EU 2003 - Briefing: Burnett & Foster

### Overview In this Black Hat Briefing presentation, James C. Foster and Mark Burnett discuss practical server forensics and attack recreation techniques within Windows 2000 and Windows Server 2003 environments. Rather than focusing on legal chain-of-custody, evidence preservation, or formal investigative suites like EnCase, the speakers focus on incident response for security professionals who need to determine how an intrusion occurred, establish a timeline of events, evaluate the scope of exposure, and identify what services or data were compromised. Alongside forensic tricks, the presentation explores anti-forensics concepts and introduces two newly written scripts—`logs` and `piler`—designed to alter or corrupt log files and file system timestamps.

### Key Topics - **Timeline Reconstruction & Time Anomaly Analysis:** Determining server time zones from IIS log rotation schedules (midnight UTC), accounting for Daylight Saving Time variations between the US and the EU, and recognizing clock tampering (such as appended duplicate hours when a system clock is rolled back). - **Web & File Change Tracking:** Utilizing tools like Microsoft Log Parser to identify web page modifications by analyzing client HTTP response transitions from 304 Not Modified to 200 OK. The presenters also highlight monitoring the NTFS Change Journal using the native `fsutil` command in Windows XP/2003. - **Registry Forensics & Process Context:** Leveraging hidden registry metadata—specifically last-write timestamps on service configuration keys, Most Recently Used (MRU) lists, and "Open With" entries—to discover when services changed or when applications were launched. Querying WMI to discover exact process start times and inspecting DNS client cache TTLs via `ipconfig /displaydns` to determine when lookups occurred. - **Evidence Obfuscation & Tool Releases:** Demonstrating `logs` (a tool to delete entries, randomize IP addresses, or spoof IP addresses in log files) and `piler` (a utility designed to mass-modify or randomize file creation, modification, and access timestamps recursively across directories).

### Technical Details - **Service States via Registry Keys:** While `regedit` hides timestamps, the registry API tracks the last-write time of keys. By querying the `Start` value under service keys using Log Parser, investigators can see if a service was reconfigured or disabled around the time of intrusion. - **Process Discovery via WMI:** Because Task Manager does not show process creation times, WMI queries are used to reveal the executable path, parent process, and exact process start timestamp, allowing analysts to correlate malware execution directly with server logs. - **User Access & Artifact Indicators:** File presence in the Recycle Bin indicates deletion via Windows Explorer rather than the command prompt, pointing to local console or Terminal Services (RDP) access. Additionally, the creation of a profile directory for the `TsInternetUser` account highlights administrative abuse of terminal services. On Windows 2000, clicking Start Menu shortcuts updates the last modified timestamp of the shortcut icons. - **Memory Hunting with SoftICE:** The speakers demonstrate using the SoftICE debugger (`s 0 l ffffffff "string"`) to hunt for known ShellCode byte sequences directly across memory addresses when logs and disk artifacts have been wiped by worms. - **Hidden Logs & ROT13 Artefacts:** Windows keeps a hidden log (`SchedLgU.txt` or `schedlog.txt`) in `%SystemRoot%\Tasks`. Furthermore, certain Windows shell registry entries track clicked programs and URLs using simple ROT13 encoding.

### Takeaways Time correlation across disparate logs (IIS, firewalls, Snort) is the most critical component of Windows incident response. When attackers delete or scramble logs, investigators can piece together activity by combining secondary indicators: registry last-write timestamps, WMI process start times, DNS cache TTLs, NTFS journal changes, and file ownership (such as unexpected files owned by the `IUSR_` account). Conversely, defenders must recognize that forensic evidence can be easily cast into doubt or invalidated by simple anti-forensic timestamp and log-corruption utilities.