0x55aa

EC2 IAM role STS credentials compromise via IMDS

Sat, 22 Feb 2025 00:00:00 +0000

Background

AWS Identity and Access Management (IAM) roles are a key security feature in AWS that allow services, applications, or users to assume temporary permissions to interact with AWS resources. IAM roles are commonly used to grant access without hardcoding credentials.

AWS Elastic Compute Cloud (EC2) is a web service that let’s AWS customers to create and manage virtual machines, also called instances.

To leverage a IAM role within an EC2 instance, the role needs to be first attached to the instance. When the instance is launched, it will assume that role and obtain temporary security credentials without the necessity of leveraging static credentials. These credentials are generated by AWS STS (security token service), and going forward I will be refering to these as “STS credentials.”

Revisiting ShellBags in Windows 11

Sat, 15 Feb 2025 00:00:00 +0000

Background

ShellBags were introduced in Microsoft Windows to provide a consistent and personalized interface to users when interacting with directories through the Windows Explorer application. This includes, but is not limited to:

Icon size, position, view mode (e.g., list, details, tiles).
Window size, and location.
Recording information for local drives, network shares, and removable devices.

ShellBags are a well-known and well-documented registry-based forensic artifact that is highly valuable in forensic analysis, as they allow investigators to determine which directories a user accessed via Windows Explorer and when. Another key advantage of ShellBags is that they retain data for accessed directories even after those directories have been deleted from the file system.

LevelDB WAL log - extracting ChatGPT desktop conversations

Fri, 31 Jan 2025 00:00:00 +0000

Background

ChatGPT desktop app uses LevelDB’s write-ahead logging (WAL) mechanism to temporarily store the cache of conversation history.

The WAL log is written to disk after ChatGPT application (i.e. associated process tree) is terminated, which may happen either at system shutdown/reboot or if the user exits the application. The exact location of the binary: “%UserProfile%\AppData\Local\Packages\OpenAI.ChatGPT-Desktop_2p2nqsd0c76g0\LocalCache\Roaming\ChatGPT\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb######.log” (“000003.log” in my case).

The log will stay on disk until the user loggs off from the ChatGPT account within the app. When that happens, the contents of “https_chatgpt.com_0.indexeddb.leveldb\” will be erased.

Diving into Master Boot Record

Sun, 26 Jan 2025 00:00:00 +0000

Partitioning scheme is a data structure that is set on a storage device during disk initialization. The scheme describes how a storage device is divided into logical sections, i.e. disk partitions. Partitioning scheme is required to be present on storage device in order for operating system to boot from that device.

Two primary partitioning schemes that are most commonly used by operating systems are Master Boot Record (MBR) and GUID Partition Table (GPT). MBR is a legacy scheme that supports up to 4 partitions per disk with a storage limit of 8TB. GPT is a modern scheme that supports up to 128 partitions, with maximum theoretical storage limitation of 9.4 ZB (9.4 billion TB).

Behavioral analysis of user file operations with SRUM

Thu, 16 Jan 2025 00:00:00 +0000

Background

SRUM stands for System Resource Usage Monitor, a technology introduced in Windows 8 and Windows Server 2019 to track the utilization of various system resources such as CPU usage, network activity, and battery consumption. SRUM data is stored in an ESE database located at “%SYSTEMROOT%\System32\sru\SRUDB.dat”.

Figure 1 - “%SYSTEMROOT%\System32\sru\SRUDB.dat” location and signature

This post was inspired by the Sunday Funday challenge from my friend and mentor David Cowen. In this post, I will be performing a behavioral analysis of Windows operating system activity recorded in SRUM for the following use cases:

Windows updates and anti-forensics (USB devices)

Thu, 09 Sep 2021 00:00:00 +0000

Background

In this post I will be talking about feature pack updates for Windows 10 operating system and how they affect computer forensic examinations. First part covers USB forensic artifacts affected by the update.

Feature updates for Windows 10 are released by Microsoft twice a year and can be considered major updates since they include new functionality, enhancements, visualization updates and many more. Each feature update for Windows 10 has a unique version number that corresponds with month and year of planned release (for example, version 1909 had a planned release date September 2019).

About

Mon, 01 Jan 0001 00:00:00 +0000

I am a digital forensics professional and malware reverse engineer. I have been in the field since 2011.

This blog is a notebook of lab work and findings from that practice: forensic artifacts, reverse engineering, detection, and the occasional cloud investigation. Tools I build for research and tests live in dfir-tools.

I am also on LinkedIn.

Opinions and views here are my own.