Forensics Questions¶
Each image carries two or three forensics questions as files on the desktop. They ask you to find something specific: a file's hash, the user who last logged in, the program listening on a port, a hidden file's contents, when an account was created. They're worth as much as several hardening items, and they're answered by looking, not by fixing. Do them before hardening, because hardening destroys the evidence.
How to read one¶
A forensics question is a text file. Read the whole thing; the answer format is specified at the bottom ("ANSWER:" on its own line, a hash in lower case, a date in a given format) and an answer in the wrong format doesn't score. Write the answer into the file exactly where it says and save it. The scorer reads the file.
Where the answers usually are¶
| Question type | Windows | Linux |
|---|---|---|
| Hash of a file | Get-FileHash C:\path\file -Algorithm MD5 (or SHA256) |
md5sum file, sha256sum file |
| Who logged in last, or when | Event Viewer, Security log, event 4624; net user name shows "Last logon" |
last, lastlog, sudo journalctl _COMM=sshd |
| Which program is on a port | netstat -abno, then the PID |
sudo ss -tulpn |
| A hidden file or folder | dir /a in the folder; Get-ChildItem -Force -Recurse |
ls -la; find / -name '.*' -type f |
| A file that contains a word | Select-String -Path C:\Users\*\* -Pattern word -Recurse |
grep -rl word /home /var /opt |
| When an account was created | Security log event 4720 | sudo ausearch -m ADD_USER, or /var/log/auth.log for useradd |
| A scheduled task or cron job | schtasks /query /fo LIST /v |
crontab -l -u user, /etc/cron.* |
| A user's group membership | net user name |
groups name, id name |
| A service's binary path | sc qc name, Get-WmiObject Win32_Service |
systemctl cat name |
| Something encoded | PowerShell [Convert]::FromBase64String |
base64 -d, xxd |
| Installed program version | Get-Package name |
dpkg -l name, apt policy name |
Working method¶
Read the question and decide which of the rows above it is. Run the read-only command. If the answer isn't there, the question usually names a location or a user; start from that. Don't change anything to get an answer; if a file is unreadable, sudo or an elevated prompt is the tool, not chmod.
Write the answer, save, and move on. If a question is taking more than ten minutes, leave it and come back after hardening; the points elsewhere are more certain. Just don't harden the thing the question is about until you've answered it.
Try it¶
On a practice image, write three forensics questions for a partner and have them write three for you: hide a file with a word in it, create a user with an odd group, start a listener with nc -l 4444 (Linux) or a scheduled task (Windows). Swap and answer. Then write down which commands you used; that list is the start of your forensics tool for a real round.