README.md

Downgrade

Write-up author: jon-brandy

DESCRIPTION:

During recent auditing, we noticed that network authentication is not forced upon remote connections to our Windows 2012 server. That led us to investigate our system for suspicious logins further. Provided the server's event logs, can you find any suspicious successful login? To get the flag, connect to the docker service and answer the questions.\

HINT:

• NONE

STEPS:

1. First, unzip the .zip given.

RESULT

2. Hmm.. Let's run the host given using netcat.

RESULT

3. It seems we need to enumerate the log file to find the correct answer, let's open the event log file using event viewer
4. Based on the question asked, let's open event log file related to it, found event log security.

RESULT

5. Yep got it right, let's answer security.

RESULT

6. Notice, we can traverse this:

7. Since it's about successfull logon, then we need to search about successfull logon.

RESULT

8. This should be the correct one, because the example ans is an id, let's enter the event id.

RESULT

9. To answer this question, scroll down and you'll find this:

RESULT

10. Let's search authPackage that stands out different.

RESULT

11. When i traverse again, found this one:

12. Let's enter 2022-09-28T13:10:57. The reason i put 15, because i'm in Indonesia and the time stamp is 7 hours ahead, so i need to reduce 7 hours.

13. Got the flag!

FLAG

HTB{34sy_t0_d0_4nd_34asy_t0_d3t3ct}