← Back to Writeups
HTBVery EasySOC/DFIR
Bookmark

Campfire-1

D3v0o0Nu119/2/20264 min read
#soc/dfir#htb#very easy

Campfire-1

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Very Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

Alonzo Spotted Weird files on his computer and informed the newly assembled SOC D3v0o0Nu11. Assessing the situation it is believed a Kerberoasting attack may have occurred in the network. It is your job to confirm the findings by analyzing the provided evidence. You are provided with: 1- Security Logs from the Domain Controller 2- PowerShell-Operational Logs from the affected workstation 3- Prefetch Files from the affected workstation

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
03:16:32Based from our previous identification, the initial execution of the script is at 2024-05-21 03:16:32

Evidence Analysed

  • Tools: powershell, impacket.
  • Artifacts: prefetch.

Detailed Investigation

  1. In this case, we're tasked to investigate a kerberoasting attack on Alonzo's computer. It is known that he spotted few weird files on hits computer.
  2. Later on, SOC team is informed and asked to assess the situation.
  3. SOC team found the situation is a result of kerberoasting attack in the network and we're asked to confirm their findings by analyzing the provided evidence.
  4. We're provided with security logs from Domain Controller, Powershell-Operational Logs, and Prefetch files from the affected workstation.

1ST QUESTION --> ANS: REDACTED

  1. The easiest way to identify the initial kerberoasting attempt, we need to filter for EventID 4769 (A Kerberos service ticket was requested).
  2. Next, check for the service name that is not krbtgt or ends with $ sign (it indicates a workstation).
  3. Also note that the ticket type should be 0x17 along with the failure code must be 0x0.
  4. Upon reviewing every logs, found one log which met our requirements.

2ND QUESTION --> ANS: REDACTED

  1. Based from the log, seems MSSQLService is the targeted service name.
  2. Upon reviewing the previous log, we can identify that the workstation used for this kerberoasting attack is FORELA-WKSTN001.

3RD QUESTION --> ANS: REDACTED

  1. The IP address of the workstation is also shown at the initial kerberoasting attempt and it's previous log.

4TH QUESTION --> ANS: REDACTED

  1. Moving on to the powershell event logs. We can identify which powershell script used by the threat actor to enumerate AD objects and hunt for kerberoastable accounts in the network.
  2. Upon further review to the script and searching for variables naming related to AD and it's logic. We can confirm that it is indeed the used script.

5TH QUESTION --> ANS: REDACTED

  1. Based from our previous identification, the initial execution of the script is at 2024-05-21 03:16:32

6TH QUESTION --> ANS: REDACTED

  1. After identified which account is kerberoastable, the threat actor continue it's attack scheme by executing a specific tool for kerberoasting.

  2. Upon reviewing the prefetch file given, a tool named RUBEUS caught my attention.

  3. Things to note, RUBEUS, IMPACKET, GetUserSPN.py, and POWERSPLOIT (Invoke-Kerberoast) are common tools used for kerberoasting.

  4. Now let's convert the prefetch file to a csv file then review it using Timeline Explorer to gain more info about the tool properties.

USING PECmd.exe to convert .pf file to csv.

.\PECmd.exe -f 'pathfile.pf' --csv . --csvf result.csv

RESULT IN TIMELINE EXPLORER

  1. To identify it's path, simply check the Files Loaded column.

  2. Nice! We've identified the full path.

7TH QUESTION --> ANS: REDACTED

  1. Next to identify the execution timestamp, simply check the Last Run column.

  2. Great! We've investigated the case!

Findings

  1. Persistence mechanism — As documented in the investigation steps.
  2. Initial access — As documented in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
Command and ControlIngress Tool TransferT1105

Answers / Flags

  • 1ST QUESTION --> ANS: REDACTED
  • 2ND QUESTION --> ANS: REDACTED
  • 3RD QUESTION --> ANS: REDACTED
  • 4TH QUESTION --> ANS: REDACTED
  • 5TH QUESTION --> ANS: REDACTED
  • 6TH QUESTION --> ANS: REDACTED
  • 7TH QUESTION --> ANS: REDACTED

Lessons Learned

  1. Using EventViewer to analyze DC's security logs.
  2. Kerberoasting Attack Analysis.
  3. Using PECmd.exe to convert prefetch file to csv format.
  4. Using Timeline Explorer to review the csv formatted prefetch file.
  5. Identifying common kerberoasting tools.