Windows Network Analysis
This guide contains the answer and steps necessary to get to them for the Windows Network Analysis room.
Table of contents
- Task 2 - Windows Network Analysis
- Task 3 - Network Analysis via PowerShell
- Task 4 - Internal Tooling
- Task 5 - Practical
Task 2 - Windows Network Analysis
-
What is the full name of the Windows feature that tracks the last 30 to 60 days of system statistics?
The answers can be found in the text.
Click for answer
-
What is the full path to the directory that Windows will output Firewall logs to?
The answers can be found in the text.
Click for answer
Task 3 - Network Analysis via PowerShell
-
What cmdlet can be used to display active TCP connections?
The answers can be found in the text.
Click for answer
-
What cmdlet can be used to display the DNS cache on the host?
The answers can be found in the text.
Click for answer
-
What command can be used to list all active RDP sessions on the host?
The answers can be found in the text.
Click for answer
Task 4 - Internal Tooling
-
What netstat flag can we use to display the executable responsible for a connection?
The answers can be found in the text.
Click for answer
-
If we wanted to display all TCP connections and the associated process ID using netstat, what flag would we use?
The answers can be found in the text.
Click for answer
-
What special character can we use to save the output of netstat to a text file?
The answers can be found in the text.
Click for answer
Task 5 - Practical
First, make sure both machines are connected.
-
Use the Get-NetTCPConnection PowerShell cmdlet to list the connections currently active. A popular port for reverse shells is currently active. What is the port number? If nothing sticks out, wait a few minutes and run the command again.
We will use the following command to list all TCP connections and look for any reverse shell connections.
Get-NetTCPConnection | select LocalAddress,localport,remoteaddress,remoteport,state,@{name="process";Expression={(get-process -id $_.OwningProcess).ProcessName}}, @{Name="cmdline";Expression={(Get-WmiObject Win32_Process -filter "ProcessId = $($_.OwningProcess)").commandline}} | sort Remoteaddress -Descending | ft -wrap -autosize
We can see two connections on port 5000 connected to the same IP as the C2 server.
Click for answer
5000 -
What is the name of the process that is connecting to the C2 server?
Although these don't have any attached processes. We can see another process on the same port listening on every interface.
Click for answer
pythonw.exe -
What is the domain that has been added to the workstation's host file?
We can query the hosts file to find out.
Click for answer
attackerc2.thm -
Analyse the SRUM database. There is another process that has sent a large amount of bytes, indicating data exfil. What is the full path to the process (as listed in SRUM)?
After opening the SRUM analysis file, we can look at the data in the "Network Data Usage" sheet. Sort on the "Bytes sent" column.
Click for answer
\device\harddiskvolume3\program files\updater\exfil.exe -
Finally, analyse the SMB shares present on the analyst machine. What is the name of the share that stands out?
My first command didn't work so I used another one to enumerate the SMB shares.
Click for answer
confidential