【TryHackMe】Advent of Cyber3 (2021)を続けてみた Day8

# Welcome to Advent of Cyber 2021
クリスマスまでの25日間、毎日基本的な知識を学び、初心者向けの新しいセキュリティ演習を行うことで、サイバーセキュリティを始めることができます。

https://tryhackme.com/room/adventofcyber3

# day8
windowsに関する問題です。

RDPで接続します。

```
┌──(kali㉿kali)-[~]
└─$ xfreerdp /u:Administrator  /p:grinch123! /w:1366 /h:768 +fonts +clipboard /v:10.10.71.252
```

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/04b663ea-6030-862b-1959-1e96ceb123c5.png)

SantasLaptopLogsのOS名を確認します。

`C:\Users\Administrator\Desktop\SantasLaptopLogs`
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/b497b7ec-6d01-5475-3827-a6ae1814a437.png)


次に`PowerShell_transcript.LAPTOP.k_dg27us.20211128153538`を開きログをみると、`s4nta`ユーザーが追加されてました。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/251c5352-5068-be78-b718-7d1973b96be8.png)

次に、`PowerShell_transcript.LAPTOP.Zw6PA+c4.20211128153734`を開きログをみると、`copy`コマンドで`UsrClass.dat`がデスクトップにコピーされてます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/9f634d7e-8d1a-dcfd-a163-35c35477b54a.png)

このログによると、ファイルをエンコードしていることが確認できます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/ae1c0258-3306-8e35-2c36-5251f8a9ac2e.png)

`-----BEGIN CERTIFICATE-----`とから`-----END CERTIFICATE-----`までに囲われた部分をbase64でデコードします。
デコードする際は、CyberChefを使用します。

https://gchq.github.io/CyberChef/

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/955ad1e6-f3b6-3814-c155-d570df862a49.png)
この`download.dat`からShellbagsの探索を開始します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/253a22aa-c2e9-5e47-d2dc-b846bb82422e.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/42eaab02-527c-9b63-04eb-cd2091b85bc2.png)

SantaRatという怪しいフォルダを見つけました。このdatファイルの詳細を確認することができませんが、`.github`と記載されているので外部公開しているかもしれません。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/f2b0578e-7535-64ce-953f-b209c90d66fa.png)

さらに、デスクトップには「BagofToys」という名前のユニークなフォルダがあります。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/6c13963d-be00-fb40-2a55-9120744e29e3.png)

Githubにアクセスして、「SantaRat」を検索します。
`https://github.com/Grinchiest/SantaRat`
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/e846c9be-bacd-bfcb-9c55-436f4a444da0.png)
その他にもいくつかリポジトリがありました。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/60164f2d-6f89-396e-8d67-3f0fbbc4a48f.png)

`PowerShell_transcript.LAPTOP.b+XfnW7t.20211128154858`を開きログをみると、実行ファイルをインストールしています。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/8a435799-2329-bd9b-0615-897f84c5a7f5.png)

`PowerShell_transcript.LAPTOP.myCoN9lB.20211128155453`によると、それぞれに`GRINCHMAS`が入ってます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/27aeaec4-19fe-50e3-e0d3-1a540ab0dc1c.png)

Commitから元のbag_of_toys.uhaアーカイブのパスワードを予測します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/4ddf1b28-91ba-2f21-2883-4ce501e002b1.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/b303b5d2-490b-9d56-133b-08e576b11332.png)



githubに表示されていたパスワードを入力してみます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/0129cc69-f300-e7a5-4504-ea06dfa80cc9.png)
合計で228のファイルがありました。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2217966/9287824f-2ca3-642d-493c-3412dc1caf02.png)



# Answer
What operating system is Santa's laptop running ("OS Name")?
<font color="White">Microsoft Windows 11 Pro</font>
What was the password set for the new "backdoor" account?
<font color="White">grinchstolechristmas</font>
In one of the transcription logs,  the bad actor interacts with the target under the new backdoor user account, and copies a unique file to the Desktop. Before it is copied to the Desktop, what is the full path of the original file? 
<font color="White">C:\Users\santa\AppData\Local\Microsoft\Windows\UsrClass.dat</font>
The actor uses a Living Off The Land binary (LOLbin) to encode this file, and then verifies it succeeded by viewing the output file. What is the name of this LOLbin?
<font color="White">certutil.exe</font>
Drill down into the folders and see if you can find anything that might indicate how we could better track down what this SantaRat really is. What specific folder name clues us in that this might be publicly accessible software hosted on a code-sharing platform?
<font color="White">.github</font>
Additionally, there is a unique folder named "Bag of Toys" on the Desktop! This must be where Santa prepares his collection of toys, and this is certainly sensitive data that the actor could have compromised. What is the name of the file found in this folder? 
<font color="White">bag_of_toys.zip</font>
What is the name of the user that owns the SantaRat repository?
<font color="White">Grinchiest </font>
Explore the other repositories that this user owns. What is the name of the repository that seems especially pertinent to our investigation?
<font color="White">operation-bag-of-toys</font>
Read the information presented in this repository. It seems as if the actor has, in fact, compromised and tampered with Santa's bag of toys! You can review the activity in the transcription logs. It looks as if the actor installed a special utility to collect and eventually exfiltrate the bag of toys. What is the name of the executable that installed a unique utility the actor used to collect the bag of toys?
<font color="White">uharc-cmd-install.exe</font>
Following this, the actor looks to have removed everything from the bag of toys, and added in new things like coal, mold, worms, and more!  What are the contents of these "malicious" files (coal, mold, and all the others)?
<font color="White">GRINCHMAS</font>
What is the password to the original bag_of_toys.uha archive? (You do not need to perform any password-cracking or bruteforce attempts)
<font color="White">TheGrinchiestGrinchmasOfAll</font>
How many original files were present in Santa's Bag of Toys?
<font color="White">228</font>