Sherlock - Crown-Jewel-2 (Linux Env.) - English

/opt/chainsaw/chainsaw dump *.evtx --json > events.json 

{"product":
	{
	"productID": 101,
	"productName": "Wireless Mouse",
	"dimensions": {
		"width": "2.5 inches",
		"height": "1.5 inches",
		"depth": "4 inches"
		}
	}
} 

cat product.json | jq '.product.dimensions.depth' 

cat product.json | jq '.product | .dimensions.depth' 

Tasks

Task 1. When utilizing ntdsutil.exe to dump NTDS on disk, it simultaneously employs the Microsoft Shadow Copy Service. What is the most recent timestamp at which this service entered the running state, signifying the possible initiation of the NTDS dumping process?

• From resolving CrownJewel-1, we know that the event responsible for changing the states of a service is 7036 and that the name of the service is Volume Shadow Copy.

• We will use this command to retrieve all the timestamps of that event for that service and remove the duplicates:

cat events.json | jq '.[].Event | select(.System.EventID == 7036) | select(.EventData.param1 == "Volume Shadow Copy") | .System.TimeCreated_attributes.SystemTime'|sort -u 

• Now we will only need to keep the most recent timestamp.

Task 2. Identify the full path of the dumped NTDS file.

• First, we will filter by ntds.dit:

cat events.json | grep -i ntds.dit 

• Any path different from Windows/NTDS/ntds.dit (the default path for ntds.dit) is indicative of malicious behavior.

• Of all of them, C:\\Windows\\Temp\\dump_tmp\\Active Directory\\ntds.dit seems to be the one, as naming a directory dump_tmp suggests the intention to create a temporary dump.

Task 3. When was the database dump created on the disk?

• We know the location where the database was dumped, so we will filter the events by the dump_tmp directory:

cat events.json | jq '.[].Event' -c | grep -i dump_tmp | jq . 

• It will return three events with IDs 330, 325, 327.

• Since event 325 is the one that is triggered when the new database is created, we will use its timestamp.

Task 4. When was the newly dumped database considered complete and ready for use?

• After event 325, event 327 is executed, which indicates that the database has been detached, so the answer should be the timestamp of event 327 that we retrieved earlier.

Task 5. Event logs use event sources to track events coming from different sources. Which event source provides database status data like creation and detachment?

• The event source that provides the status of the database is ESENT, as we can see in the events we retrieved in question 3.

Task 6. When ntdsutil.exe is used to dump the database, it enumerates certain user groups to validate the privileges of the account being used. Which two groups are enumerated by the ntdsutil.exe process? Give the groups in alphabetical order joined by comma space.

• The process that is triggered when groups are enumerated is 4799.

• We will retrieve the names of the groups displayed in the .EventData.TargetUserName field, filtering by event 4799 when is called by ntdsutil.exe:

cat events.json | jq '.[].Event | select(.System.EventID == 4799) | select(.EventData.CallerProcessName | test("ntdsutil.exe")) | .EventData.TargetUserName'|sort -u 

• It will return:
  • “Administrators"
  • "Backup Operators”

Task 7. Now you are tasked to find the Login Time for the malicious Session. Using the Logon ID, find the Time when the user logon session started.

• As the hint states, authentication in domain environments is carried out with Kerberos, and it is associated with events 4768 and 4769.

• First, we look for a username in event 4768 that is neither a service nor a machine:

cat events.json | jq '.[].Event | select(.System.EventID == 4768) | .EventData.TargetUserName' 

• This returns:

  • “DC01$"
  • "DC01$"
  • "Administrator”

• The only one with a username is Administrator.

• We will look for the 4768 event of Administrator:

cat events.json | jq '.[].Event | select(.System.EventID == 4768) | select(.EventData.TargetUserName == "Administrator")' 

• We keep the timestamp down to the seconds, as the hint tells us that events 4768, 4769, and 5379 are executed sequentially (one immediately after the other).

• Now we need to search for the events that contain the logon ID, which are the 5379 events.

• We filter by the previous timestamp.

cat events.json | jq '.[].Event | select(.System.EventID == 5379) | select(.System.TimeCreated_attributes.SystemTime | test("2024-05-15T05:36:31"))' 

• It returns 3 events with logon ID 0x8de3d (in the SubjectLogonId field) and all with the same timestamp, the same one we used to filter. That is the answer to the question.

That's it!