CyberGuardians

Real Digital Forensics by Keith Jones, Richard Bejtlich, and Curtis Rose 1 - Windows Live Response Never save data locally on the hd, as there is a chance you may be overwriting evidence Always use the -b option with md5sum, to perform the hash in binary mode -k option with cryptcat, allows you to set the encryption password Volatile Data * system date and time * current network connections * open tcp and udp ports * which exe's are opening tcp and udp ports * cached netbios name table * users currently logged on * internal routing table * running processes * running services * scheduled jobs * open files * process memory dumps To truly verify a system binary, you must compare hashes with trusted source Common attack involves changing a servers routing table to redirect traffic and bypass firewalls Firedaemon turns any process into a service userdump.exe will capture memory space used by any running process. userdump output cannot be ...

Windows Forensics and Incident Recovery Notes Windows Event Log -clearing the Security Event Log generates event ID 517 -Stealing info via USB drive may cause event ID 134: "Removable Storage Service"; If logs have been cleared,check HKEY_LOCAL_MACHINE\System\MountedDevices Registry key. A right click on these entries may show "RemoveableMedia" -Logon events http://support.microsoft.com/default.aspx?kbid=174073 -Logon types http://support.microsoft.com/default.aspx?scid=kb;en-us;140714 -More security Events http://support.microsoft.com/kb/174074/ CMD Line History - doskey /history or the RunMRU registry key File Associations - C:\>assoc will list out every association; C:\>assoc .exe ---> .exe=exefile - ftype exefile ---> exefile="%1" %* ; shows what variables used at runtime; matched the value in HKEY_CLASSES_ROOT\exefile\shell\open\command - if this value has been moded by malware use --> C:\>ftype exefile="%1" %* to change ba...

Protect Your Windows Network From Perimeter to Data by Jesper M. Johansson and Steve Riley 1 - Introduction to Network Protection Information technology is working properly only when users can stop thinking about how or why it works Security Management is about spending good money to have nothing happen Fundamental Tradeoffs are between Cost, Level of Security, and Usefullness/Usability Microsoft Library - Security Center A protected network is one with an absence of unmitigated vulnerabilities that can be used to compromise the network To have a truly secure network you must enumerate every place where it might be insecure and demonstrate that it is not insecure in any of them. This is only possible in theory not in practice (i.e. Chasing Unicorns) 2 - Anatomy of a Hack No network is any more secure than the least-secure device connected to it SQL injection is a vulnerability in the application, not the DBMS itself The only proper way to clean a compromised system is to nuke and pav...

1 - Windows - - Unable to delete registry key? - Use the at command to schedule an interactive registry edit with SYSTEM rights ex. c:\> at 16:00 /interactive regedt32.exe - - Netstat Foo - - C:\> netstat -na 1 | find "[Scan_Host_IP_Addr]" -- Watches for connections/scans - - C:\> netstat -nao 1 | find "[Dest_IP_Addr]" -- Finds the PID generating the traffic - - C:\> netstat -na 1 | find "4444" | find "ESTABLISHED" -- Reports when someone connects - - Get Your Netbios Name Codes http://www.cotse.com/nbcodes.htm - - PSTools Foo - - Remote Shutdown > psexec \\RemotePC -u UserName -p Password shutdown -r -t 1 - - Remote Service Disabling - sc \\ config start= disabled - - MISC - - LM Empty Hash AAD3B435B51404EEAAD3B435B51404EE - - NTLM Empty Hash 31D6CFE0D16AE931B73C59D7E0C089C0 - - Find Resultant Set of Group Policy, rsop.msc - - C:\> write notepad.exe:STR -- allows you to see ADS - - Ping Sweeper - - for /L %i in (1,1,255) do @...

Map of Windows Memory Addresses openRCE

SANS Track 4 Notes, Comments Day 1 – Incident Handling Sample Incident forms are available @ http://www.sans.org/incidentforms/ Giac Practicals are available @ http://www.giac.org/GCIH.php and contain good working examples Protect Evidence – get the user away from the machine ASAP to keep the machine unchanged until you can image the drive. Keep the original stored in a safe place and maintain a chain of evidence. Verify backup integrity to insure you are not restoring a compromised image. Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned Keep up to date on privacy laws, European laws are radically different from US laws IDS, depending on the vendor, maybe able to monitor encrypted VPN traffic Always strive to raise security awareness with management Honeynet – for training purposes it maybe useful to set up a vulnerable system to intentionally let it be compromised to develop the teams investigative skills. Nice Trojan Port list http://www.dark-e.co...

Hacking Exposed Notes Footprinting – profiling an organization Internet, Intranet, Remote Access, and Extranet presence to determine security posture and netblocks Website Pilfering – grabbing source code to analyze offline Unix – Wget http://www.gnu.org/software/wget/wget.html Win – Teleport Pro http://www.tenmax.com/teleport/home.htm Search Engines – tools for searching multiple engines, IRC, email, etc at once Win – FerretPRO($) http://www.ferretsoft.com Web – DogPile http://www.dogpile.com Registered Networks – internet whois searches Current Registrars http://www.internic.net/alpha.html Unix – Whois, Xwhois http://c64.org/~nr/xwhois/ Unix - $ whois “acme.”@whois.crsnic.net (list possible domains) Unix - $ whois “HANDLE JS1234”@whois.networksolutions.com (list POC info) Unix - $ whois “@acme.net”@whois.networksolutions.net (list email info) Web – US http://www.arin.net Web – International http://www.allwhois.com Web – US Military http://whois.nic.mil Web – US Gov http://whois....