``Forensics Question 1 correct``

Open ``pGina.fork`` and go to ``Plugin Selection``

Double click ``LDAP`` and check ``Show Text`` for the ``Search Password``

The Search DN, ``uid=admin,ou=system``, is the answer to the first part
The Search Password, ``seeleisreal``, is the answer to the second part

``Forensics Question 2 correct``

This forensic requires us to look in the histories of Microsoft Edge

The history file is stored in the following directory: ``C:\Users\{user}\AppData\Local\Microsoft\Edge\User Data\Default\History``

These files are SQLite databases, so a SQLite Database viewer is required. On this forensic, I used ``https://inloop.github.io/sqlite-viewer/``

For each database file, look at the ``urls`` and ``downloads`` tables, looking for a match to pinball

Eventually, you check the database file of ``mkatsuragi``, and you find data related pinball. ``mkatsuragi`` is the answer to the first part of the question

Since this on a live system, we can log into the mkatsuragi's account, and the README is so convienent by giving us the password to it

Log into the account and open edge and go to the history, where you see two dates: February 3, 2025 and February 5, 2025

The second part's answer is February 3, 2025 in MM/DD/YYYY format, so ``2/3/2025``

``Forensics Question 3 correct``

This is an alternative data stream (ADS) question

To find all the data streams for the wallpaper file, located at ``C:\Users\sikari\Pictures\wallpaper.jpg``, run the following command: ``Get-Item "C:\Users\sikari\Pictures\wallpaper.jpg" -Stream *``

The stream name ``ramiel`` is what we are looking for: get the contents using the following command: ``Get-Content "C:\Users\sikari\Pictures\wallpaper.jpg" -Stream ramiel``

The content is this: ``I am the lowest of the low``

``Removed unauthoirzed user mimakinami``

Open ``Apache Directory Studio`` then click ``NERV`` in the ``Connections`` tab

After that, expand ``DIT`` and go to ``Root DSE\dc=nerv,dc=net,ou=users`` and delete ``uid=mimakinami``

``User alsoryu is not an administrator``

Open ``Apache Directory Studio`` then click ``NERV`` in the ``Connections`` tab

After that, expand ``DIT`` and go to ``Root DSE\dc=nerv,dc=net,ou=groups`` and click on ``cn=Administrators``

Delete the ``member`` row containing alsoryu

``User rayanami has a password``

Open ``Apache Directory Studio`` then click ``NERV`` in the ``Connections`` tab

After that, expand ``DIT`` and go to ``Root DSE\dc=nerv,dc=net,ou=users``, right click ``uid=rayanami`` and go to Extended Operations > Password Modify...

Check ``Old password not available (admin only)`` and enter some random password (can't generate a password)

``User sikari has password hash stored in SSHA-512``

Open ``Apache Directory Studio`` then click ``NERV`` in the ``Connections`` tab

After that, expand ``DIT`` and go to ``Root DSE\dc=nerv,dc=net,ou=users,uid=sikari``, and double click the userPassword attribute

Enter a new password (I recommend the current password) and set the hashing method to ``SSHA-512``

``Built-In Windows Administrator Disabled``

Open ``Apache Directory Studio`` then click ``NERV`` in the ``Connections`` tab

After that, expand ``DIT`` and go to ``Root DSE\dc=nerv,dc=net,ou=system,uid=admin``, right click inside the attribute editor and click ``Add Attribute...``

For the name, type ``pwdAccountLockedTime`` and click Finish

You will be given warnings, select to give the attribute a value and give it the value ``000001010000Z``, selecting the checkbox to make the value valid

Once the value is saved, it will look like it didn't create a value. This is expected as attribute is considered an "operational attribute"

Open an elevated command prompt and run ``net user Administrator /active:no``

Reference: https://stackoverflow.com/questions/26334705/how-to-disable-user-in-apache-directory-ldap

``Limit use of blank passwords to console logon only [Enabled]``

Open ``secpol.msc`` and go to ``Local Policies\Security Options`` and set ``Accounts: Limit local account use of blank passwords to console logon only`` to ``Enabled``

``Authenticated Users are no longer trusted for delegation``

Open ``secpol.msc`` and go to ``Local Policies\User Rights Management`` and clear ``Enable computer and user accounts to be trusted for delegation``

``Audit sensitive privledge use [success/failure]``

Open ``secpol.msc`` and go to ``Local Policies\Audit Policy`` and configure ``Audit privledge use`` to audit success and failure events

Then go to ``Local Policies\Advanced Audit Policy Configuration\System Audit Policies - Local Group Policy Object\Privledge Use`` and configure ``Audit Sensitive Privilege Use`` to audit success and failure events

``Users may no longer logon as a service``

Open ``secpol.msc`` and go to ``Local Policies\User Rights Management`` and remove the ``Users`` group from ``Log on as a service``

``Use FIPS complient algorithms for encryption, hashing, and signing [enabled]``

Open ``secpol.msc`` and go to ``Local Policies\Security Options`` and set ``System cryptography: Use FIPS compliant cryptographic algorithms, including encryption, hashing and signing algorithms`` to ``Enabled``

``RDP Connection Security Rule is configured to require inbound authentication``

Open ``secpol.msc`` and go to ``Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security - Local Group Policy Object\Connection Security Rules`` and double click ``RDP``

Go to the ``Authentication`` tab and set the authentication mode to require inbound and outbound connections

``WinRM only allows management from the local system (README VULN)``

Open ``gpedit.msc`` and navigate to ``Computer Configuration\Administrative Templates\Windows Components\Windows Remote Management\WinRM Service`` and enable ``Allow remote server management through WinRM``, supplying an IPv4 filter of ``127.0.0.1``

``Windows Defender Firewall is active on Ethernet0 interface when using Public profile``

Open Windows Firewall and click on ``Windows Defender Firewall Properties``. Navigate to ``Public Profile`` and click ``Customize`` next to ``Protected network connections:``

Check the ``Ethernet0`` checkbox

``Removed SMB v1.X support``

Open ``Server Manager`` and click Manage > Remove Roles and Feature. Go to the ``Features`` tab and uncheck the ``SMB 1.0/CIFS File Sharing Support`` feature and then procede with the uninstallation

``Group Users no longer has full control over Pydio folder``

Locate the ``pydio`` folder in ``C:\inetpub\wwwroot`` and open its advanced security menu. Disable inheritance and convert the permissions to explicit permissions. Edit the ``Users`` group permissions to only give the group the ``Read & Execute``, ``List folder contents``, and ``Read`` permissions

``Screen locks on screensaver``

Open CMD and run ``reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 1 /f``

``A majority of  Windows Updates are installed``

Windows Updates are currently broken on this image. Trying to start the ``Windows Update`` service, ``wuauserv``, you get the following error: ``The service is not responding to the control function``

The easiest way to fix this is to get a baseline of the ``wuauserv`` registry keys, which can be found here: https://www.elevenforum.com/t/restore-default-services-in-windows-11.3109

After you import the reg file, start the service, but however, you are not done: some of the update downloads are broken

To fix this, follow the directions listed here: https://answers.microsoft.com/en-us/windows/forum/all/windows-10-update-error-code-0x8007041d/1236b92b-5680-46e3-87f7-5d86c9305b96

If you don't want to restart the computer, simply manually start the services that you previous stopped using ``net start <service name>``

Finally, install updates as you normally would

``Simple TCP/IP Services is stopped, disabled, or removed``

Open an elevated command prompt and run ``net stop simptcp && sc config simptcp start=disabled``

``Notepad++ has been updated``

Open ``Notepad++`` and go to ? > Update Notepad++

``Print Server role has been removed``

Open ``Server Manager`` and click Manage > Remove Roles and Feature. Go to the ``Server Roles`` tab and uncheck the ``Print and Documents Services`` role and then procede with the uninstallation

``TeamViewer removed``

Using the information from the Desktop Goose vuln, once in the A:\ drive, delete ``TeamViewer.exe``

Doing a simple ``dir`` command in A:\, we find ``TeamViewer.exe``, delete it and you will get the vuln

``Steam was removed``

This checks for traces that the standard Windows uninstallation process does not remove. The easiest way to remove these traces is using a 3rd party uninstaller, such as Bulk Crap Uninstaller: https://www.bcuninstaller.com/

Uninstall Steam using this 3rd party uninstall tool, opting to remove traces

``Legacy IE11 browser removed``

Open ``appwiz.cpl`` and uninstall ``Internet Explorer Launcher``
After that, open Settings and go to ``System > Optional Features`` and uninstall ``Internet Explorer mode``

``Desktop Goose Removed``

Getting the process list using ``Get-Process`` (more specifically, ``Get-Process | ForEach-Object { Write-Output "$($_.Name) - $($_.Path)" }``), we see that GooseDesktop is running from ``A:\VM\GooseDesktop.exe``. Attempting to go to A:\, we are met with an access denined error

Open CMD as admin and then go to the A:\ drive, you will be successful

Remove the ``VM`` directory and you will get the vuln

``Removed malicious WinDivert driver``

I only got this vuln because I have a driver baseline function in my script (not sure how someone is supposed to get this without a baseline)

Delete ``WinDivert64.sys`` from ``C:\Windows\System32\drivers``

``Removed unauthorized .mp3 files from sikari's web file share``

According to the ReadMe, media files are not allowed, so this includes the web media files

You can either login to the web dashboard and delete them or go to where they are stored (``C:\inetpub\wwwroot\pydio\data\personal\sikari\SDAT``) and delete them

Either way, you get the vuln

``DNT requestes enabled in Microsoft Edge``

Open Edge and go to ``Settings > Privacy, search, and services`` and check ``Send 'Do Not Track' requests``

``Microsoft Defender SmartScreen with PUA blocking is enabled in Microsoft Edge system-wide``

When attempting to configure these settings, we see that they are "managed by our organization"

This means that the setting is configured either through registry or group policy

Checking group policy reveals that this is not configured here, so registry it is!

Going a group policy website (I use https://admx.help), you can look up the registry keys for policies (if a policy is configured, but not through gpedit, it won't show up there)

The policies we need are ``Configure Microsoft Defender SmartScreen (HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\SmartScreenEnabled)`` and ``Configure Microsoft Defender SmartScreen to block potentially unwanted apps (HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge\SmartScreenPuaEnabled)``

Set both of these reg values to 1 and you get the vuln

``RDP: Drive redirection disabled``

Unlike the Edge settings, this is configured through group policy

TIP: To see all configured settings, go to ``All Settings`` in either ``Computer Configuration`` or ``User Configuration`` and click on State

This setting is configured under ``Computer Configuration``, so go to ``Computer Configuration > Administrative Templates > All Settings``, click on State, and set ``Do not allow drive redirection`` to ``Enabled``

After that, run ``gpupdate /force``

``RDP: Client security level set to High``

Open ``gpedit.msc`` and go to ``Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security`` and set ``Set client connection encryption level`` to ``High Level``

``pGina: Simple Demonstration Authentication plugin disabled``

Open ``pGina.fork`` and go to ``Plugin Selection`` and uncheck ``Simple Demonstration``

``pGina: Only Administrators are permitted to login``

Open ``pGina.fork`` and go to ``Plugin Selection``

Double click ``LDAP``, go to the ``Authorization`` tab

Change the default behavior to ``Deny``

Set ``Path`` to ``cn=Administrators,ou=groups,dc=nerv,dc=net`` and set ``Filter`` to ``(&(member=uid=%u,ou=users,dc=nerv,dc=net))`` (leave other options as default)

Add the rule and save

``pGina: Automatically deny login if LDAP authentication returns an error``

Open ``pGina.fork`` and go to ``Plugin Selection``

Double click ``LDAP``, go to the ``Authorization`` tab and uncheck ``Allow when server is unreachable`` and check ``Deny when LDAP authentication fails``

``pGina: Change Password provider no longer sends password updates in plain text``

Open ``pGina.fork`` and go to ``Plugin Selection``

Double click ``LDAP``, go to the ``Change Password`` tab and change ``Plain Text`` to ``SSHA-512`` (doesn't have to be this, but make it consistent based on another vuln)

``pGina: Empty passwords no longer accepted on LDAP authentication fallback``

Open ``pGina.fork`` and go to ``Plugin Selection``

Double click ``LDAP``, go to the ``Authentication`` tab and uncheck ``Allow Empty Passwords``

``ApacheDS: Anonymous bind disabled``

Open ``Apache Directory Studio`` then right-click ``NERV`` then click ``Open Configuration``

Uncheck the ``Allow Anonymous Access`` option

``ApacheDS: LDAPS is enabled and used by pGina (README VULN)``

We must make the certificate file that LDAPS will use, to do this, use ``New-SelfSignedCertificate`` and ``Export-Certificate``

```
$certname = "nerv.net"
$cert = New-SelfSignedCertificate -Subject "CN=$certname" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256
Export-Certificate -Cert $cert -FilePath "C:\$certname.cer"
```
Open ``Apache Directory Studio`` then right-click ``NERV`` then click ``Open Configuration``

Go to ``LDAP/LDAPS Servers`` and check ``Enable LDAPS Server``. Expand ``SSL/Start TLS Keystore`` and type in ``C:\nerv.net.cer``. Press CTRL + S to save this configuration

Open ``pGina.fork`` and go to ``Plugin Selection`` and double tap ``LDAP``. Change the LDAP port to ``10636`` and check ``Use SSL`` and ``Validate Server Certificate``, typing ``C:\nerv.net.cer`` in the ``Certificate`` textbox

``ApacheDS: Kerberos is enabled and used by pGina (README VULN)``

Open ``Apache Directory Studio`` then right-click ``NERV`` then click ``Open Configuration``

Go to ``Kerberos Server`` and check ``Enable Kerberos Server``. Press CTRL + S to save this configuration

Open ``pGina.fork`` and go to ``Plugin Selection``

Check ``KRB5 Authentication Plugin`` and double click it, typing ``nerv.net`` into the textbox

Go to ``Plugin Order > Authnetication`` and click KRB5 Authentication Plugin. Then click the up arrows until it is at the top of the list

``IIS: Pydio maximum upload size increased to 4.2 GB (README VULN)``

Open Pydio's config file located at ``C:\inetpub\wwwroot\pydio\web.config``

To edit this file, we need administrative permissions in the text editor we want to change this file in. The easiest way to do this is to open CMD as administrator and run the following command: ``notepad "C:\inetpub\wwwroot\pydio\web.config"``

In this file, set ``maxAllowedContentLength`` to ``4294967295``

Reference: https://stackoverflow.com/questions/4022434/how-to-set-the-maxallowedcontentlength-to-500mb-while-running-on-iis7

``IIS: Pydio no longer treats yikari as an admin by default``

It's always a good thing to look at configuration files

In the pydio boot configuration file, ``C:\inetpub\wwwroot\pydio\data\plugins\boot.conf``, there is a line defining an admin user: ``"AJXP_ADMIN_LOGIN":"yikari",``

Remove this line and you will get the vuln

``IIS: HTTPS has been enabled for files.nerv.net (README VULN)``

Open ``IIS Manager`` and go to ``TOKYO-3 ... > Sites > Right Click files.nerv.net > Edit Bindings``

Create a new binding, setting the type to https, host name to ``files.nerv.net``, and supplying the given certificate in the dropdown

All other settings remain the same

``IIS: HSTS has been enabled for files.nerv.net``

Open ``IIS Manager`` and go to ``TOKYO-3 ... > Sites > Right Click files.nerv.net > Manage Website > Advanced Settings``

Expand the ``HSTS`` settings and set ``Enabled`` and ``IncludeSubDomains`` to ``True``

``IIS: HTTP Logging Enabled``

Open ``IIS Manager`` and go to ``TOKYO-3 ... > Sites > files.nerv.net`` and double click ``Logging``

Enable the module, no additional settings need to be configured

``DNS: DNSSEC enabled for nerv.net.zone``

Open ``DNS`` and go to ``TOKYO-3 > Forward Lookup Zones > Right Click nerv.net > DNSSEC > Sign the Zone``

Go through the DNS signing wizard; default signing settings are fine

``DNS: Dynamic record updates disabled``

Open ``DNS`` and go to ``TOKYO-3 > Forward Lookup Zones > Right Click nerv.net > Properties``

Set ``Dynamic updates`` to ``None``

``MySQL Server: Strict mode enabled``

This check requires us to change the MySQL configuration file because changing the database value itself doesn't give us the points

To find the configuration file, ``my.ini``, look in the shortcut path of the MySQL Command Line Client, which is the following: ``"C:\Program Files\MySQL\MySQL Server 8.4\bin\mysql.exe" "--defaults-file=C:\ProgramData\MySQL\MySQL Server 8.4\my.ini" "-uroot" "-p"``

Our configuration file is located at ``C:\ProgramData\MySQL\MySQL Server 8.4\my.ini``

To edit this file, we need administrative permissions in the text editor we want to change this file in. The easiest way to do this is to open CMD as administrator and run the following command: ``notepad "C:\ProgramData\MySQL\MySQL Server 8.4\my.ini"``

Find the line that says ``[mysqld]``, and under it, put in the following configuration option: ``sql_mode="STRICT_TRANS_TABLES"``

``MySQL Server: Root password changed``

Open the MySQL Command Line Client and login using the root password provided by the README (``impact2``)

Run the following command: ``FLUSH PRIVILEGES; ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_password';`` where ``new_password`` can be any string you want