AfricanFalls Lab | CyberDefenders

Reconstruct a suspect’s digital activities and intent by analyzing browser history, system artifacts, deleted files, and credentials from a disk image using various forensic tools.

Lab URL: https://cyberdefenders.org/blueteam-ctf-challenges/africanfalls/

Scenario

John Doe was accused of doing illegal activities. A disk image of his laptop was taken. Your task as a soc analyst is to analyze the image and understand what happened under the hood.

Tools we need for this lab

• FTK imager
• DB browser (SQL lite)
• PECmd by Eric Zimmerman
• Timeline browser
• Mimikatz

Lets get started

Q1:What is the MD5 hash value of the suspect disk?

first here I tried to get the ad1 hash using powershell’s “get-filehash” but this answer didn’t work out.

so I opened the txt file came with it “DiskDigger.ad1.txt” and in the end of it you can find Image Verification results. which has the MD5 hash.

Q2:What phrase did the suspect search for on 2021-04-29 18:17:38 UTC? (three words, two spaces in between)

ok here we need first to extract the history file of chrome so we can proceed with DB browser for SQLlite.

• first we open our FTK imager
• File > Add evidence item
• choose image file.
• then browse and go the the lab’s .ad1 file and finish

now we open browse the folder and we need to extract the history file which can be found under the following path:

• C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default
• you right click on “history” file and export it

then we open our DB browser for SQLite and open the history file we extracted.

• we go to browse data
• we choose the table “urls”
• you can find so many entires here in the table which has the user searches.
• knowing that the timestamps here are in chromium format
• so to narrow down our search we need to convert the UTC timestamp to chromium
• after search didn’t find direct way to convert UTC > Chromium
• so I choose to convert it to convert UTC > Unix and then Unix > Chromium

so I order to convert to Chromium timestamp I used the following formula:

(Unix + 11644473600) * 1000000

now when I searched using the result number I didn’t get an answer so I started searching number by number till I found the entry 88 in the table matches me.

to double check we get the chromium timestamp we have. I go to **https://www.epochconverter.com/webkit **when I copy it I get the exact time in the question.

Note: I could find the converter from Chromium timestamp but not to it directly.

making the answer of this question is:

password cracking lists

Q3:What is the IPv4 address of the FTP server the suspect connected to?

ok here you may wonder how can you find the logs of FTP connections. if you had a sharp eyes you would notice in our journey to chrome’s history you can find FileZilla under the AppData/Local path.

Filezilla is an FTP client

so now in order to get the connection logs you can find it in the path

• AppData/Roaming/FileZilla
• you can find a file called recentservers.xml

as you can see there was a connection towards the IP 192.168.1.20 on port 21

Q4:What date and time was a password list deleted in UTC? (YYYY-MM-DD HH:MM:SS UTC)

ok here we can go the $RecycleBin Path in ftk imager. when we browse it we can find in some folder that there is a deleted file which looks to be a password list as shown.

so Ok now you may rush and go type 2021–04–29 18:19 in the answer but it won’t work.

so why?

when you delete a file it actually goes to a hidden folder “$Recycle.Bin\<UserID>”

there are 2 files saved for that file deleted:

• one starting with $R<fileID> which is the actual file deleted
• the second one starts with $I<fileID> which has the metadata “file name, deletion time, etc”

so that makes our answer:

2021–04–29 18:22

Q5:How many times was Tor Browser ran on the suspect's computer? (number only)

ok here “Prefetch” folder can help us. why?

as prefetch stores data about programs when they run. for example:

• lets say you ran x.exe
• a file called x..EXE-<someID>.pf is created under the prefetch folder
• which contains the name of the executable, last time executed, number of times it has been executed, etc.

in this question we will need PECmd.exe and Timeline explorer.

ok we go back to our FTK imager to export the Prefetch folder under the path:

C:\Windows\Prefetch

and now we will utilize PECmd.exe to parse and extract us a CSV which we be needed later:

PECmd.exe -d <PrefechDirectoryPath> — csv prefetch

now we get that CSV and open it using Timeline explorer:

when we search using Tor keyword we find only the Tor browser installation had been executed. but we can’t find the Tor browser itself.

making our answer: 0 as didn’t run it.

Q6:What is the suspect's email address?

now we will use our tool Autopsy. as DB broswer for SQLite won’t be very helpful here.

first you will extract the file starting with windows partition in FTK imager:

• you create a new case in autopsy
• then you add a new data source
• you select the folder you’ve extracted by FTK imager
• then it opens up to you

In order to check it:

• Data Artifacts > Web history
• we browse here till we find mail urls

we can find the email address as shown:

• dreammaker82@protonmail.com

Q7:What is the FQDN did the suspect port scan?

here we need to check the installed programs to check if we can find any clues for any well-known port scanning program.

and yes we can find Nmap installed in that device.

so now we need to check the powershell commandline history logs to check if the user ran nmap using it.

which can be found in:

C:\Users\<username>\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

you extract it and inspect it:

you can find here that the user ran:

nmap dfir.science

Q10:A Windows password hashes for an account are below. What is the user's password? Anon:1001:aad3b435b51404eeaad3b435b51404ee:3DE1A36F6DDB8E036DFD75E8E20C4AF4:::

here we can see that the actually MD5 hash part is: 3DE1A36F6DDB8E036DFD75E8E20C4AF4

I tried to crack it using john the wripper with rockyou wordlist but didn’t find.

so I tried hashes.com and I found the answer successfully:

Q11:What is the user "John Doe's" Windows login password?

in this question we need to get the SAM database file which contains the user’s and their password hashes and we need also the SYSTEM file as it has the syskey required to decrypt the SAM database.

you can find both under:

**C:\Windows\System32\config\SAM**

and we need the tool Mimikatz.

we open our Mimikatz.exe

and we run the following command:

lsadump::sam /system:<systemPath> /sam:<samPath>

which will dump us the SAM database.

when we inspect the output we can find John Doe’s NTLM hash.

we copy it to hashes.com and yes we can find the answer!

Thanks & Regards