Try Hack Me — Investigating Windows — Write Up
Task 1 : Investigating Windows
This is a challenge that is exactly what is says on the tin, there are a few challenges around investigating a windows machine that has been previously compromised.
Connect to the machine using RDP. The credentials the machine are as follows:
Please note that this machine does not respond to ping (ICMP) and may take a few minutes to boot up.
Whats the version and year of the windows machine?
Windows Server 2016
Which user logged in last?
Administrator
When did John log onto the system last?
Answer format: MM/DD/YYYY H:MM:SS AM/PM
03/02/2019 5:48:32 PM
What IP does the system connect to when it first starts?
10.34.2.3
What two accounts had administrative privileges (other than the Administrator user)?
Answer format: username1, username2
Jenny,Guest
Whats the name of the scheduled task that is malicious.
Clean File System
What file was the task trying to run daily?
nc.ps1
What port did this file listen locally for?
1348
When did Jenny last logon?
Never
At what date did the compromise take place?
Answer format: MM/DD/YY
03/02/2019
At what time did Windows first assign special privileges to a new logon?
Answer format: MM/DD/YYYY HH:MM:SS AM/PM
03/02/2019 4:04:49 PM
What tool was used to get Windows passwords?
Mimikatz
What was the attackers external control and command servers IP?
76.32.97.132
What was the extension name of the shell uploaded via the servers website?
.jsp
What was the last port the attacker opened?
1337
Check for DNS poisoning, what site was targeted?
google.com
For any queries contact on my twitter and linkedin profiles -
