IR 103: Remote Triage Tools

1. Công cụ Quản lý và Truy vấn hệ thống

1.1. Tìm hiểu về WMI và cú pháp WMIC

• Chế độ tương tác trực tiếp: Thông qua một WMI-aware shell

• Chế độ không tương tác: Thông qua lệnh wmic ở cửa sổ dòng lệnh và WMI Query Language (WQL) để lọc kết quả đầu ra (Khuyên dùng)

C:\>wmic /node:"server1" process where name="svchost.exe" get name, processid, parentprocessid, commandline
CommandLine                                                                                     Name         ParentProcessId  ProcessId
C:\Windows\system32\svchost.exe -k DcomLaunch -p                                                svchost.exe  868              1008
C:\Windows\system32\svchost.exe -k RPCSS -p                                                     svchost.exe  868              924
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM                                         svchost.exe  868              1088
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC                                         svchost.exe  868              1224
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService                svchost.exe  868              1304
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc            svchost.exe  868              1312
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv                   svchost.exe  868              1400
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog                 svchost.exe  868              1488
C:\Windows\system32\svchost.exe -k LocalService -p                                              svchost.exe  868              1532
...

• Tham số /node:"server1" cho biết đây là một truy vấn đến hệ thống từ xa không phải cục bộ

• Theo sau là process cho biết đây là một aliases (bí danh) đề cập đến lớp của WMI mà chúng ta muốn tương tác. Trong trường hợp này là lớp Win32_Process

• Tiếp theo where name="svchost.exe" đây là cú pháp của WQL dùng để lọc kết quả trả về, thuộc tính Name của các đối tượng Win32_Process được chỉ định bằng svchost.exe

• Cuối cùng get name, processid, parentprocessid, commandline là danh sách các thuộc tính của đối tượng, được phân cách bằng dấu ,

• WMIC Quick Reference: https://www.appliedincidentresponse.com/wmic-quick-reference/

• Windows Management Instrumentation: https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page

class Win32_Process : CIM_Process
{
  string   CreationClassName;
  string   Caption;
  string   CommandLine;
  datetime CreationDate;
  string   CSCreationClassName;
  string   CSName;
  string   Description;
  string   ExecutablePath;
  uint16   ExecutionState;
  string   Handle;
  uint32   HandleCount;
  datetime InstallDate;
  uint64   KernelModeTime;
  uint32   MaximumWorkingSetSize;
  uint32   MinimumWorkingSetSize;
  string   Name;
  string   OSCreationClassName;
  string   OSName;
  uint64   OtherOperationCount;
  uint64   OtherTransferCount;
  uint32   PageFaults;
  uint32   PageFileUsage;
  uint32   ParentProcessId;
  uint32   PeakPageFileUsage;
  uint64   PeakVirtualSize;
  uint32   PeakWorkingSetSize;
  uint32   Priority = NULL;
  uint64   PrivatePageCount;
  uint32   ProcessId;
  uint32   QuotaNonPagedPoolUsage;
  uint32   QuotaPagedPoolUsage;
  uint32   QuotaPeakNonPagedPoolUsage;
  uint32   QuotaPeakPagedPoolUsage;
  uint64   ReadOperationCount;
  uint64   ReadTransferCount;
  uint32   SessionId;
  string   Status;
  datetime TerminationDate;
  uint32   ThreadCount;
  uint64   UserModeTime;
  uint64   VirtualSize;
  string   WindowsVersion;
  uint64   WorkingSetSize;
  uint64   WriteOperationCount;
  uint64   WriteTransferCount;
};

1.2. Một số tùy chọn của WMIC

/node Sử dụng tên máy chủ hoặc địa chỉ IP. Dưới đây là một số tùy chọn hữu ích khác:

aliases cung cấp các bí danh, giúp dễ nhớ hơn khi truy cập vào các lớp WMI

Tham khảo: https://docs.microsoft.com/en-us/windows/win32/wmisdk/like-operator

$ wmic process where "Name like 'svchost%'" get name, processid, parentprocessid, commandline
$ wmic process where 'Name like "svchost%"' get name, processid, parentprocessid, commandline
$ wmic process where (Name like "svchost%") get name, processid, parentprocessid, commandline

$ wmic computersystem list /format:csv > output.csv
$ wmic /output:output.csv computersystem list /format:csv

1.3. Một số ví dụ về WMIC

$ wmic environment list brief /format:list > \\server1\BaselineData\Client2\environment.txt

$ wmic /node:server1 /output:processes.txt process get name, processid, parentprocessid, threadcount, handlecount, commandline
$ wmic /node:"server1" /output:processes.txt process get name, processid, parentprocessid, threadcount, handlecount, commandline /format:list

$ wmic /node:"server1" process where name="CRACKME.EXE" delete
Deleting instance \\server1\ROOT\CIMV2:Win32_Process.Handle="2764"
Instance deletion successful.

$ wmic process where (ExecutablePath LIKE "%Download%") get name, executablepath
ExecutablePath                                                        Name
C:\Program Files (x86)\Internet Download Manager\IDMan.exe            IDMan.exe
C:\Program Files (x86)\Internet Download Manager\IDMIntegrator64.exe  IDMIntegrator64.exe
...

$ wmic process where (NOT ExecutablePath LIKE "%Windows%") get name, executablepath, parentprocessid
ExecutablePath                                                                                                             Name                                 ParentProcessId
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe                                             OfficeClickToRun.exe                 836
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe                                                              sqlwriter.exe                        836
C:\Program Files\Canon\Canon MF Network Scanner Selector\CMFNSS6.EXE                                                       CMFNSS6.EXE                          8028
C:\Program Files\Google\Chrome\Application\chrome.exe                                                                      chrome.exe                           9824
...

$ wmic /node:"server1" process call create "calc"
Executing (Win32_Process)->Create()
Method execution successful.
Out Parameters:
instance of __PARAMETERS
{
        ProcessId = 6184;
        ReturnValue = 0;
};

$ wmic /node:"server1" process where (Name LIKE "%Calc%") get name, processid, parentprocessid, commandline
CommandLine                                                                                                                                                        Name            ParentProcessId  ProcessId
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca  Calculator.exe  1008             11660

$ wmic nicconfig get MACAddress, DefaultIPGateway, IPAddress, DNSHostName
DefaultIPGateway  DNSHostName      IPAddress                                        MACAddress

{"192.168.10.1"}  server1  {"192.168.10.116", "f88c::d559:1201:df56:b6c4"}  00:61:96:DF:F4:3E
...

$ wmic /node:"server1" share list brief
Description    Name    Path
Remote Admin   ADMIN$  C:\Windows
Default share  C$      C:\
Default share  D$      D:\
Default share  E$      E:\
Default share  F$      F:\
Remote IPC     IPC$

# Exclude Default Share
$ wmic /node:"server1" share where (NOT Name LIKE "%$") list brief
No Instance(s) Available.

$ wmic /node:server1 /user: administrator@company.demo service get Name, Caption, State, StartMode, pathname /format:csv

$ wmic /node:"server1" service get Name, Caption, State, StartMode, pathname /format:csv
Node,Caption,Name,PathName,StartMode,State
server1,Base Filtering Engine,BFE,C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p,Auto,Running
server1,AllJoyn Router Service,AJRouter,C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p,Manual,Stopped
server1,Application Layer Gateway Service,ALG,C:\Windows\System32\alg.exe,Manual,Stopped
server1,Application Host Helper Service,AppHostSvc,C:\Windows\system32\svchost.exe -k apphost,Auto,Running
...

$ wmic /node:"server1" service get Name, Caption, State, StartMode, pathname /format:list
Caption=Application Layer Gateway Service
Name=ALG
PathName=C:\Windows\System32\alg.exe
StartMode=Manual
State=Stopped

Caption=AppX Deployment Service (AppXSVC)
Name=AppXSvc
PathName=C:\Windows\system32\svchost.exe -k wsappx -p
StartMode=Manual
State=Running

Caption=DHCP Client
Name=Dhcp
PathName=C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
StartMode=Auto
State=Running
...

# Systems.txt
DC1
DC2
SERVER1
SERVER2
CLIENT1
CLIENT2

$ wmic /node:@Systems.txt qfe get csname, description, FixComments, HotFixID, InstalledBy,InstalledOn,ServicePackInEffect
$ wmic /node:"server1" qfe get csname, description, FixComments, HotFixID, InstalledBy,InstalledOn,ServicePackInEffect
CSName   Description      FixComments  HotFixID   InstalledBy          InstalledOn  ServicePackInEffect
server1  Update                        KB5007289  NT AUTHORITY\SYSTEM  11/27/2021
server1  Update                        KB5000736                       4/9/2021
server1  Update                        KB5003791  NT AUTHORITY\SYSTEM  11/27/2021
...

$ wmic /node:@Systems.txt /failfast:on qfe get csname, description, FixComments, HotFixID, InstalledBy,InstalledOn,ServicePackInEffect 1>results.txt 2>errors.txt

# Hosts.txt
DC1
DC2
SERVER1
SERVER2

$ for /F %i in (Hosts.txt) do @echo scanning %i & wmic /node:%i process get name, processid, parentprocessid, threadcount, handlecount >> %i.txt & wmic /node:%i environment list brief >> %i.txt & wmic /node:%i nicconfig get MACAddress, DefaultIPGateway, IPAddress, IPSubnet, DNSHostName, DNSDomain >> %i.txt & wmic /node:%i service get Name, Caption, State, ServiceType, StartMode, pathname >> %i.txt & wmic /node:%i qfe get description, FixComments, HotFixID, InstalledBy, InstalledOn, ServicePackInEffect >> %i.txt
# Example, run in local, for one machine
$ echo scanning %computername% & wmic /node:"%computername%" process get name, processid, parentprocessid, threadcount, handlecount >> %computername%.txt & wmic /node:"%computername%" environment list brief >> %computername%.txt & wmic /node:"%computername%" nicconfig get MACAddress, DefaultIPGateway, IPAddress, IPSubnet, DNSHostName, DNSDomain >> %computername%.txt & wmic /node:"%computername%" service get Name, Caption, State, ServiceType, StartMode, pathname >> %computername%.txt & wmic /node:"%computername%" qfe get description, FixComments, HotFixID, InstalledBy, InstalledOn, ServicePackInEffect >> %computername%.txt

2. PowerShell

$ Get-Help Get-Process -Detailed

$ Get-Command *process*

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Function        Get-AppvVirtualProcess                             1.0.0.0    AppvClient
Function        Start-AppvVirtualProcess                           1.0.0.0    AppvClient
Cmdlet          ConvertTo-ProcessMitigationPolicy                  1.0.12     ProcessMitigations
Cmdlet          Debug-Process                                      3.1.0.0    Microsoft.PowerShell.Management
Cmdlet          Enter-PSHostProcess                                3.0.0.0    Microsoft.PowerShell.Core
Application     qprocess.exe                                       10.0.19... C:\Windows\system32\qprocess.exe
...

2.1. Powershell và các CmdLet cơ bản

$ Get-Process | Get-Member

   TypeName: System.Diagnostics.Process

Name                       MemberType     Definition
----                       ----------     ----------
Handles                    AliasProperty  Handles = Handlecount
Name                       AliasProperty  Name = ProcessName
Disposed                   Event          System.EventHandler Disposed(System.Object, System.EventArgs)
Kill                       Method         void Kill()
Start                      Method         bool Start()
__NounName                 NoteProperty   string __NounName=Process
BasePriority               Property       int BasePriority {get;}
Container                  Property       System.ComponentModel.IContainer Container {get;}
EnableRaisingEvents        Property       bool EnableRaisingEvents {get;set;}
Company                    ScriptProperty System.Object Company {get=$this.Mainmodule.FileVersionInfo.CompanyName;}
CPU                        ScriptProperty System.Object CPU {get=$this.TotalProcessorTime.TotalSeconds;}
...

Get-Process | Select-Object -Property ProcessName, ID, StartTime

ProcessName                        Id StartTime
-----------                        -- ---------
ApplicationFrameHost             2176 18/12/2021 8:23:09 AM
audiodg                          8084 20/12/2021 9:16:49 AM
backgroundTaskHost               8476 20/12/2021 10:51:19 AM
Calculator                      11344 18/12/2021 8:25:16 AM
chrome                            664 20/12/2021 9:35:11 AM
...

$ Get-ChildItem
$ ls
$ dir
$ gci

$ Get-Process | Select-Object -Property ProcessName, ID, StartTime
$ gps | select name, ID, starttime

$ Get-Process -Name "powers*"
$ Get-Process | Where-Object -Property name -Like power*

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    500      26    63336      73664       0.58  11152   1 powershell
    906      53   166044     185112      62.95  11788   1 powershell

$ Get-Process | Format-Table -Property ProcessName, Id

ProcessName                        Id
-----------                        --
ApplicationFrameHost             2176
audiodg                         14168
Calculator                      11344
chrome                            664
...

2.2. Quản trị từ xa với Powershell

• Enter-PSSession: Kết nối từ xa kiểu 1-1 tương tự như SSH

• Invoke-Command: Kết nối từ xa kiểu 1-n, cho phép các lệnh được chạy trên nhiều hệ thống song song

• Enter-PSSession: Chỉ chấp nhận tên của một máy tính ở một thời điểm

• Invoke-Command: Chấp nhận nhiều tên máy tính ở một thời điểm

$ Enter-PSSession -ComputerName DC1 -Credential administrator@company.demo

$ Invoke-Command -ComputerName dc1, dc2, dc3, dc4 -ScriptBlock {Get-Process | Where-Object -Property name -eq chrome}

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName   PSComputerName
-------  ------    -----      -----     ------     --  -- -----------   --------------
    405      20   114040     165372     105.72   1232   1 chrome        dc1
    276      17    28112      65400       9.64   2656   1 chrome        dc2
    274      17    21996      48112       0.58   7176   1 chrome        dc3
    288      22    53204      94308       2.28   7304   1 chrome        dc4

2.3. Truy cập vào các lớp WMI/MI/CIM với Powershell

$ Get-CimInstance -ClassName Win32_Process

$ Get-Process | Get-Member

TypeName: System.Diagnostics.Process

Name                       MemberType     Definition
----                       ----------     ----------
Handles                    AliasProperty  Handles = Handlecount
Name                       AliasProperty  Name = ProcessName
..
Disposed                   Event          System.EventHandler Disposed(System.Object, System.EventArgs)
ErrorDataReceived          Event          System.Diagnostics.DataReceivedEventHandler ErrorDataReceived(System.Object, System.D...
..
BeginErrorReadLine         Method         void BeginErrorReadLine()
BeginOutputReadLine        Method         void BeginOutputReadLine()
..
BasePriority               Property       int BasePriority {get;}
Container                  Property       System.ComponentModel.IContainer Container {get;}
..
PSConfiguration            PropertySet    PSConfiguration {Name, Id, PriorityClass, FileVersion}
PSResources                PropertySet    PSResources {Name, Id, Handlecount, WorkingSet, NonPagedMemorySize, PagedMemorySize, ...
..

$ Get-CimInstance -ClassName Win32_Process | Get-Member

TypeName: Microsoft.Management.Infrastructure.CimInstance#root/cimv2/Win32_Process

Name                       MemberType     Definition
----                       ----------     ----------
Handles                    AliasProperty  Handles = Handlecount
ProcessName                AliasProperty  ProcessName = Name
..
Clone                      Method         System.Object ICloneable.Clone()
Dispose                    Method         void Dispose(), void IDisposable.Dispose()
..
Caption                    Property       string Caption {get;}
CommandLine                Property       string CommandLine {get;}
..
Path                       ScriptProperty System.Object Path {get=$this.ExecutablePath;}

$ Get-CimInstance -ClassName Win32_Process | Format-Table -Property Name, ProcessId, ParentProcessId, CommandLine

Name                                ProcessId ParentProcessId CommandLine
----                                --------- --------------- -----------
System Idle Process                         0               0
System                                      4               0
Registry                                  124               4
smss.exe                                  484               4
csrss.exe                                 656             644
wininit.exe                               748             644
csrss.exe                                 756             740
services.exe                              820             748
lsass.exe                                 840             748 C:\Windows\system32\lsass.exe
winlogon.exe                              916             740 winlogon.exe
svchost.exe                               496             820 C:\Windows\system32\svchost.exe -k DcomLaunch -p
fontdrvhost.exe                           584             748 "fontdrvhost.exe"
fontdrvhost.exe                           596             916 "fontdrvhost.exe"
svchost.exe                               868             820 C:\Windows\system32\svchost.exe -k RPCSS -p
svchost.exe                              1044             820 C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
dwm.exe                                  1112             916 "dwm.exe"
...

3. Một số Incident Response Framework

4. Kết luận

5. Tham khảo

• Steve Anson (2020). Applied Incident Response, John Wiley & Sons, Inc