Jinkies a HTB Writeup

This writeup documents my analysis of the Jinkies sherlock on HackTheBox. In this challenge we are given a kape image of a compromised machine. Let’s analyze the attack happened…

Which folders were shared on the host? (Please give your answer comma separated, like this: c:\program files\share1, D:\folder\share2)

To inspect which folders were shared on the network we can simply refer to this path HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares on the SYSTEM registry hive.

Inspecting the above path in Registry Explorer i found two paths that are shared C:\Users, C:\Users\Velma\Documents.

What was the file that gave the attacker access to the user’s account?

Navigating the C\users\Velma\Documents folder i noticed a project related to a web login application that contained the database file under the path C\users\Velma\Documents\Python Scripts + things\web server project\testing\logon website\bk\bk_db.ibd.

An IBD file is an internal database file used by MySQL and its InnoDB storage engine to save table data, indexes, and structures.

I couldn’t parse it in DB viewer and there is probably better ways to parse this file and view its contents but i am lazy so im using strings.

Searching for the user Velma confirms the credentials are present on this file making it the file used by the attacker to get access.

How many user credentials were found in the file?

Using a simple linux command strings ./bk_db.ibd | grep "@" | wc -l to filter for emails and count the lines we get the answer 216.

What is the NT hash of the user’s password?

Isolating Velma’s row from the db file using strings [email protected] dinkley the part peakTwins2023fc refers to the password, ntlm hashing it we get 967452709ae89eaeef4e2c951c3882ce

Is the user’s computer password the same as the password found in the ibd file? (Yes or No)

Having the SAM and SYSTEM hives we can easily dump the local user’s ntlm hashes using impacket secretsdump.py

The ntlm hash for Velma is indeed the same which means she used the same password for the local machine as well as the web app (not good).

What was the time the attacker first interactively logged on to our user’s host?

Opening the Security.evtx log in Event Viewer and filtering for successful logons (Event Id 4624) i searched for the username Velma to find the related events quicker then it was just a matter of finding the event with the logon type set to 3 (network login).

After trying to bruteforce the answer with different event timestamps i found the correct answer. The attacker logged on at exactly 2023-10-06 17:17:23.

What’s the first command the attacker issues into the Command Line?

Switching to the Sysmon logs and filtering for Event Id 1 (Process Creation) i identified events that occurred right after the attacker logged on to the machine and find cmd was ran followed by whoami

What is the name of the file that the attacker opens in VSCode shortly before launching the web browser?

Still in the Sysmon logs searching for events related to VScode process creation. i identified a file being opened near the time of the attacker logging on to the machine. Its name is Version-1.0.1 - TERMINAL LOGIN.py

What’s the domain name of the location the attacker likely exfiltrated the file to?

Browsing the Velma users AppData directory i identified chrome’s History database file on the following path \TriageData\C\users\Velma\Appdata\Local\Google\Chrome\User Data\Default

The Chrome history file is a local database named History that stores your web browsing records, search terms, and download details using the SQLite format

Parsing the database file in DB Viewer and searching through the urls table. The only site that could be used for data exfiltration is pastes.io.

What is the handle of the attacker?

its pwnmaster12 here i realized no one is gonna read this probably and i am too lazy to explain how i found the answer so i am gonna say it was revealed to me in a dream.