Analyze SMB traffic in a PCAP file using Wireshark to identify PsExec lateral movement, compromised systems, user credentials, and administrative shares.
An alert from the Intrusion Detection System (IDS) flagged suspicious lateral movement activity involving PsExec. This indicates potential unauthorized access and movement across the network. As a SOC Analyst, your task is to investigate the provided PCAP file to trace the attacker’s activities. Identify their entry point, the machines targeted, the extent of the breach, and any critical indicators that reveal their tactics and objectives within the compromised environment.
Easy - Network Forensics | Completion Achievement
- To effectively trace the attacker's activities within our network, can you identify the IP address of the machine from which the attacker initially gained access?
Since we are assuming that the attacker has already breached the network, we should expect to see an internal/private IP address (10.x.x.x). Looking at the Statistics > Endpoints tab on Wireshark, we will be able to see two relevant private IP addresses communicating with each other:
Which of these addresses appears to be acting as a client? We can use the ip.addr == 10.0.0.130 filter on Wireshark to check up on the first address:
It seems that the 10.0.0.130 address is acting as a client through the SMB2 protocol (Session Setup Request, Tree Connect Request, etc.) whereas the 10.0.0.133 address acts as the server responding to this client (Session Setup Response, Tree Connect Response, etc.). It is safe to assume which IP address corresponds to the attacker.
- To fully understand the extent of the breach, can you determine the machine's hostname to which the attacker first pivoted?
Let's look deeper into smb2 traffic in the packet capture with the smb2 filter:
Packet 131 contains an NTLMSSP_CHALLENGE response, which contains relevant information about the client initiating the request. We can look into the packet details and find the machine's hostname.
- Knowing the username of the account the attacker used for authentication will give us insights into the extent of the breach. What is the username utilized by the attacker for authentication?
This information can be obtained from the very next packet (#132), which contains a NTLMSSP_AUTH request from the attacker's machine. We can simply look at the Packet Details pane or look at the Info section to find our answer:
- After figuring out how the attacker moved within our network, we need to know what they did on the target machine. What's the name of the service executable the attacker set up on the target?
Looking at the packets following the initial SMB communications, we can see the attacker attempting to write a file into the 10.0.0.133 machine, which is the service executable we are looking for:
- We need to know how the attacker installed the service on the compromised machine to understand the attacker's lateral movement tactics. This can help identify other affected systems. Which network share was used by PsExec to install the service on the target machine?
Looking at the packet details in the same Create Request File packet, we can confirm which share was used to write the PSEXESVC.exe service executable:
- We must identify the network share used to communicate between the two machines. Which network share did PsExec use for communication?
How does PsExec traffic look like in SMB? Using this set of notes from a red teaming author, we can see that PsExec traffic over SMB often contains the strings stdin, stdout and stderr. Looking for similar strings in our packet capture will return evidence of PsExec communicating over SMB, along with the name of the share where this communications took place:
- Now that we have a clearer picture of the attacker's activities on the compromised machine, it's important to identify any further lateral movement. What is the hostname of the second machine the attacker targeted to pivot within our network?
Knowing that we can use NTLMSSP_CHALLENGE responses as a way of reading hostnames, let's do the same to find the second hostname accessed by the attacker. When set these type of responses as a filter by right clicking the NTLM Message Type: NTLMSSP_CHALLENGE (0x00000002) field on Packet Details and selecting Apply as Filter > Selected, which will add the ntlmssp.messagetype == 0x00000002 display filter. Scrolling below, we can find the hostname of the second machine that the attacker interacted with:
