Tomcat shells
Tomcat shells
Web shells memory write up
WIN-CEKM08E74HR-20150611-222930.raw
All I know is that this dump is from a machine running a web server which has been compromised. I don't know how it was compromised, nor do I have any other details about the server itself.
Identify the OS profile Set environment variable 'mem' to /mnt/volatility/DF/WIN-CEKM08E74HR-20150611-222930.raw
$ cd /root/volatility
$ mem=/mnt/volatility/DF/WIN-CEKM08E74HR-20150611-222930.raw
$ python vol.py -f $mem imageinfoVolatility results
Volatility Foundation Volatility Framework 2.6.1
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : VistaSP1x86, Win2008SP1x86, Win2008SP2x86, VistaSP2x86
AS Layer1 : IA32PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (/mnt/volatility/DF/WIN-CEKM08E74HR-20150611-222930.raw)
PAE type : No PAE
DTB : 0x122000L
KDBG : 0x8190ac98L
Number of Processors : 1
Image Type (Service Pack) : 2
KPCR for CPU 0 : 0x8190b800L
KUSER_SHARED_DATA : 0xffdf0000L
Image date and time : 2015-06-11 22:29:32 UTC+0000
Image local date and time : 2015-06-11 18:29:32 -0400Would be reasonable to assume it will be Win2008 based on the 'web server' part of the challenge.
$ python vol.py -f $mem --profile=Win2008SP1x86 pslistProcesses of interest;
0x831f3d90 cmd.exe 3248 1728 0 -------- 0 0 2015-06-11 22:21:49 UTC+0000 2015-06-11 22:21:49 UTC+0000
0x8363c7f0 tasklist.exe 3256 3248 0 -------- 0 0 2015-06-11 22:21:49 UTC+0000 2015-06-11 22:21:49 UTC+0000
0x835f5718 cmd.exe 3520 1728 0 -------- 0 0 2015-06-11 22:24:04 UTC+0000 2015-06-11 22:24:04 UTC+0000
0x830e9d90 cmd.exe 3572 2032 1 17 0 0 2015-06-11 22:25:00 UTC+0000
0x8362fca0 bg.jpg 3580 3572 1 61 0 0 2015-06-11 22:25:00 UTC+0000
0x835eba10 cmd.exe 3604 1728 0 -------- 0 0 2015-06-11 22:25:15 UTC+0000 2015-06-11 22:25:15 UTC+0000
0x836407b0 cmd.exe 3612 1728 0 -------- 0 0 2015-06-11 22:25:24 UTC+0000 2015-06-11 22:25:24 UTC+0000
0x830e2d90 tasklist.exe 3620 3612 0 -------- 0 0 2015-06-11 22:25:24 UTC+0000 2015-06-11 22:25:24 UTC+0000
0x83693bc0 TrustedInstalle 2364 596 3 104 0 0 2015-06-11 22:26:34 UTC+0000
0x832e7020 csrss.exe 2664 2684 8 188 2 0 2015-06-11 22:26:55 UTC+0000
0x83125cd8 winlogon.exe 2732 2684 3 114 2 0 2015-06-11 22:26:55 UTC+0000
0x82a3f530 taskeng.exe 2448 1012 9 226 2 0 2015-06-11 22:27:17 UTC+0000
0x83681610 dwm.exe 2860 1160 3 70 2 0 2015-06-11 22:27:17 UTC+0000
0x837241d8 explorer.exe 2428 2856 17 425 2 0 2015-06-11 22:27:18 UTC+0000
0x83117020 jusched.exe 3056 2428 1 50 2 0 2015-06-11 22:27:18 UTC+0000
0x83632d08 VBoxTray.exe 3060 2428 9 228 2 0 2015-06-11 22:27:18 UTC+0000
0x83201b90 Tomcat7w.exe 2816 2428 2 50 2 0 2015-06-11 22:27:18 UTC+0000
0x83116ad8 wuauclt.exe 3360 1012 2 142 2 0 2015-06-11 22:27:32 UTC+0000
0x8311ec10 cmd.exe 4032 2428 1 19 2 0 2015-06-11 22:29:10 UTC+0000Server appears to be a Windows 2008 box running Tomcat7. Pull network information
$ python vol.py -f $mem --profile=Win2008SP1x86 netscan
0x1eda4db0 TCPv4 -:8080 58.64.141.245:1057 CLOSED 1728 Tomcat7.exeLooks like this server is listening on 192.168.56.30. There's a remote connection associated with PID 1728 / Tomcat7.exe This PID is also the PPID for numerous cmd.exe
Let's run pstree to see the family (could also run pstree -v)
$ python vol.py -f $mem --profile=Win2008SP1x86 pstree
0x837241d8:explorer.exe 2428 2856 17 425 2015-06-11 22:27:18 UTC+0000
. 0x83201b90:Tomcat7w.exe 2816 2428 2 50 2015-06-11 22:27:18 UTC+0000
. 0x83117020:jusched.exe 3056 2428 1 50 2015-06-11 22:27:18 UTC+0000
. 0x8311ec10:cmd.exe 4032 2428 1 19 2015-06-11 22:29:10 UTC+0000
. 0x83139650:services.exe 596 520 6 234 2015-06-11 22:05:29 UTC+0000
.. 0x832dc560:Tomcat7.exe 1728 596 28 360 2015-06-11 22:05:56 UTC+0000
... 0x835eba10:cmd.exe 3604 1728 0 ------ 2015-06-11 22:25:15 UTC+0000
... 0x836407b0:cmd.exe 3612 1728 0 ------ 2015-06-11 22:25:24 UTC+0000
.... 0x830e2d90:tasklist.exe 3620 3612 0 ------ 2015-06-11 22:25:24 UTC+0000
... 0x831f3d90:cmd.exe 3248 1728 0 ------ 2015-06-11 22:21:49 UTC+0000
.... 0x8363c7f0:tasklist.exe 3256 3248 0 ------ 2015-06-11 22:21:49 UTC+0000
... 0x835f5718:cmd.exe 3520 1728 0 ------ 2015-06-11 22:24:04 UTC+0000Dump Tomcat PID memory (1728)
$ python vol.py -f $mem --profile=Win2008SP1x86 memdump -p 1728 -D /mnt/volatility/DF/tomcat-dump/Strings output 1728.dmp to readable
$ strings -a /mnt/volatility/DF/tomcat-dump/1728.dmp > /mnt/volatility/DF/tomcat-dump/1728strings.txt
COMPUTERNAME=WIN-CEKM08E74HR
ComSpec=C:\Windows\system32\cmd.exe
DFSTRACINGON=FALSE
FP_NO_HOST_CHECK=NO
LOCALAPPDATA=C:
2\config\systemprofile\AppData\Local
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\ProgramData\Oracle\Java\javapath;C:\Wi
:\Windows;C:\Windows\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=
ENTIFIER=x86 Family 6 Model 42 Stepping 7, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=2a07
ProgramData=C:\Program
UvDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Windows\TEMP
TMP=C:\Windows\TEMP
Format
USERDOMAIN=WORKGROUP
USERNAME=WIN-CEKM08E74HR$
USERPROFILE=C:\Windows\system32\config\systemprofile
windir=C:\Windows
"C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\Tomcat7.exe" //RS//Tomcat7
58.64.141.245 - tomcat [11/Jun/2015:18:07:04 -0400] "POST /manager/html/upload?org.apache.catalina.filters.CSRF_NONCE=262D313C4A6E085593AF3CAD4F4E7A99 HTTP/1.1" 200 158
58.64.141.245 - - [11/Jun/2015:18:07:27 -0400] "POST /webfiles/ HTTP/1.1" 200 2367
58.64.141.245 - - [11/Jun/2015:18:07:37 -0400] "POST /webfiles/ HTTP/1.1" 200 2460
58.64.141.245 - - [11/Jun/2015:18:07:51 -0400] "POST /webfiles/ HTTP/1.1" 200 2388
58.64.141.245 - - [11/Jun/2015:18:09:26 -0400] "POST /webfiles/ HTTP/1.1" 200 8973
58.64.141.245 - - [11/Jun/2015:18:12:16 -0400] "POST /webfiles/ HTTP/1.1" 200 48896
58.64.141.245 - - [11/Jun/2015:18:12:42 -0400] "POST /webfiles/ HTTP/1.1" 200 2245
58.64.141.245 - - [11/Jun/2015:18:13:16 -0400] "POST /webfiles/ HTTP/1.1" 200 2278
58.64.141.245 - - [11/Jun/2015:18:15:24 -0400] "POST /webfiles/ HTTP/1.1" 200 2261
58.64.141.245 - - [11/Jun/2015:18:15:34 -0400] "POST /webfiles/ HTTP/1.1" 200 5149
58.64.141.245 - - [11/Jun/2015:18:16:31 -0400] "POST /webfiles/ HTTP/1.1" 200 5227
58.64.141.245 - - [11/Jun/2015:18:19:52 -0400] "POST /webfiles/ HTTP/1.1" 200 5149
58.64.141.245 - - [11/Jun/2015:18:21:49 -0400] "POST /webfiles/ HTTP/1.1" 200 5227
58.64.141.245 - - [11/Jun/2015:18:24:04 -0400] "POST /webfiles/ HTTP/1.1" 200 2271
58.64.141.245 - - [11/Jun/2015:18:25:15 -0400] "POST /webfiles/ HTTP/1.1" 200 2271
58.64.141.245 - - [11/Jun/2015:18:25:25 -0400] "POST /webfiles/ HTTP/1.1" 200 5305Looking for shells
$ cat /mnt/volatility/DF/tomcat-dump/1728strings.txt | grep -i 'post' | moreLet's see when 58.64.141.245 first accessed the web server.
58.64.141.245 - - [08/Jun/2015:19:38:44 -0400] "GET /manager/html HTTP/1.1" 401 2538
$ grep -C10 "58\.64\.141\.245" /mnt/volatility/DF/tomcat-dump/1728strings.txt
58.64.141.245 - - [11/Jun/2015:18:27:51 -0400] "GET /webfiles/?sort=1&downfile=C%3A%5Cinetpub%5Cwwwroot%5Csm.gif HTTP/1.1" 200 975 - - [11/Jun/2015:18:27:37 -0400] "GET /webfiles/?Javascript HTTP/1.1" 200 3714
58.64.141.245 - - [11/Jun/2015:18:27:44 -0400] "GET /webfiles/?sort=1&file=C%3A%5Cinetpub%5Cwwwroot%5Csm.gif HTTP/1.1" 200 972 7:34 -0400] "GET /webfiles/?Javascript HTTP/1.1" 200 3714/1.1" 200 3714 - [11/Jun/2015:18:13:43 -0400] "GET /webfiles/?sort=1&dir=C%3A%5Cinetpub%5Cwwwroot HTTP/1.1" 200 8863
58.64.141.245 - - [11/Jun/2015:18:13:43 -0400] "GET /webfiles/?Javascript HTTP/1.1" 200 3714Let's focus on the activity around 'GET /webfiles'
$ grep -C10 "GET \/webfiles" /mnt/volatility/DF/tomcat-dump/1728strings.txt
GET /webfiles/?sort=1&file=C%3A%5Cinetpub%5Cwwwroot%5Csm.gif HTTP/1.1
accept:*/**
referer:http://192.168.56.30:8080/webfiles/?sort=1&dir=C%3A%5Cinetpub%5Cwwwroott
accept-language:en-uss
user-agent:Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0))
accept-encoding:gzip, deflatee
host:192.168.56.30:80800
connection:Keep-Alivee
cookie:JSESSIONID=D4BB0A17D08FE321DF87835231D798244
cookie:JSESSIONID=D4BB0A17D08FE321DF87835231D798244
0A17D08FE321DF87835231D798244
--
Accept-Encoding: gzip, deflate
Host: 192.168.56.30:8080
Connection: Keep-Alive
Cookie: JSESSIONID=983D1DF88F7A229E9D2C5DD76804F120
Authorization: Basic dG9tY2F0OnRvbWNhdA==Authorisation is base64. Let's decode it.
$ echo dG9tY2F0OnRvbWNhdA== | base64 -d
tomcat:tomcatFound interesting strings in 1728strings.txt
178956:Created by jsp File Browser v.Let's focus on that.
179973:" <small>jsp File Browser version
179974-C by <a href="http://www.vonloesch.de">www.vonloesch.de</a></small>
179975- </center>
179976-</html>
179977-java/util/zip/ZipFile
246416- <div class="formular">
246417- <form class="formular2" action="/webfiles/" enctype="multipart/form-data" method="POST">
246418- <input type="hidden" name="dir" value="C:\inetpub\wwwroot">
246419- <input type="hidden" name="sort" value="1">
246420- <input type="file" class="textfield" onKeypress="event.cancelBubble=true;" name="myFile">
246421- <input title="Upload selected file to the current working directory
246422-" type="Submit" class="button" name="Submit" value="Upload"
246423- onClick="javascript:popUp('/webfiles/')">
246424- </form>
246425- <form class="formular2" action="/webfiles/" method="POST">
246426- <input type="hidden" name="dir" value="C:\inetpub\wwwroot">
246427- <input type="hidden" name="sort" value="1">
246428- <input type="hidden" name="command" value="">
246429- <input title="Launch command in current directory" type="Submit" class="button" id="but_Lau" name="Submit" value="(L)aunch external program">
246430- </form>
246431- </div>
246432-
246433- <hr>
246434- <center>
246435: <small>jsp File Browser version 1.2 by <a href="http://www.vonloesch.de">www.vonloesch.de</a></small>
246436- </center>
246437-</bo
246438-H7
246439- H7
246440- H7
246441- Wp<
246442-/manager/images/asf-logo.gif
246443-org.apache.catalina.filters.CSRF_NONCE
246444-multipart/form-data; boundary=---------------------------7df134640124
246445-/manager/images/tomcat.gif
246446-org.apache.catalina.filters.CSRF_NONCE=262D313C4A6E085593AF3CAD4F4E7A99
246447-en-us
246448-262D313C4A6E085593AF3CAD4F4E7A99
246449-W/"2066-1431019026000"
246450-36791
246451-Thu, 07 May 2015 17:17:06 GMT
246452-W/"7279-1431019026000"
246453-/manager/html/upload
246454-/manager/html
248751-/webfiles/tml/uploadlogo.gif
248752-sort=1&file=C:\inetpub\wwwroot\sm.gif5Csm.gif3C4A6E085593AF3CAD4F4E7A99
248753-HTTP/1.1 200 OK
248754-Server: Apache-Coyote/1.1
248755-Content-Disposition: inline;filename="sm.gif"
248756-Content-Type: image/gif;charset=ISO-8859-1
248757-Content-Length: 97
248758-Date: Thu, 11 Jun 2015 22:27:44 GMT
248759-Administrator:WIN-CEKM08E74HR:A15153D335C2751F17306D272A9441BB:835FD21AAC32076DF24DC75E0C77144F
248760-pe="hidden" name="dir" value="C:\inetpub\wwwroot">
248761- <input type="hidden" name="sort" value="1">
248762- <input type="hidden" name="command" value="">
248763- <input title="Launch command in current directory" type="Submit" class="button" id="but_Lau" name="Submit" value="(L)aunch external program">
248764- </form>
248765- </div>
248766-
248767- <hr>
248768- <center>
248769: <small>jsp File Browser version 1.2 by <a href="http://www.vonloesch.de">www.vonloesch.de</a></small>
38887- out.write("\t\t<input type=\"hidden\" name=\"command\" value=\"\">\n");
38888- out.write("\t\t<input title=\"Launch command in current directory\" type=\"Submit\" class=\"button\" id=\"but_Lau\" name=\"Submit\" value=\"");
65343- out.write("\t\t<input type=\"hidden\" name=\"command\" value=\"\">\n");
65344- out.write("\t\t<input title=\"Launch command in current directory\" type=\"Submit\" class=\"button\" id=\"but_Lau\" name=\"Submit\" value=\"");Let's find this shell.
58.64.141.245 - - [11/Jun/2015:18:12:18 -0400] "GET /webfiles/?uplMonitor=C%3A%5Cfakepath%5C12.bat HTTP/1.1" 200 574
$ cat /mnt/volatility/DF/tomcat-dump/1728strings.txt | grep -i '\.bat'
<snip>
at 18:25 c:\windows\12.bat
first&uplMonitor=C%3A%5Cfakepath%5C12.bat
Javascriptonitor=C:\fakepath\12.bat12.bat
C:\fakepath\12.bat
Content-Disposition: form-data; name="myFile"; filename="12.bat"
uplMonitor=C%3A%5Cfakepath%5C12.bat
Javascript=C:\inetpub\wwwrootwwroot12.bat
uplMonitor=C%3A%5Cfakepath%5C12.bat
at 18:25 c:\windows\12.bat
first&uplMonitor=C%3A%5Cfakepath%5C12.bat
C:\fakepath\12.bat
<snip>
GET /webfiles/?first&uplMonitor=C%3A%5Cfakepath%5C12.bat HTTP/1.1
Content-Disposition: form-data; name="myFile"; filename="12.bat"
<snip>
58.64.141.245 - - [11/Jun/2015:18:12:16 -0400] "GET /webfiles/?first&uplMonitor=C%3A%5Cfakepath%5C12.bat HTTP/1.1" 200 865
58.64.141.245 - - [11/Jun/2015:18:12:18 -0400] "GET /webfiles/?uplMonitor=C%3A%5Cfakepath%5C12.bat HTTP/1.1" 200 574Right. C:\fakepath\12.bat - let's dump this batch script
$ python vol.py -f $mem --profile=Win2008SP1x86 filescan | grep -i "12\.bat"
Volatility Foundation Volatility Framework 2.6.1
0x000000001ee373f8 8 0 -W-rw- \Device\HarddiskVolume1\Windows\12.bat
$ python vol.py -f $mem --profile=Win2008SP1x86 dumpfiles -Q 0x000000001ee373f8 -D /mnt/volatility/DF/tomcat-dump/
Volatility Foundation Volatility Framework 2.6.1
DataSectionObject 0x1ee373f8 None \Device\HarddiskVolume1\Windows\12.batExamine 12.bat
$ cat /mnt/volatility/DF/tomcat-dump/file.None.0x8362e730.dat
@echo off
c:\inetpub\wwwroot\bg.jpg -e -o c:\inetpub\wwwroot\sm.gifpstree verbose
$ python vol.py -f $mem --profile=Win2008SP1x86 pstree -v..... 0x8362fca0:bg.jpg 3580 3572 1 61 2015-06-11 22:25:00 UTC+0000
audit: \Device\HarddiskVolume1\inetpub\wwwroot\bg.jpg
cmd: c:\inetpub\wwwroot\bg.jpg -e -o c:\inetpub\wwwroot\sm.gif
path: c:\inetpub\wwwroot\bg.jpgLet's determine what bg.jpg actually is
$ python vol.py -f $mem --profile=Win2008SP1x86 filescan | grep -i 'bg\.jpg'
Volatility Foundation Volatility Framework 2.6.1
0x000000001ede1ba0 8 0 -W-rw- \Device\HarddiskVolume1\inetpub\wwwroot\bg.jpg
0x000000001f2dc170 7 0 R--r-d \Device\HarddiskVolume1\inetpub\wwwroot\bg.jpg
$ sha1sum /mnt/volatility/DF/tomcat-dump/file.*
c0d7899cc49bf2cb4f3abe663dc6a62ed69c06ff /mnt/volatility/DF/tomcat-dump/file.None.0x832c0680.dat26019082706f9898a716d8803f57cc70365c821b /mnt/volatility/DF/tomcat-dump/file.None.0x8362fb20.img
$ strings file.None.0x8362fb20.img
WCE %s (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.
Options:
-l List logon sessions and NTLM credentials (default).
Optional: -r<refresh interval>.
-s Changes NTLM credentials of current logon session.
Parameters: <UserName>:<DomainName>:<LMHash>:<NTHash>.
-o saves all output to a file.
-r Lists logon sessions and NTLM credentials indefinitely.
Refreshes every 5 seconds if new sessions are found.
-c Run <cmd> in a new session with the specified NTLM credentials.
Parameters: <cmd>.
-e Lists logon sessions NTLM credentials indefinitely.
Refreshes every time a logon event occurs.
Parameters: <filename>.
-i Specify LUID instead of use current logon session.
Parameters: <luid>.
-d Delete NTLM credentials from logon session.
Parameters: <luid>.
-a Use Addresses.
Parameters: <addresses>
-f Force 'safe mode'.
-g Generate LM & NT Hash.
Parameters: <password>.
-K Dump Kerberos tickets to file (unix & 'windows wce' format)
Error in cmdline!. Bye!.
-k Read Kerberos tickets from file and insert into Windows cache
username wrong format!.
-w Dump cleartext passwords stored by the digest authentication package
-v verbose output.So it's windows credential editor. -e for credentials, -o for output. Review sm.gif
$ python vol.py -f $mem --profile=Win2008SP1x86 filescan | grep -i 'sm\.gif'
Volatility Foundation Volatility Framework 2.6.1
0x000000001edf6640 1 0 R--rw- \Device\HarddiskVolume1\inetpub\wwwroot\sm.gif
$ python vol.py -f $mem --profile=Win2008SP1x86 dumpfiles -Q 0x000000001edf6640 -D /mnt/volatility/DF/tomcat-dump/wce
Volatility Foundation Volatility Framework 2.6.1
DataSectionObject
0x1edf6640 None \Device\HarddiskVolume1\inetpub\wwwroot\sm.gif
$ strings /mnt/volatility/DF/tomcat-dump/wce/file.None.0x830f1448.dat
Administrator:WIN-CEKM08E74HR:A15153D335C2751F17306D272A9441BB:835FD21AAC32076DF24DC75E0C77144FIdentifying tasks
$ python vol.py -f $mem --profile=Win2008SP1x86 filescan | grep -i 'tasks'
Volatility Foundation Volatility Framework 2.6.1
0x000000001ee03280 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
0x000000001ee49ba8 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient\UserTask
0x000000001f122450 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor
0x000000001f127f80 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\Multimedia\SystemSoundsService
0x000000001f1e8bd8 17 1 RW-r-- \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx
0x000000001f1eb750 8 0 -W-r-- \Device\HarddiskVolume1\Windows\System32\Tasks\At1
0x000000001f22da78 10 1 RW-r-- \Device\HarddiskVolume1\Windows\Tasks\SCHEDLGU.TXT
0x000000001f22e9c8 6 1 R--rw- \Device\HarddiskVolume1\Windows\Tasks
0x000000001f231b18 2 0 R--r-d \Device\HarddiskVolume1\Windows\System32\taskschd.dll
0x000000001f2638d0 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries
*0x000000001f297ad8 8 0 -W-r-d \Device\HarddiskVolume1\Windows\Tasks\At1.job*
0x000000001f2e7ed0 1 0 R--r-d \Device\HarddiskVolume1\Windows\System32\Tasks\Microsoft\Windows\Server Manager\ServerManager
$ python vol.py -f $mem --profile=Win2008SP1x86 dumpfiles -Q 0x000000001f297ad8 -D /mnt/volatility/DF/tomcat-dump/tasks
$ strings -el /mnt/volatility/DF/tomcat-dump/tasks/file.None.0x8363fd10.dat
c:\windows\12.bat
SYSTEM
Created by NetScheduleJobAdd.$ xxd /mnt/volatility/DF/tomcat-dump/tasks/file.None.0x8363fd10.dat
00000000: 0006 0100 7cbf 6c48 bcaa 564e 928f 06eb ....|.lH..VN....
00000010: 7057 4ccb 4600 ca00 0000 0000 3c00 0a00 pWL.F.......<...
00000020: 2000 0000 0014 730f 0000 0000 0113 0400 .....s.........
00000030: 0200 e021 df07 0600 0400 0b00 1200 1900 ...!............
00000040: 0000 1c00 0100 1200 6300 3a00 5c00 7700 ........c.:.\.w.
00000050: 6900 6e00 6400 6f00 7700 7300 5c00 3100 i.n.d.o.w.s.\.1.
00000060: 3200 2e00 6200 6100 7400 0000 0000 0000 2...b.a.t.......
00000070: 0700 5300 5900 5300 5400 4500 4d00 0000 ..S.Y.S.T.E.M...
00000080: 1e00 4300 7200 6500 6100 7400 6500 6400 ..C.r.e.a.t.e.d.
00000090: 2000 6200 7900 2000 4e00 6500 7400 5300 .b.y. .N.e.t.S.
000000a0: 6300 6800 6500 6400 7500 6c00 6500 4a00 c.h.e.d.u.l.e.J.
000000b0: 6f00 6200 4100 6400 6400 2e00 0000 0000 o.b.A.d.d.......
000000c0: 0800 0000 0000 0000 0000 0100 3000 0000 ............0...
000000d0: df07 0600 0b00 0000 0000 0000 1200 1900 ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000f0: 0000 0000 0000 0000 0000 0000 0100 0100 ................
00000100: 3c56 fcbd fe46 561b 1843 6c37 2c42 d847 <V...FV..Cl7,B.G
00000110: 8146 13f0 4dc0 8ca1 6385 9699 3525 f122 .F..M...c...5%."
00000120: a49a 20ed 4b99 5850 df79 17f8 0f16 4777 .. .K.XP.y....Gw
00000130: b394 0b70 a307 7bd4 993b a5d4 71a0 0a19 ...p..{..;..q...Dump security logs to identify who created scheduled task
$ python vol.py -f $mem --profile=Win2008SP1x86 filescan | grep -i 'security'
Volatility Foundation Volatility Framework 2.6.1
0x000000001ee09960 3 1 RW---- \Device\HarddiskVolume1\Windows\System32\config\RegBack\SECURITY
0x000000001f091600 11 1 RW---- \Device\HarddiskVolume1\Windows\System32\config\SECURITY
0x000000001f1ed2c0 13 1 RW-r-- \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Security.evtx
0x000000001fa06ed8 1 1 RW---- \Device\HarddiskVolume1\Windows\System32\config\SECURITY.LOG1
0x000000001fa31308 17 1 RWDr-d \Device\HarddiskVolume1\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
0x000000001fa31b00 1 1 RW---- \Device\HarddiskVolume1\Windows\System32\config\SECURITY.LOG2
0x000000001fa37a60 1 1 RW-r-d \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Configuration-Wizard%4Operational.etl
0x000000001fa37b08 1 1 RW-r-d \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Configuration-Wizard%4Diagnostic.etl$ python vol.py -f $mem --profile=Win2008SP1x86 dumpfiles -Q 0x000000001f1ed2c0 -D /mnt/volatility/DF/tomcat-dump/security-log/
Volatility Foundation Volatility Framework 2.6.1
DataSectionObject 0x1f1ed2c0 None \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Security.evtx
SharedCacheMap 0x1f1ed2c0 None \Device\HarddiskVolume1\Windows\System32\winevt\Logs\Security.evtxRenamed file.None.0x831ef6a0.vacb to file.None.0x831ef6a0.vacb.evtx Opened in Event Viewer, refined by ID 4698 (new scheduled task has been created)
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4698</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12804</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2015-06-11T22:13:16.426336000Z" />
<EventRecordID>7273</EventRecordID>
<Correlation />
<Execution ProcessID="608" ThreadID="2268" />
<Channel>Security</Channel>
<Computer>WIN-CEKM08E74HR</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WIN-CEKM08E74HR$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TaskName">\At1</Data>
<Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?>
<Task version="1.0" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo /> <Triggers> <TimeTrigger> <StartBoundary>2015-06-11T18:25:00</StartBoundary> </TimeTrigger> </Triggers> <Principals> <Principal id="Author"> <UserId>@AtServiceAccount</UserId> <LogonType>InteractiveTokenOrPassword</LogonType> <RunLevel>HighestAvailable</RunLevel> </Principal> </Principals> <Actions Context="Author"> <Exec> <Command>c:\windows\12.bat</Command> </Exec> </Actions> </Task></Data>
</EventData>
</Event>Executive Summary
We have a Tomcat7 installation on a Windows 2008 server. Access was gained with default tomcat credentials (tomcat/tomcat). A file was uploaded which provided SYSTEM level access. Windows Credential Editor (WCE) was uploaded, a scheduled task was created which executed WCE and dumped local credentials into a single file. The attacker downloaded that file remotely, gaining access to the local Administrator account credentials. All attacks took place on 11th June 2015 from the IP 58.64.141.245
Last updated
Was this helpful?