> For the complete documentation index, see [llms.txt](https://davin-hong3.gitbook.io/d/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davin-hong3.gitbook.io/d/walkthroughs/capture-the-flags-ctf/tryhackme-advent-of-cyber/day-8-santas-special-bag-of-toys-john-hammond-special.md).

# Day 8 : Santa's Special Bag of Toys (John Hammond Special)

Working with Powershell Transcription Logs (Windows Forensics)

## Introduction to Windows Forensics 

###  - Powershell Transcription Logs

**PowerShell Transcription Logs** capture the input and output of Windows PowerShell commands, allowing an analyst to review what happened when. Typically, PowerShell Transcription can be enabled by Group Policy, but another method to turn on this logging is by configuring the Windows Registry.

![](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FTBRmNBjqNKzkwOe6D4co%2Fimage.png?alt=media\&token=9eed1260-b680-4f41-9535-c9db26cd5397)

these will turn on PowerShell Transcription Logging for a local host if entered in an Administrator command prompt:

```

reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableTranscripting /t REG_DWORD /d 0x1 /f
reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v OutputDirectory /t REG_SZ /d C:/ /f
reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription /v EnableInvocationHeader /t REG_DWORD /d 0x1 /f               

```

The Windows Registry is a large database of operating system settings and configurations. It is organized by "hives", with each hive containing "keys" and their corresponding "values." 

PowerShell Transcription Logging can be enabled in this way "per-user" via the `HKEY_CURRENT_USER` registry hive, or across the entire host via the `HKEY_LOCAL_MACHINE` registry hive.

The actor uses a [Living Off The Land ](https://lolbas-project.github.io/lolbas/Binaries/Certutil/)binary (LOLbin) to encode this file - windows binary used for handling certificates, and then verifies it succeeded by viewing the output file.

* the UsrClass.dat file was encoded with Base64, which we decoded.
* now open this file in the GUI Windows registry explorer > load offline hive > download.dat file from decoded

![](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2Fu8L6Uj8pNcnvvUnwYY5a%2Fimage.png?alt=media\&token=588e40cd-795b-44c2-8438-7df518df7b84)

###  - UsrClass.dat file

{% embed url="<https://shehackske.medium.com/windows-shellbags-part-1-9aae3cfaf17>" %}

* contains shellbags, or artifacts contained within Windows registry that **store user preferences while viewing folders** within the **Windows Explorer GUI**
* analyze this to see what user activity was performed on the laptop before it was compromised

To extract the Shellbags information within this `UsrClass.dat` file, we will use the "[Shellbags Explorer](https://www.sans.org/tools/shellbags-explorer/)" graphical utility put together by [Eric Zimmerman](https://ericzimmerman.github.io/#!index.md).

![This is the registry explorer.exe](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2Ffgeww3Y6jNxNIUHuPTvh%2Fimage.png?alt=media\&token=67660c47-b827-49e1-acf2-5290370ca3b5)

Unfortunately, from just Shellbags alone, we only have insight into folder names (sometimes files, if we are lucky) and column data within Windows Explorer, but not files

### &#x20;- Finding commits on Github

Go to code tab > look for upper right corner below the clone button > notice the 5 commits

![](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2F91hvyCSTtCldLKKkEeS9%2Fimage.png?alt=media\&token=f1485592-aefe-4d61-9cd0-9560ed8a5f44)

![](https://2068334946-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fow1iM27u7disHeJiSlBC%2Fuploads%2FzenHUzddKGbexiwm1985%2Fimage.png?alt=media\&token=922b438d-6446-4560-ae0c-2a1859a2895c)

Total of 228 files in the extracted zip.