1. Introduction
This challenge was part of the HTB Holmes CTF 2025 which was the first one of it’s kind. Being only about blue teaming and not the usual mostly red teaming CTF with the challenge of trying to exploit some vulnerabilities and trying to gain access to various systems. Instead this CTF covered Threat Intelligence, SOC, DFIR and malware reversing which are not usually seen in typical CTFs.
I competed in team Kapital alongside my amazing teammates, hakal, profzzor and jason who also helped me with this challenge! (Kudos to them)
We completed the CTF in under 4 hours and we placed in 4th place missing the 3rd place by just few seconds!
I mostly completed this challenge by myself but jason and profzzor completed some of the flags and hakal also helped me where to look for certain flags!
But with that background information out of the way let’s get into the actual challenge!
2. Methodology
Tools used:
| Evidence Type | Tools used | Purpose |
|---|---|---|
| Disk forensics | Autopsy | Initial overview |
| Network log (pcapng) | Wireshark | Analyze the network traffic |
| Registry | RegistryExplorer | Analyze registry hives |
| $UsnJournal | MFTECmd & Timeline Explorer | Parse and view record of changes |
3. Evidence analysis
3.1 Situation overview
Our scenario for this case:
With help from D.I. Lestrade, Holmes acquires logs from a compromised MSP connected to the city’s financial core. The MSP’s AI servicedesk bot looks to have been manipulated into leaking remote access keys - an old trick of Moriarty’s.
We were also given a zip file which had our files regarding this case. Inside of that zip file we had the following files (top level view).
| |
Weirdly the __MACOSX folder wasn’t useful for us since it only had files with size of 1kb. So we focused on the pcapng and the disk C.
The scenario info is giving us a hint that the adversary exploited the AI bot to leak credentials. Thus we start our investigation from the given pcapng file.
3.2 Network analysis
3.2.1 AI Chat Overview
Upon opening the pcapng file we can immediately filter the traffic for HTTP traffic since the AI most likely had some web interface.
Upon filtering we can see that we are receiving JSON from the AI and specifically when doing a GET request on the /api/messages endpoint. On POST request the client sends users message as JSON to the AI. So on the GET requests it returns the whole conversation up till that point so we can easily see what the AI responded and what user sent to the AI.
Figure 1: HTTP traffic between the AI and user
On closer investigation we can see that there are only 2 users (IP addresses) talking with the AI, 10.32.43.31 and 10.0.69.45. This we can easily find from the Wireshark under Statistics -> Conversations .
Figure 2: HTTP traffic statistics according to Wireshark
3.2.2 Legitimate User
Since we are left with two IPs to investigate we can easily take a look what they have been sending to the AI. As mentioned before the GET request on the /api/messages endpoint returns all messages until that point, we can take a look what user with IP 10.32.43.31 has been sending.
| |
The user with IP 10.32.43.31 seems to be IT Admin Borock and when looking at this conversation we can rule out the IP 10.32.43.31 as it seems to belong legitimate employee.
3.2.3 Attacker Chat
We are now left with the IP 10.0.69.45 which most likely is our attacker. Upon looking at the conversation between AI and someone who seems to refer to themselves as Watson, we can easily tell him to be our attacker.
| |
From the above JSON we can create shorter timeline how attacker used the AI to retrieve the credentials to the RMM.
Figure 3: Shorter timeline of attacker’s prompts to the AI
That concludes our network analysis since the pcapng file doesn’t seem to have anything related to the attacker trying to use those credentials immediately. Maybe we can find more information from the disk of what went down.
4. Attacker’s movement and actions on workstation
4.1 Initial access
Since we now know that the attacker has some kind of remote management software’s credentials we should look around for remote management tools.
| |
Tree command shows us that we have TeamViewer folder under Program Files which indicates that the workstation most likely has TeamViewer installed.
Upon closer look we have log files related to the TeamViewer under the above mentioned folder.
| |
And looking at the Connections_incoming.txt we can see the following:
| |
This is most certainly the attacker connecting with TeamViewer to the machine using RMM account named “James Moriarty”.
We can also confirm the machine’s internal IP address from which the attacker connected to be 192.168.69.213 from the TeamViewer15_Logfile.log.
| |
Now that we have covered how the attacker got into our systems we can move onto looking how attacker moved (pun intended) and what actions they took.
4.2 Tools were uploaded to workstation
Looking at the TeamViewer15_Logfile.log closer we can see that the attacker has created folder (C:\Windows\Temp\safe) where they transferred their tools to use to collect credentials and other sensitive information from the system.
| |
And specifically it seems that they have brought Mimikatz, Everything and some zip files which probably contain executables that are used to collect credentials, cookies and a like from web browsers.
These files that the attacker uploaded to the workstation are definitely concerning and we should next up look if they were executed in the system. Though given the limited artifacts given to us makes our investigation harder but obviously not impossible!
4.3 Execution of uploaded tools
Given that we have UsnJournal we can parse that with MFTECmd to load it to Timeline Explorer.
| |
When searching for Mimikatz in Timeline Explorer we were able to find that UsnJournal has actually logged the creation of Mimikatz.exe prefetch file and thus we can confirm that the attacker has ran Mimikatz.
Figure 4: Creation of Mimikatz.exe.pf logged in UsnJournal
We are also able to confirm that most of the other executables were executed also since creation of the prefetch file was also logged by UsnJournal.
Figure 5: Creation of other executables logged in UsnJournal
The attacker likely executed the Everything to find sensitive files on the workstation so that they could exfiltrate later.
Weirdly enough the attacker didn’t run the JM.exe file which could indicate its purposes might be for something else (persistence?)
4.4 Local collection and exfiltration
We can now confirm that the attacker most likely has collected something from our system so we should at this point look if the attacker has exfiltrated anything to his machine. Most logical point would be to turn towards the TeamViewer15_Logfile.log file once again to look if they have used the TeamViewer connection to exfiltrate files.
After a while looking at it we can found that the attacker seems to have exfiltrated files after most likely looking at the system with Everything for sensitive files.
| |
Attacker seems to have stolen some sensitive files that could expose employees of the company and some of the company’s internals as well. There is also mention of a kdbx file which most likely is backup KeePass database having important credentials.
At this point we have almost confirmed whole kill chain what the attacker has done. We still need to look at if the attacker created some kind of persistence mechanism on the system.
4.5 Persistence (Winlogon Helper DLL)
After looking at various persistence locations using Registry Explorer I was able to find the persistence mechanism from SOFTWARE registry hive. The persistence mechanism specifically was leveraging Winlogon Helper DLL (T1547.004).
Figure 6: Attacker persistence mechanism leveraging Winlogon
As we can see the earlier uploaded file JM.exe was actually used as persistence mechanism. What this means is that JM.exe will be ran once user logs in. But we have no idea what JM.exe might do but most likely gives some kind of backdoor access to the attacker.
5. Timeline
Let’s wrap up what the attacker did on the workstation.
Initial access (20.08.2025, 09:58:25) - Attacker used breached RMM credentials to connect to the workstation using TeamViewer (TeamViewer log)
Tool transfer (20.08.2025, 10:02:49) - Attacker uploaded multiple tools to
C:\Windows\Temp\safe\using TeamViewer (mimikatz.exe,Everything,JM.exe, browser credential stealers) (TeamViewer log)Potential OS Credential Dumping (20.08.2025, 10:07:08) - Attacker executed Mimikatz (USNJournal)
Credentials from Web Browsers (20.08.2025, 10:09:14) - Attacker executed their web browser credential stealer (USNJournal)
File and Directory Discovery (20.08.2025, 10:09:42) - Attacker used Everything to find sensitive files
Exfiltration Over C2 Channel (20.08.2025, 10:12:07) - Files collected to Flyover folder were exfiltrated via TeamViewer connection that was used for initial access
Winlogon Helper DLL (20.08.2025, 10:13:57) - Attacker added the JM.exe to SOFTWARE hive under
Microsoft\Windows NT\CurrentVersion\Winlogon
Figure 7: Visualization of the adversary’s attack flow
6. Challenge Questions & Flags
- What was the IP address of the decommissioned machine used by the attacker to start a chat session with MSP-HELPDESK-AI? (IPv4 address)
This was covered in the section 3.2.3 and the IP is 10.0.69.45
- What was the hostname of the decommissioned machine? (string)
We can obtain this by filtering for ip.addr == 10.0.69.45 in Wireshark.
And we obtain the hostname to be WATSON-ALPHA-2
- What was the first message the attacker sent to the AI chatbot? (string)
This was covered in the section 3.2.3 to be Hello Old Friend
- When did the attacker’s prompt injection attack make MSP-HELPDESK-AI leak remote management tool info? (YYYY-MM-DD HH:MM:SS)
We were able to get this from the JSON in the section 3.2.3 and the answer is 2025-08-19 12:02:06
- What is the Remote management tool Device ID and password? (IDwithoutspace:Password)
This was also covered in section 3.2.3 and the answer is: 565963039:CogWork_Central_97&65
- What was the last message the attacker sent to MSP-HELPDESK-AI? (string)
We were also obtain this from the JSON by looking at the end of it. The answer is JM WILL BE BACK
- When did the attacker remotely access Cogwork Central Workstation? (YYYY-MM-DD HH:MM:SS)
We covered this in the section 4.1. The answer is 20-08-2025 09:58:25 as per teamviewer connections incoming.txt file.
- What was the RMM Account name used by the attacker? (string)
We also got this from the same file and the account name was James Moriarty
- What was the machine’s internal IP address from which the attacker connected? (IPv4 address)
This was covered in the 4.1 section to be 192.168.69.213
- The attacker brought some tools to the compromised workstation to achieve its objectives. Under which path were these tools staged? (C:\FOLDER\PATH)
We covered this in the section 4.2 and the path is C:\Windows\Temp\safe
- Among the tools that the attacker staged was a browser credential harvesting tool. Find out how long it ran before it was closed? (Answer in milliseconds) (number)
We were able to figure this from NTUSER.dat and specifically the UserAssist which recides under Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist. From here we can see that the credential harvesting tool was ran for 8000 ms or 8 seconds.
- The attacker executed a OS Credential dumping tool on the system. When was the tool executed? (YYYY-MM-DD HH:MM:SS)
We were able to get this already in section 4.3 but since the mimikatz.exe prefetch file was created at 2025-08-20 10:07:08 we can assume that around that time it was executed.
- The attacker exfiltrated multiple sensitive files. When did the exfiltration start? (YYYY-MM-DD HH:MM:SS)
This was covered in section 4.4 and the exfiltration started exactly at 2025-08-20 10:12:07
- Before exfiltration, several files were moved to the staged folder. When was the Heisen-9 facility backup database moved to the staged folder for exfiltration? (YYYY-MM-DD HH:MM:SS)
We can obtain this from looking at the USNJournal records and they indicate that the backup database was created a second time and also during the investigation we saw the creation of the folder so the answer is 2025-08-20 10:11:09
- When did the attacker access and read a txt file, which was probably the output of one of the tools they brought, due to the naming convention of the file? (YYYY-MM-DD HH:MM:SS)
We earlier saw that the attacker exfiltrated a file named dump.txt so we can figure out the answer by looking at automatic destination jumplists. Upon analyzing them we were able to get that the dump.txt was accessed at 2025-08-20 10:08:06
- The attacker created a persistence mechanism on the workstation. When was the persistence setup? (YYYY-MM-DD HH:MM:SS)
This was covered in section 4.5 but the attacker added their JM.exe under userinit which means JM.exe will be executed when user logs in. Timestamp for the attacker creating the persistence mechanism is 2025-08-20 10:13:57
- What is the MITRE ID of the persistence subtechnique? (Txxxx.xxx)
Modifying Winlogon anyway results to be MITRE ID T1547.004
- When did the malicious RMM session end? (YYYY-MM-DD HH:MM:SS)
We can get this from the Connections_incoming.txt file. As we know the attacker used James Moriarty account we can see that after the first timestamp there is 20-08-2025 10:14:27 which most likely refers to disconnection of the TeamViewer connection
- The attacker found a password from exfiltrated files, allowing him to move laterally further into CogWork-1 infrastructure. What are the credentials for Heisen-9-WS-6? (user:password)
We were also given the backup database and obviously there isn’t mention of the password anywhere. Thus we need to convert the kdbx file to hash using keepass2john
| |
After that simply just run john against the hash with the good old rockyou and we got the password! (cutiepie14)
We can now use that password to open the kdbx file with KeePass.
Upon entering the password and opening we are able to now read the credentials for Heisen-9-WS-6.
So we get the credentials to be Werni:Quantum1!
7. Lessons Learned
Here are some key takeaways from this CTF challenge.
- Don’t include any credentials in the AI model’s training data and instead create proper documentation how to do various things instead of relying on some AI chatbot
- It is important to monitor and log remote access tools like TeamViewer and maybe create allowlists/blocklists to restrict who can connect to various PCs
- Value of registry when trying to find persistence mechanisms
- Power of USNJournal when not having all the artifacts
8. Reflection
This was my first CTF, and it being blue team related, was very interesting for me because I have been doing Sherlock challenges since spring of this year. Now I got to test my skills in practice and in a somewhat stressful event.
This CTF and these challenges taught me more and I learnt something new! I read other writeups and they introduced me to new tools and knowledge that I will definitely use on future Sherlocks and CTFs.
It’s frustrating to miss 3rd place by just a few seconds, but it makes you want to try even harder. Our team has already made sure that, wen next CTF comes around, we will be ready to place in the top three.
