Velociraptor P1
Last updated
Last updated
Velociraptor is an advanced digital forensic and incident response tool that enhances your visibility into your endpoints. In this exercise we'll setup a velociraptor server based on linux and connect a windows client to it. Further we'll collect our first artefact.
Prerequisite:
Linux VM (https://livecd.hacking-lab.com/)
Windows 10 VM (https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/)
Velociraptor can be run on windows, linux and macOSX. In this case I'll run velociraptor on a virtual linux machine and I'll setup a windows box which is connected to the velociraptor server.
Original Lab developed by SAM BOWNE:
Edit the velociraptor.config.yaml configuration file and replace every localhost or 127.0.0.1 entry with the ip address of the virtual machine.
mv velociraptor.config.yaml /etc
Set administrator password:
Start Velociraptor GUI:
The basic setup of velociraptor is now up and running. We can now start to add clients in our velociraptor environment.
Edit the velociraptor.config.yaml file again.
Scroll down to the first END CERTIFICATE line.
Below the "nonce: line, insert this line, as shown in the image above.
use_self_signed_ssl: true
Prepare Client installer for windows:
I'm using winscp to transfer the repacked exe file to my windows box
Open a elevated cmd prompt:
We have now full control over the client, can browse trough the filesystem and registry or collecting some artefacts!
At the top left, click the house icon to go to the home page, which shows "Server status".
At the top center, click the "Show All" button.
In the "Client ID" column, click the blue link.
At the top center, click the Collected button.
At the top left, click the plus-sign (see image below)
At the top left, in the search box, type netstat.
Click Windows.Network.NetstatEnriched.
A description of this artifact appears, as shown below.
At the lower left, click the blue "Configure Parameters" link.
At the top left, click the wrench icon.
In the "ProcessNameRegex" field, enter velociraptor.* as shown below.
At the lower right, click the blue Launch link.
In the next screen, at the top center, click the Windows.Network.NetstatEnriched line to highlight it. In the lower pane, click the Results tab.
You see information about the Velociraptor process, as shown below:
As we know the basics, we can practise a little bit ;-)
