe                          2120    816     13    382 2015-09-03 10:03:37 UTC+0000\n",
    ". 0x83faa020:xampp-control.e                         2768    816      2    119 2015-08-23 10:32:17 UTC+0000\n",
    ". 0x83e7b7f8:cmd.exe                                  612    816      1     72 2015-08-23 10:30:44 UTC+0000\n",
    ". 0x84259100:cmd.exe                                 1972    816      1     19 2015-09-02 09:28:30 UTC+0000\n",
    "```\n",
    "\n",
    "The Volatility plugin _cmdline_ revealed no arguments for either _cmd.exe_ process (612 or 1972). \n",
    "\n",
    "```\n",
    "adric@marie:/cases/ashmery/ch1⟫ vol.py cmdline -p 612\n",
    "Volatility Foundation Volatility Framework 2.5\n",
    "************************************************************************\n",
    "cmd.exe pid:    612\n",
    "Command line : \"C:\\Windows\\System32\\cmd.exe\" \n",
    "adric@marie:/cases/ashmery/ch1⟫ vol.py cmdline -p 612 -p 1972\n",
    "Volatility Foundation Volatility Framework 2.5\n",
    "************************************************************************\n",
    "cmd.exe pid:   1972\n",
    "Command line : \"C:\\Windows\\System32\\cmd.exe\" \n",
    "```\n",
    "\n",
    "Digging further, I checked the batch processed output of the volatility _consoles_ plugin looking or command history or details from the cmd.exe processes in _memdump.mem-vol25c-consoles.txt_. There are some commands logged as well as some screen capture.\n",
    "\n",
    "```\n",
    "Cmd #0 at 0xe907c8: ipconfig\n",
    "Cmd #1 at 0xe91af8: cls\n",
    "Cmd #2 at 0xe91db0: ipconfig\n",
    "Cmd #3 at 0x5a34bd0: net user user1 user1 /add\n",
    "Cmd #4 at 0x5a34eb8: net user user1 root@psut /add\n",
    "Cmd #5 at 0x5a34c10: net user user1 Root@psut /add\n",
    "Cmd #6 at 0x5a24800: cls\n",
    "Cmd #7 at 0x5a34c58: net /?\n",
    "Cmd #8 at 0x5a34d88: net localgroup /?\n",
    "Cmd #9 at 0x5a34f48: net localgroup \"Remote Desktop Users\" user1 /add\n",
    "Cmd #10 at 0x5a34c70: net /?\n",
    "Cmd #11 at 0xe911b0: netsh /?\n",
    "Cmd #12 at 0xe907e8: netsh firewall /?\n",
    "Cmd #13 at 0xe91218: netsh firewall set service type = remotedesktop /?\n",
    "Cmd #14 at 0xe91288: netsh firewall set service type = remotedesktop enable\n",
    "Cmd #15 at 0xe91300: netsh firewall set service type=remotedesktop mode=enable\n",
    "Cmd #16 at 0xe91380: netsh firewall set service type=remotedesktop mode=enable scope=subnet\n",
    "```\n",
    "\n",
    "It certainly looks as though the cmd process \"AttachedProcess: cmd.exe Pid: 612 Handle: 0x2d8\" was used to add a user _user1_ (at least) and grant the user remote access via group membership, and that firewall rules were changed to allow Remote Desktop access to the system. We'll need to dig deeper and probably look at the disk evidence to find out how that occurred. Also, there were mistyped commands and usuage statements displayed, storngly suggesting an interactive human user was responsible.\n",
    "\n",
    "A ClamAV scan of the modules dumped by the batch Voaltility run found no known malware."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Disk Ingest\n",
    "===\n",
    "\n",
    "After extraction we have a raw disk image. We can check the layout with Sleuthkit _mmls_ and then mount it up before processing the raw image into Plaso for super timeline.\n",
    "\n",
    "```\n",
    "$ file s4a-challenge4\n",
    "s4a-challenge4: x86 boot sector\n",
    "\n",
    "adric@marie:/cases/ashmery/ch1⟫ mmls s4a-challenge4\n",
    "DOS Partition Table\n",
    "Offset Sector: 0\n",
    "Units are in 512-byte sectors\n",
    "\n",
    "      Slot      Start        End          Length       Description\n",
    "000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)\n",
    "001:  -------   0000000000   0000002047   0000002048   Unallocated\n",
    "002:  000:000   0000002048   0052426751   0052424704   NTFS / exFAT (0x07)\n",
    "003:  -------   0052426752   0052428799   0000002048   Unallocated\n",
    "```\n",
    "\n",
    "Mount NFTS with _mountwin_ alias options from SIFT and calculated offset from partition table in mmls output.\n",
    "\n",
    "```\n",
    "sudo mount -o ro,loop,show_sys_files,streams_interface=windows,offset=$((2048 * 512)) s4a-challenge4 /mnt/windows_mount\n",
    "```\n",
    "\n",
    "Ingest entire disk \"kitchen sink\" style with simple Plaso invocation:\n",
    "\n",
    "```\n",
    "log2timeline.py ch1.plaso s4a-challenge4\n",
    "```\n",
    "\n",
    "Plaso info:\n",
    "\n",
    "```\n",
    "************************** Plaso Storage Information ***************************\n",
    "            Filename : ch1.plaso\n",
    "      Format version : 20160715\n",
    "Serialization format : json\n",
    "--------------------------------------------------------------------------------\n",
    "\n",
    "*********************************** Sessions ***********************************\n",
    "ef3aea58-1fec-47cd-b2a7-4ea67949e84d : 2017-02-05T06:14:17.586957+00:00\n",
    "--------------------------------------------------------------------------------\n",
    "\n",
    "**************** Session: ef3aea58-1fec-47cd-b2a7-4ea67949e84d *****************\n",
    "                Start time : 2017-02-05T06:14:17.586957+00:00\n",
    "           Completion time : 2017-02-05T06:42:22.275277+00:00\n",
    "              Product name : plaso\n",
    "           Product version : 1.5.1\n",
    "    Command line arguments : /usr/bin/log2timeline.py ch1.plaso s4a-challenge4\n",
    "  Parser filter expression : win7\n",
    "Enabled parser and plugins : android_app_usage, asl_log, bencode,\n",
    "                             bencode/bencode_transmission,\n",
    "                             bencode/bencode_utorrent, binary_cookies, bsm_log,\n",
    "                             chrome_cache, chrome_preferences, cups_ipp,\n",
    "                             custom_destinations, dockerjson, dpkg, esedb,\n",
    "                             esedb/esedb_file_history, esedb/msie_webcache,\n",
    "                             filestat, firefox_cache, firefox_cache2, hachoir,\n",
    "                             java_idx, lnk, mac_appfirewall_log, mac_keychain,\n",
    "                             mac_securityd, mactime, macwifi,\n",
    "                             mcafee_protection, mft, msiecf, olecf,\n",
    "                             olecf/olecf_automatic_destinations,\n",
    "                             olecf/olecf_default, olecf/olecf_document_summary,\n",
    "                             olecf/olecf_summary, openxml, opera_global,\n",
    "                             opera_typed_history, pe, plist, plist/airport,\n",
    "                             plist/apple_id, plist/ipod_device,\n",
    "                             plist/macosx_bluetooth,\n",
    "                             plist/macosx_install_history, plist/macuser,\n",
    "                             plist/maxos_software_update, plist/plist_default,\n",
    "                             plist/safari_history, plist/spotlight,\n",
    "                             plist/spotlight_volume, plist/time_machine,\n",
    "                             pls_recall, popularity_contest, prefetch,\n",
    "                             recycle_bin, recycle_bin_info2, rplog, sccm,\n",
    "                             selinux, skydrive_log, skydrive_log_old, sqlite,\n",
    "                             sqlite/android_calls, sqlite/android_sms,\n",
    "                             sqlite/appusage, sqlite/chrome_cookies,\n",
    "                             sqlite/chrome_extension_activity,\n",
    "                             sqlite/chrome_history, sqlite/firefox_cookies,\n",
    "                             sqlite/firefox_downloads, sqlite/firefox_history,\n",
    "                             sqlite/google_drive, sqlite/imessage,\n",
    "                             sqlite/kik_messenger, sqlite/ls_quarantine,\n",
    "                             sqlite/mac_document_versions,\n",
    "                             sqlite/mackeeper_cache, sqlite/skype,\n",
    "                             sqlite/twitter_ios, sqlite/zeitgeist,\n",
    "                             symantec_scanlog, syslog, syslog/cron, syslog/ssh,\n",
    "                             usnjrnl, utmp, utmpx, winevt, winevtx,\n",
    "                             winfirewall, winiis, winjob, winreg,\n",
    "                             winreg/appcompatcache, winreg/bagmru,\n",
    "                             winreg/ccleaner, winreg/explorer_mountpoints2,\n",
    "                            winreg/explorer_programscache,\n",
    "                             winreg/microsoft_office_mru,\n",
    "                             winreg/microsoft_outlook_mru,\n",
    "                             winreg/mrulist_shell_item_list,\n",
    "                             winreg/mrulist_string,\n",
    "                             winreg/mrulistex_shell_item_list,\n",
    "                             winreg/mrulistex_string,\n",
    "                             winreg/mrulistex_string_and_shell_item,\n",
    "                             winreg/mrulistex_string_and_shell_item_list,\n",
    "                             winreg/msie_zone, winreg/mstsc_rdp,\n",
    "                             winreg/mstsc_rdp_mru, winreg/network_drives,\n",
    "                             winreg/userassist, winreg/windows_boot_execute,\n",
    "                             winreg/windows_boot_verify, winreg/windows_run,\n",
    "                             winreg/windows_sam_users, winreg/windows_services,\n",
    "                             winreg/windows_shutdown,\n",
    "                             winreg/windows_task_cache,\n",
    "                             winreg/windows_timezone,\n",
    "                             winreg/windows_typed_urls,\n",
    "                             winreg/windows_usb_devices,\n",
    "                             winreg/windows_usbstor_devices,\n",
    "                             winreg/windows_version, winreg/winlogon,\n",
    "                             winreg/winrar_mru, winreg/winreg_default,\n",
    "                             xchatlog, xchatscrollback, zsh_extended_history\n",
    "        Preferred encoding : UTF-8\n",
    "                Debug mode : False\n",
    "               Filter file : N/A\n",
    "         Filter expression : N/A\n",
    "--------------------------------------------------------------------------------\n",
    "************************* Events generated per parser **************************\n",
    "                Parser (plugin) name : Number of events\n",
    "--------------------------------------------------------------------------------\n",
    "                      appcompatcache : 360\n",
    "                              bagmru : 46\n",
    "               explorer_mountpoints2 : 38\n",
    "              explorer_programscache : 2\n",
    "                            filestat : 262786\n",
    "                                 lnk : 320\n",
    "                      mrulist_string : 3\n",
    "           mrulistex_shell_item_list : 3\n",
    "                    mrulistex_string : 1\n",
    "mrulistex_string_and_shell_item_list : 1\n",
    "                           msie_zone : 66\n",
    "                              msiecf : 104\n",
    "                       olecf_default : 11\n",
    "                                  pe : 53511\n",
    "                         shell_items : 690\n",
    "                          userassist : 22\n",
    "                windows_boot_execute : 14\n",
    "                         windows_run : 3\n",
    "                    windows_services : 2257\n",
    "                    windows_shutdown : 6\n",
    "                  windows_task_cache : 92\n",
    "                    windows_timezone : 7\n",
    "                  windows_typed_urls : 1\n",
    "                 windows_usb_devices : 18\n",
    "                    windows_timezone : 7\n",
    "                  windows_typed_urls : 1\n",
    "                 windows_usb_devices : 18\n",
    "                     windows_version : 6\n",
    "                             winevtx : 3455\n",
    "                            winlogon : 9\n",
    "                      winreg_default : 379419\n",
    "                               Total : 703251\n",
    "--------------------------------------------------------------------------------\n",
    "\n",
    "*********************************** Error: 0 ***********************************\n",
    "           Message : unable to open file with error:\n",
    "                     pymsiecf_file_open_file_object: unable to open file.\n",
    "                     libmsiecf_hash_table_read: unsupported signature.\n",
    "                     libmsiecf_io_handle_read_hash_table: unable to read hash\n",
    "                     table at offset: 16384. libmsiecf_file_open_read: unable\n",
    "                     to read hash table. libmsiecf_file_open_file_io_handle:\n",
    "                     unable to read from file handle.\n",
    "      Parser chain : msiecf\n",
    "Path specification : type: OS, location: /cases/ashmery/ch1/s4a-challenge4\n",
    "                   : type: TSK_PARTITION, location: /p1, part index: 2, start\n",
    "                     offset: 0x00100000\n",
    "                   : type: TSK, inode: 62329, location:\n",
    "                     /Users/Administrator/AppData/Local/Microsoft/Windows/History/History.IE5/MSHist012015090320150904/index.dat\n",
    "--------------------------------------------------------------------------------\n",
    "No analysis reports stored.\n",
    "```\n",
    "\n",
    "With disk now mounted we can extract key files for more processing and extract supertimeline data for analysis.\n",
    "\n",
    "```\n",
    "adric@marie:/cases/ashmery/ch1⟫ psort.py ch1.plaso -o l2tcsv -w ch1_supertl_ks.csv\n",
    "\n",
    "plaso - psort version 1.5.1\n",
    "\n",
    "Storage file    : ch1.plaso\n",
    "\n",
    "Identifier              PID     Status          Events          Tags            Reports\n",
    "Main                    21474   exporting       703251 (0)      0 (0)           0 (0)\n",
    "\n",
    "Processing completed.\n",
    "\n",
    "*********************************** Counter ************************************\n",
    "        Events processed : 703251\n",
    "Duplicate events removed : 22562\n",
    "--------------------------------------------------------------------------------\n",
    "adric@marie:/cases/ashmery/ch1⟫ wc -l ch1_supertl_ks.csv \n",
    "680690 ch1_supertl_ks.csv\n",
    "```\n",
    "\n",
    "Given the role of the system the web logs should be of interest. Once we link the web logs with the process creation we should have some times worth investigating in the super timeline."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "XAMPP Web Logs\n",
    "===\n",
    "\n",
    "The Apache logs are found in the mounted disk image in an obvious location in the C:\\xampp\\ folder structure.\n",
    "\n",
    "```\n",
    "adric@marie:/cases/ashmery/ch1⟫ ls -lh /mnt/windows_mount/xampp/apache/logs/\n",
    "total 1.7M\n",
    "-rwxrwxrwx 1 root root 1.6M Sep  3  2015 access.log\n",
    "-rwxrwxrwx 1 root root 5.4K Aug 23  2015 error.log\n",
    "-rwxrwxrwx 1 root root    6 Aug 23  2015 httpd.pid\n",
    "-rwxrwxrwx 1 root root 3.1K Jul 12  2015 install.log\n",
    "-rwxrwxrwx 2 root root    0 Aug 23  2015 ssl_request.log\n",
    "```\n",
    "\n",
    "A quick peak at the access logs' last two lines to see what the fields and time format look like is quite suggestive of our scenario. We also see that Apache is logging in UTC-7 so we'll need to be mindful of that comparing to our other time data:\n",
    "\n",
    "```\n",
    "adric@marie:/mnt/windows_mount/xampp/apache/logs⟫ tail -2 access.log \n",
    "192.168.56.102 - - [03/Sep/2015:00:31:30 -0700] \"POST /dvwa/vulnerabilities/upload/ HTTP/1.1\" 200 4722 \"http://192.168.56.101/dvwa/vulnerabilities/upload/\" \"Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.2.0\"\n",
    "192.168.56.102 - - [03/Sep/2015:00:31:54 -0700] \"GET /dvwa/hackable/uploads/phpshell2.php HTTP/1.1\" 200 2 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.2.0\"\n",
    "```\n",
    "\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}