Daily Blog #514: Sunday Funday 10/21/18 - Windows Type 3 Challenge

Hello Reader,
       Adam Harrison returned this week to reclaim the prize, but every week is a new week and a new challenge. This week we are mixing things up both in the test kitchen were we are focusing on traces left behind by popular pentest tools and the sunday funday challenges to. I focus on a lot of host artifacts because of the work I do, but there is a world of intrusion artifacts out there as well that I want to make sure people are aware of.


The Prize:

$100 Amazon Giftcard

The Rules:

1. You must post your answer before Friday 10/26/18 7PM CST (GMT -5)
2. The most complete answer wins
3. You are allowed to edit your answer after posting
4. If two answers are too similar for one to win, the one with the earlier posting time wins
5. Be specific and be thoughtful
6. Anonymous entries are allowed, please email them to dcowen@g-cpartners.com. Please state in your email if you would like to be anonymous or not if you win.
7. In order for an anonymous winner to receive a prize they must give their name to me, but i will not release it in a blog post

The Challenge:

What are the differences between a normal windows type 3 login (network share) and one from tools found in Kali that support either brute forcing logins or accessing shares. Include both the differences in successful attempts as well as failed attempts at access. 

Also Read: Daily Blog #513

Read More

Daily Blog #512: Forensic Lunch Test Kitchen 10/19/18 - SMB Brute Forcing Tools

Hello Reader,
        Another test kitchen on the books! Tonight we took a break from ObjectIDs and took a look at something I've been wanting to test for awhile, smb brute forcing tools. We ran a couple SMB Brute forcing tools:

• Hydra
• Medusa
• Ncrack
• Nmap's SMB login script
• Metasploits smb_login module
• Patator

And then went into the windows event logs to determine what they left behind that would make it obvious this was a third party smb network client trying to brute force in and not a native windows smb client. 

We learned:

• Windows 10 does not have logon failure auditing on by default
• Hydra, Medusa, Nmap and Ncrack will provide the IP Address instead of the workstation name in the event logs, which isn't normal
• Metasploit's smb_login module will set the workstation name to WORKSTATION in the event logs, which isn't normal
• Patator which is using the impacket smbconnect script passes in a null workstation name, which is again not normal
• That as of Windows 8 and Sever 2012 there is a new event log source called SMBServer which logs just SMB data, including SMB authentication failures. Very useful when the security log rolls over and is on by default!

You can watch the video here:

Also Read: Daily Blog #511

Read More