Posts

TryHackMe - New Hire Old Artifacts

-
  Investigation Breakdown & Step-by-Step Findings Phase 1: Initial Execution & Password Dumper Identification Objective: Identify the Web Browser Password Viewer executed on the system. Splunk Query: index=* EventCode=1 "Password Viewer" Findings: Full Binary Path: C:\Users\FINANC~1\AppData\Local\Temp\11111.exe Company Name: NirSoft (a well-known utility developer whose tools are frequently abused by threat actors). Phase 2: Secondary Payload & Masquerading Objective: Locate additional binaries executed from the same temporary directory and uncover their true identity. Splunk Query: index=* EventCode=1 CurrentDirectory="*AppData\\Local\\Temp*" Findings: Executed Binary: IonicLarge.exe Original Filename: PalitExplorer.exe (revealed via OriginalFileName field analysis using index=* Image="*IonicLarge.exe*"). Phase 3: Defense Evasion & Persistence Objective: Determine how the malware tampered with local defenses. Splunk Queries: Registry activ...
Post a Comment
Read more

TryHackMe - Forward CFT

-
Image
  Introduction Forward is a medium-difficulty Active Directory machine on TryHackMe. The challenge simulates an assumed-breach scenario where an unprivileged domain account is provided initially. The objective is to enumerate the domain, obtain additional credentials, identify a privilege escalation path, exploit vulnerable Active Directory behavior, and eventually obtain administrative access to the Domain Controller. Target Information Target IP: 10.112.158.28 Domain: ctf.local Domain Controller: DC01.ctf.local Initial credentials: ctf.local\j.smith Password: JSmith@IT2024 1. Initial Enumeration I started with a full TCP Nmap scan to identify exposed services: sudo nmap -Pn -sC -sV -p- 10.112.158.28 -oN forward.nmap The scan identified several Active Directory-related services, including: 53/tcp    DNS 88/tcp    Kerberos 135/tcp   MSRPC 139/tcp   NetBIOS 389/tcp   LDAP 445/tcp   SMB 464/tcp   Kerberos password ...
Post a Comment
Read more

SOC Lab Project Implementation with Wazuh SIEM Part 2

-
Image
  From Docker to Detection: Building a Red & Blue Team Lab with OWASP Juice Shop and Wazuh 1. Introduction What you set out to build Why Red Team + Blue Team Objective: Exploiting a vulnerability and detecting it in Wazuh Lab Diagram: Plaintext Kali Linux │ │ SQL Injection ▼ Ubuntu Lab │ ├── Docker │ └── OWASP Juice Shop :3000 │ └── Wazuh Agent │ ▼ Wazuh Manager │ ▼ Wazuh Dashboard 2. Lab Environment Detailed component breakdown: Component Role MacBook Air M4 Hypervisor / management Kali Linux Red Team / attacker Ubuntu Lab Victim / application server Docker Containerization OWASP Juice Shop Vulnerable web application Wazuh Agent Log collection Wazuh Manager SIEM / detection Wazuh Dashboard Visualization 3. Installing Ubuntu Server Core configuration steps: Installing Ubuntu Server on Fujitsu Network configuration SSH setup IP verification Commands: Bash ip addr hostname -I sud...
Post a Comment
Read more