CyberDefenders: Insider Walkthrough

Following the evidence left behind inside a forensic image.

In this challenge, we are tasked with investigating a forensic disk image to determine what actions were performed on the system and whether any suspicious activity took place.

To examine the evidence, we will use FTK Imager, a digital forensics tool commonly used to access and analyze disk images without modifying the original data. By exploring the contents of the image and reviewing artifacts left behind by the user, we can reconstruct activity on the system and better understand the events that occurred.

Throughout this walkthrough, we will analyze the available evidence, correlate findings across multiple artifacts, and piece together the user’s actions to uncover the full story behind the investigation.

Before beginning the investigation, the forensic image must be loaded into FTK Imager.

To do this, open FTK Imager and navigate to:

File → Add Evidence Item

Select Image File as the evidence type and proceed to the next step. Then browse to the provided forensic image and select the .ad1 file supplied with the challenge.

Once the image is loaded, FTK Imager displays the contents within the Evidence Tree. From here, we can navigate through the file system, examine user artifacts and begin analyzing the evidence relevant to the investigation.

Question 1: Which Linux distribution is being used on this machine?

To identify the operating system, I navigated to the installer directory and examined the lsb-release file within the forensic image. The file contains distribution information, which revealed that the machine was running Kali Linux.

Answer: Kali

Question 2: What is the MD5 hash of the Apache access.log file?

To determine the file’s hash, I navigated to /var/log/apache2 within the forensic image and located the access.log file. After exporting the file from FTK Imager, I reviewed its hash values to obtain the MD5 hash.

The exported file’s hash information revealed the following MD5 value:

Answer: d41d8cd98f00b204e9800998ecf8427e

Question 3: It is suspected that a credential dumping tool was downloaded. What is the name of the downloaded file?

To identify the downloaded tool, I examined the user’s Downloads directory within the forensic image. Among the files present, I found an archive named mimikatz_trunk.zip, a well-known credential dumping utility commonly used to extract passwords and authentication material from compromised systems.

Answer: mimikatz_trunk.zip

Question 4: A super-secret file was created. What is the absolute path to this file?

I initially attempted to locate the file by manually examining directories within the forensic image but was unable to find anything that matched the description. I then reviewed the user’s .bash_history file located in the root user’s home directory, which records previously executed commands. Within the command history, I found commands referencing the creation and access of a file named SuperSecretFile.txt, revealing its full location on the system.

Answer: /root/Desktop/SuperSecretFile.txt

Question 5: What program used the file didyouthinkwedmakeiteasy.jpg during its execution?

To identify which program interacted with the file, I continued examining the user’s .bash_history file. While reviewing the recorded commands, I found an entry showing the execution of binwalk against the file didyouthinkwedmakeiteasy.jpg. This indicates that the file was analyzed using the Binwalk utility during the investigation.

Answer: binwalk

Question 6: What is the third goal from the checklist Karen created?

To find the answer, I examined the files stored on the user’s Desktop and discovered a file named Checklist. Opening the file revealed a list of goals that Karen had created. The third item on the checklist was clearly listed as Profit.

Answer: Profit

Question 7: How many times was Apache run?

To determine whether Apache had been used on the system, I examined the /var/log/apache2 directory. The Apache log files, including access.log, error.log, and other_vhosts_access.log, were all present but had a size of 0 KB, indicating that no web server activity had been recorded.

Answer: 0

Question 8: This machine was used to launch an attack on another. Which file contains the evidence for this?

To identify evidence of the attack, I reviewed the files stored in the root user’s home directory. Among them, the image irZLAohl.jpeg contained a screenshot showing the execution of flightsim, a tool used to generate malicious network traffic. Since the screenshot documents the attack activity, it serves as the relevant evidence.

Answer: irZLAohl.jpeg

Question 9: It is believed that Karen was taunting a fellow computer expert through a bash script within the Documents directory. Who was the expert that Karen was taunting?

I examined the bash scripts stored in the Documents/myfirsthack directory and found the file firstscript_fixed. Reviewing its contents revealed the message:

“Heck yeah! I can write bash too Young”

indicating that Karen was taunting someone named Young.

Answer: Young

Question 10: A user executed the su command to gain root access multiple times at 11:26. Who was the user?

To identify the user, I examined the auth.log file in /var/log and reviewed the entries around 11:26, as specified in the question. The log shows multiple su events referencing the postgres account, revealing the user involved in the activity.

Answer: postgres

Question 11: Based on the bash history, what is the current working directory?

To find the current working directory, I examined the .bash_history file and looked for directory navigation commands. The history shows the user changing into /root/Documents/myfirsthack/, which is the working directory referenced during the recorded activity.

Answer: /root/Documents/myfirsthack/