Hack The Box-Sherlocks-Noted

最新推荐文章于 2024-11-18 21:05:40 发布

Str4w_AShiR

最新推荐文章于 2024-11-18 21:05:40 发布

阅读量869

点赞数 23

分类专栏： HTB-Sherlocks靶场合集文章标签：网络 excel java 数据包

本文链接：https://blog.csdn.net/m0_52742680/article/details/135937402

版权

HTB-Sherlocks靶场合集专栏收录该内容

6 篇文章 1 订阅

订阅专栏

Forela的开发人员Simon遭遇勒索攻击，敏感数据被盗。作为安全分析师，你需调查攻击路径，寻找源文件，追踪加密钱包地址及联系信息，以应对数据泄露并找回数据。

摘要由CSDN通过智能技术生成

靶场介绍

Simon, a developer working at Forela, notified the CERT team about a note that appeared on his desktop. The note claimed that his system had been compromised and that sensitive data from Simon’s workstation had been collected. The perpetrators performed data extortion on his workstation and are now threatening to release the data on the dark web unless their demands are met. Simon’s workstation contained multiple sensitive files, including planned software projects, internal development plans, and application codebases. The threat intelligence team believes that the threat actor made some mistakes, but they have not found any way to contact the threat actors. The company’s stakeholders are insisting that this incident be resolved and all sensitive data be recovered. They demand that under no circumstances should the data be leaked. As our junior security analyst, you have been assigned a specific type of DFIR (Digital Forensics and Incident Response) investigation in this case. The CERT lead, after triaging the workstation, has provided you with only the Notepad++ artifacts, suspecting that the attacker created the extortion note and conducted other activities with hands-on keyboard access. Your duty is to determine how the attack occurred and find a way to contact the threat actors, as they accidentally locked out their own contact information.

在Forela工作的开发人员Simon向CERT团队通知了他桌面上出现的一张纸条。该纸条声称，他的系统已被泄露，西蒙工作站的敏感数据已被收集。犯罪者在他的工作站上进行了数据勒索，现在威胁说，除非他们的要求得到满足，否则将在暗网上公布数据。Simon的工作站包含多个敏感文件，包括计划的软件项目、内部开发计划和应用程序代码库。威胁情报小组认为，威胁行为者犯了一些错误，但他们没有找到任何联系威胁行为者的方法。该公司的利益相关者坚持要求解决这一事件，并恢复所有敏感数据。他们要求在任何情况下都不应泄露这些数据。作为我们的初级安全分析师，您被指派在本案中进行特定类型的DFIR（数字取证和事件响应）调查。CERT负责人在试用工作站后，只向您提供了Notepad++工件，怀疑攻击者创建了勒索笔记，并通过实际键盘访问进行了其他活动。你的职责是确定攻击是如何发生的，并找到联系威胁行为者的方法，因为他们意外地锁定了自己的联系信息。

Task 1

What is the full path of the script used by Simon for AWS operations?

Simon用于AWS操作的脚本的完整路径是什么？

查看config.xml文件，在History表单中有一段有段AWS的脚本

在这里插入图片描述

Task 1：C:\Users\Simon.stark\Documents\Dev_Ops\AWS_objects migration.pl

Task 2

The attacker duplicated some program code and compiled it on the system, knowing that the victim was a software engineer and had all the necessary utilities. They did this to blend into the environment and didn’t bring any of their tools. This code gathered sensitive data and prepared it for exfiltration. What is the full path of the program’s source file?

攻击者复制了一些程序代码并在系统上进行了编译，知道受害者是一名软件工程师，拥有所有必要的实用程序。他们这样做是为了融入环境，没有带任何工具。该代码收集了敏感数据，并准备进行外过滤。程序源文件的完整路径是什么？

查看session.xml文件，由题目可知，攻击者运行了一段程序代码，因此以java结尾的文件为答案

在这里插入图片描述