What if we could stop time itself?
Well, that's what we can kind of do.
And it's one of the techniques instead of going through and deleting the
event logs or trying to modify them in such a way to where we are covering our
tracks or even closing out our pin test.
We can go through and mess with some of the timestamps on things by using a
practice called time stop.
And this is not working with the blue team on this one.
This is really just us trying to make sure that we are covering our tracks and
not getting caught during the course of a pen test.
So let's hop on over to our lab for a second.
I have a meterpreter session opened up with our DC using dummy DC EXE.
And I was just doing a little browsing around inside of our
actual directory listing here.
Now, the reason this is a little important is because inside of the
meterpreter command console, you can actually use a command called time
stop codes below, by the way, and you can see that there's no specific path
identified. Well, you can do this in a couple of different ways.
First, you can need to know where you're actually at on the system itself.
And I'm in the DC share folder.
So let's do it again real quick.
We can see that there are two files in this folder.
And one is dummy EXE and one is dummy DC EXE.
What I want to do is make dummy DC have the same timestamp as dummy.
If I zoom in for you here real quick, you can see that dummy EXE was made in
November on November 29th, where dummy DC was made on December 7th.
Well, I want to have them for this scenario in the exact same date and
timestamp timeframe here, because it looks like they were both brought in at
the same time where dummy EXE may be a legitimate file, dummy DC obviously not.
So why does this matter?
Well, it's because you want to craft certain things to look like they came
in at certain times.
Some security administrators and especially defense personnel may look at a file's
timestamp to say, well, it came in before X day and everything that came in before
X day was already vetted or was already verified by somebody else as being clear.
Or that's when we did our last restore date and everything before that restore
date was in that predetermined file of our list of files that needed to be
restored.
A couple of different ways you can look at it.
In the grand scheme of things, it's something it's a little niche, but it's
a niche thing that we can do to make things look like it's supposed to be
where it's supposed to be.
Right?
So we just say timestamp dummy DC EXE, and we're going to force it to take the
timestamp from dummy EXE using the dash F codes below.
Now, when we run this, you can see that we have a couple of things here.
Mace attributes for dummy EXE settings, specific Mace attributes on dummy DC.
Well, that's all well and good, but what actually happened?
Well, if we run it LS now, and I'll show you this, I'll have a snippet
of this below the video as well.
You can zoom in for you.
You can see that dummy DC has had its timestamp changed to match that of
dummy, dummy DC to dummy, yes.
And we can even go inside the DC itself in the dummy DC folder and see that that
is in fact, what actually happened right there, both of them, November 28th, 1129
PM.
So is this an evasion tactic?
Absolutely.
Is it a niche one?
Yep.
But it also evades going in the event viewer.
So you don't really see anything other than a file has been, uh,
modified in the folder itself.
But we don't have anything from windows saying, Oh, there's alert because if
there had been, you would have seen it pop up here in the DC saying that
somebody's messing with the file.
This is happening because we're inside of that meter per intercession and
we're being able to manipulate the files.
Now you can do this in any folder as well, too.
You could very well go on the entire file system and change everything
to a specific date and timestamp.
I don't know why you would want to do that.
But you know, there you go.
And you can find some of the oldest files that are like windows default
1999 and have everything go through there to try to make it look like a system file.
Now it just popped in my head, speaking of system file in 1999, if you bury
something in a system 32 folder and you give it that 1999 date, a security
technician may just overlook it because you know, Microsoft's known to do that.
It looks like a Microsoft method.
Something to consider.