Documenting my journey exploring TryHackMe
Exploring TryHackMe to expand my hands on practice reinforcing technical capabilities with a pen test lens and its fun!
Linux Commands
- whoami - Returns the machine information
- echo - Returns a command
- ls - List what in the current folder
- cd - change directory or move into a folder
- cat - shows the contents of a file
- pwd - prints the working directory
- dirb - returns hidden pages [for example dirb www.BigBusiness.com returns unindexed admin pages] Helpful in capture the flag to find unprotected pages
- find - search for files [for example find -name passwords.txt]
- grep - searches inside for text [for example grep "password123" passwords.txt]
- & - Runs commands and does not wait
- && - Runs commands and waits for the first to finish
- ">" - Used to redirect output and over writes the file
- ">>" - The redirector does the same thing, but instead of overwriting, it will just add the output to the bottom of the file
Step 1: Find all true positives
Step 2: Read the documentation
Step 3: Investigate the alert queue
Step 4: Take ownership of an alert
Step 5: Deep dive into the SIEM [Splunk]
Results: 100%
Alert 1: Inbound Email Containing Suspicious External Link
Decision: True Positive
Explanation: The link within the email is to another company impersonating Human Resources to our employee redirecting them to an external website.
Alert 2: Access to Blacklisted External URL Blocked by Firewall
Decision: True Positive
Explanation: Known malicious IP - Escalate for further review as to why our IP tried to access was it by accident, a phishing breach, or an inside threat.
Alert 3: Inbound Email Containing Suspicious External Link
Decision: True Positive
Explanation: The sender and external link are impersonating Microsoft.
Results: 94.44% - Currently 1st Place!
Placing me in the top 45% on TryHackMe
Description Dive into the heat of a live phishing attack as it unfolds within the corporate network. In this high-pressure scenario, your role is to meticulously analyze and document each phase of the breach as it happens. Can you piece together the attack chain in real-time and prepare a comprehensive report on the malicious activities? Scenario objectives
Monitor and analyze real-time alerts as the attack unfolds. Identify and document critical events such as PowerShell executions, reverse shell connections, and suspicious DNS requests. Create detailed case reports based on your observations to help the team understand the full scope of the breach.
Actions Taken:
The CCNA Cybersecurity labs, studying, and knowledge helped me through this one for sure!
At first there are a few simple phishing/spam emails then you get a few tickets of uncommon subprocesses which on their own could be false positives until you receive an indicator of attack (no spoilers here - IYKYK). Then over 30 tickets rush in requiring you to investigate via Splunk (it does allow you to select your preferred SIEM when starting). It quickly becomes apparent there is an external threat actor poking your network and then it happens - They begin exfiltrating data.
It is important to both prioritize priority of tickets as the attack escalates but also keep a timeline in your mind as you investigate each ticket to provide accurate reporting.
Lessons Learned TryHackMe does NOT want you to mark spam emails as Phishing and they want specifically Phishing emails only to be marked threats.
Results: Failed
Updated my host file with the IP and URL but was unable to obtain the x509 cert. Tried FFuF but it didn't work. Used the entire hour and will retire again in the near future.
It said Fuffy Wuffy, Wasn't Fuffy Was He? And I said... Let me get back to you.
What I am learning through this exercise:
- ffuf Takes dirb (mapping unlisted pages) further by scanning the sites entire DNS configuration for both pages [HOST/pages] and subdomains [Private.HOST] this is very relevant as I have personally setup DNS servers to include subdomains for internal training sites.
- The ability to bypass security by adding host files on your own device by tricking domains who maintain a self-signed certificate.