Mouse Trap

In the world of cyber security, we often talk about a game of cat and mouse.

Follow the adventures of Jom and Terry, members of the TryMouseMe purple team, as they work through a thrilling exercise of Attack and Defense. From initial access to persistence, you will emulate a three-stage attack on a Windows environment.

Attack Emulation VM

Click the green Start Machine button to start the machine above.

Please give the VM 5 minutes to boot up.

While you wait for the machine to start, familiarise yourself with the attack chain and engagement information below.

Note: It is highly recommended to use the AttackBox for this task.

Attack Chain

To test the capabilities of the blue team, you have been tasked to use the following TTPs to compromise the target:

Tactics	Techniques	Procedures
TA001: Initial access	Exploit Public-Facing Application (T1190)	After finding a vulnerable service, you will get a user shell via remote code execution.
TA004: Privilege Escalation	Path Interception by Unquoted Path (T1574.009)	You will then escalate your privileges through an unquoted service path.
TA003: Persistence	Registry Run Keys / Startup Folder (T1547.001) Create Account: Local Account (T1136.001)	Finally, you will maintain persistence thanks to registry run keys and local user account creation.

Engagement Specifications

To effectively detect the activities conducted during the emulation, here are the specific Indicators of Compromise (IOCs) that must be followed during the execution of the attack vectors:

Technique	Requirements
Remote code execution	Once you’ve found the CVE and exploit, use the version that uses SMB, not HTTP Generate a Windows stageless reverse TCP (x64) shell Ensure that your reverse shell is called shell.exe
Unquoted service path	Use SharpUp.exe for enumeration, located in C:\Users\purpletom Target the Mobile Mouse directory while executing the unquoted service path abuse
Registry run keys and local account creation	Use the HKEY_CURRENT_USER registry hive Use the SYSTEM user when creating the run key persistence Specify the registry key name (shell) Use the following path for the payload (C:\Windows\Temp\shell.exe) Specify the name of the backdoor user (terry)