I Have Solved PsExec Hunt Lab Challenge

Hi, it’s me Ammar. Today I’m going to discuss how I completed the challenge given by CyberDefenders. This time, I was given a scenario like the one below;

An alert from the Intrusion Detection System (IDS) flagged suspicious lateral movement activity involving PsExec. This indicates potential unauthorized access and movement across the network. As a SOC Analyst, your task is to investigate the provided PCAP file to trace the attacker’s activities. Identify their entry point, the machines targeted, the extent of the breach, and any critical indicators that reveal their tactics and objectives within the compromised environment.

Question 1

To effectively trace the attacker’s activities within our network, can you identify the IP address of the machine from which the attacker initially gained access?

Answer:

IP-to-IP communication statistics

Use Wireshark’s "Statistics" menu and then select "Conversations" to view multiple IPv4 communications. The image above shows that IP 10.0.0.130 is sending the most packets, with a total volume of 7 MB.

Question 2

To fully understand the extent of the breach, can you determine the machine’s hostname to which the attacker first pivoted?

Answer:

Result filtering ntlmssp

By filtering using ntlmssp.challenge.target_name , then paying attention to the wrong packet with the SMB protocol, right in the packet details it was found that the name SALES-PC matched the response format.

Question 3

Knowing the username of the account the attacker used for authentication will give us insights into the extent of the breach. What is the username utilized by the attacker for authentication?

Answer:

Attacker account’s username

So, to find the account name used for the attack is to do filtering ntlmssp.auth.username, Then, examine the fields in the 'Info' column. Finally, compare it to the attacker’s sequence of events, as authentication should occur immediately before accessing the ADMIN$ or IPC$ shares. This reveals the account name used is ssales.

Question 4

After figuring out how the attacker moved within our network, we need to know what they did on the target machine. What’s the name of the service executable the attacker set up on the target?

Answer:

SMB object list

The image above shows the result of using Wireshark to identify objects using the SMB protocol. To do this, simply go to File > Export Objects > SMB. This will reveal PSEXESVC as the name of the executable service file set up on the target.

Question 5

We need to know how the attacker installed the service on the compromised machine to understand the attacker’s lateral movement tactics. This can help identify other affected systems. Which network share was used by PsExec to install the service on the target machine?

Answer:

Result of filtering smb tree

Initially, PsExec will connect to IPC$ to establish a communication session and manage Named Pipes. To execute commands, PsExec will copy the PSEXESVC.exe file to the ADMIN$ service, a hidden administrative share located directly in the Windows system directory.

Question 6

We must identify the network share used to communicate between the two machines. Which network share did PsExec use for communication?

Answer:

Result of filtering smb tree

Based on the SMB protocol, the first connection made by PsExec is to authenticate and establish an initial communication session with the target machine. PsExec will then use ADMIN$ to place the executable file, all Named Pipes mechanisms used to control remote services and send data streams such as stdin, stdout, and stderr run on the IPC$ share connection.

Question 7

Now that we have a clearer picture of the attacker’s activities on the compromised machine, it’s important to identify any further lateral movement. What is the hostname of the second machine the attacker targeted to pivot within our network?

Answer:

Second machine’s hostname

Using the ntlmssp.challenge.target_name filter would reveal evidence that the attacker is attempting to identify or register with the new target system to continue lateral movement. Therefore, based on existing network forensics evidence, the hostname of the second machine targeted by the attacker’s pivoting is MARKETING-PC.