Artifact Of Dangerous Sighting - HackTheBox Challenge Writeup

Challenge Information

Description

Pandora discovers that someone has been tampering with her computer—specifically, she finds the Windows Event Viewer tab open on the Security log after returning from a coffee break. Concerned about potential sabotage of her research into an elusive relic, she immediately takes protective measures: disconnects from the network, captures a snapshot of her machine, and shuts it down.

The challenge requires analyzing the forensic artifact (a system snapshot) to uncover traces of unauthorized access and determine who attempted to compromise her research.

Solution Overview

This forensics challenge involves analyzing a Windows system snapshot, with focus on the Security Event Log as the primary evidence source. The key to solving this challenge is examining event logs for suspicious activity patterns that indicate unauthorized access or tampering attempts.

Key Steps

1. Extract and Mount the Forensic Image

Begin by extracting the provided forensic artifact and mounting it for analysis:

# Extract the challenge archive
unzip artifact_of_dangerous_sighting.zip

# Mount the Windows filesystem (if provided as .vmdk, .vdi, or raw image)
# For raw/dd images:
mount -o ro,loop,offset=1048576 image.raw /mnt/forensics

# For VirtualBox or VMware images, use appropriate tools:
# vboximg-mount or vmfs-fuse

2. Locate and Extract the Security Event Log

Windows Security event logs are typically stored in:

# Navigate to the Windows Event Log directory
cd /mnt/forensics/Windows/System32/winevt/Logs

# The Security log is stored as Security.evtx
ls -la Security.evtx

3. Parse and Analyze the Event Log

Use forensic tools to extract and parse the Security event log:

# Using Python with python-evtx library
python3 << 'EOF'
import evtx

log_file = "Security.evtx"
parser = evtx.Evtx(log_file)

# Iterate through events and display relevant entries
for record in parser.records():
    event_data = record.xml
    # Filter for suspicious events (logons, privilege escalation, etc.)
    print(event_data)
EOF

# Alternatively, use evtxdump or convert to XML
evtxdump -o output.xml Security.evtx

4. Identify Suspicious Activity

Focus on key event IDs associated with unauthorized access:

# Event IDs to investigate:
# 4625 - Failed login attempts
# 4624 - Successful logon
# 4720 - User account created
# 4732 - User added to security-enabled local group
# 4688 - Process creation
# 5140 - Network share accessed

# Filter for failed logon attempts
grep -i "4625" output.xml | head -20

# Check for successful logons from suspicious sources
grep -i "4624" output.xml

5. Extract the Flag

The malicious activity and evidence of tampering will reveal information that leads to the flag. Analyze:

• Timestamp of suspicious events
• Source IP addresses or account names attempting access
• Process names or commands executed

The flag format is: HTB{<redacted>}

Tools Used

Key Learnings

1. Windows Event Logs as Evidence: The Security event log is a crucial source of forensic evidence on Windows systems, recording authentication attempts, privilege changes, and critical system events.

2. Event ID Significance: Different event IDs indicate different types of system activity. Knowing which IDs represent suspicious behavior (failed logons, privilege escalation, account creation) is essential for forensic analysis.

3. Timeline Analysis: Correlating timestamps across multiple events helps establish a sequence of malicious actions and identify the scope of the compromise.

4. Preservation and Isolation: Pandora’s immediate response (pulling the network cable, taking a snapshot, and shutting down) is the correct forensic procedure for preserving evidence and preventing further tampering.

5. Log Parsing Tools: Proficiency with event log parsing tools is critical in Windows forensics, as manual examination of binary .evtx files is impractical without proper parsers.

Flag: HTB{<redacted>}