start	end	text
0	5320	Cloud File Storage Gems. I'm Michael Wiley, Director of Cybersecurity Services at Richie
5320	9560	May Technology Solutions. Prior to joining the firm, I owned a boutique cybersecurity
9560	14720	firm in Los Angeles, California, where I performed penetration tests, red team engagements, phishing
14720	19540	campaigns, social engineering, and so on. These days, I do a bit more around compliance,
19540	24560	digital forensics, incident response, and security architecture. I've got plenty of
24560	30420	certifications I've collected over the past few years, and I enjoy what I do tremendously.
30860	35180	I encourage you to connect on LinkedIn and follow me on Twitter. Those are probably the
35180	38060	best two ways to get a hold of me after this talk.
38600	44860	About Richie May. Well, the firm was founded 30, going on 35 years ago, as a tax and audit
44860	49500	firm. A while ago, transitioned into business advisory, and during that process, the firm
49500	55200	realized that they wanted to advise their clients on technology and cybersecurity. They
55200	60500	brought in my boss, who's a former CISO. They acquired my firm and a couple of others to
60500	65900	build the team that I work with today. I focus on the media and entertainment industry, while
65900	70260	the firm's other niche is the financial sector. So I get to work with a lot of studios and
70260	72900	vendors that make the movies you love happen.
73920	76820	Some of the learning objectives we're going to go over in this talk. We're going to learn
76820	81960	what file artifacts are available in cloud file storage applications. We'll see what kind
81960	87060	of cloud file storage user activities we can enumerate during a penetration test. We'll
87060	91420	be introduced to application logs and what's available there and examine the difference
91420	94240	between cloud file storage providers.
94720	100120	So first, I want to give some credit where credit is due. Some of this I have come up
100120	105080	with from my own testing, from forensic cases that I've looked at, as well as a lot of
105080	109660	reading from other people's work. So just name a few of those who have created content
109660	114700	and things that I have read, come across, looked at their research labs, etc. These
114700	116460	people are due credit.
118100	122640	So why are we talking about cloud file storage solutions? Well, back in the day, obviously,
122640	127080	we had file servers on premise and that's the most of the time the crown jewel is what
127080	131200	we're looking at during a test. It could be obviously a database or something else, but
131200	135960	a lot of times you're going to find those juicy gems on a file server. These days,
135960	140260	we seem to be doing at Richie Mae, a lot of migrations, helping customers move away from
140260	144780	the traditional model of non-premise file server and trying to utilize some of these
144780	150960	cloud file storage solutions like Box, Google Drive, OneDrive, Dropbox, Sharefile, etc.
151400	155220	And so some of the perceived benefits that organizations get of this and why they're
155220	159560	making that transition is that, one, there's protection against disasters for the most
159560	163980	part. So whether it's the pandemic, you can go home and obviously access Google Drive.
163980	167420	Whereas if you had a file server on premise, you'd obviously need VPN access or some other
167420	172640	way to get to those files. There's a decrease in maintenance. So IT departments don't have
172640	176860	to sit there and patch file servers. They don't have to work on ACLs. They don't have
176860	182960	to troubleshoot DFS issues, sync problems, all those kinds of things. There's also perceived
183100	187080	a high availability aspect of it. Sure, cloud can go down from time to time, but for the
187080	191780	most part, these cloud file storage solutions have an uptime higher than file servers that
191780	197980	are sitting on premise. They're also scalable. So Google will happily sell you an extra terabyte
197980	202760	or two terabytes of space with just an increase in your price of your monthly subscription.
202760	205960	Whereas if you have a traditional file server on premise and you're running out of space,
205960	211560	you may have to add hard drives to a RAID cluster or add systems to a cluster or whatever
211560	216860	mechanism you're using to get more space. Also, there's some ease of management. You
216860	221880	don't have to get into a Windows operating system and adjust file permissions or folder
221880	226100	permissions or share permissions. You can just basically make a couple of changes from
226340	230780	a web interface. There are a couple uses that we're going to take a look at. And so if you
230780	235440	do end up compromising a system and you suspect or see that there is a cloud file storage
235440	241020	solution there, you may run into one of two scenarios. One, it may be business authorized.
241020	244900	So there may be a cloud file storage solution that the business has paid for, implemented
244900	250100	and deployed. And there may be some differences then if you find the application installed,
250100	254080	but it's a personal account that they have logged in with. So in many cases, I've gone
254080	259460	in from both perspectives, offensive or defensive, and we have seen applications installed that
259460	263540	were not sanctioned by the organization, but it was either a employee who thought they
263540	267620	were doing good or they wanted to just access their files and they downloaded Dropbox or
267620	273240	Box or some application and started syncing files. So what are those different solutions
273240	277300	out there? Well, we're going to talk about Microsoft OneDrive, Google Drive, Dropbox,
277300	284770	Box and Citrix ShareFile. And the data here was pulled up from, I believe it was SolarWinds
285600	292620	did a study on this, and they outlined small, midsize or large businesses and which solution
292620	297900	they're using. So you can obviously see Microsoft OneDrive, it's baked into Windows 8 and above,
297900	301140	so a lot of people are using it. But when you start getting into some of the other solutions
301140	305820	like Box, you can obviously see they're focusing on larger businesses in that market share.
307100	312220	So as I mentioned, there's two different scenarios that we might run across. One is where the
312220	317700	remote system that we've compromised, they're running a cloud file storage solution that
317700	322900	is sanctioned by the corporate environment. And in that case, there may be CASB or off-site
322900	327300	logs or other security controls where they're monitoring or controlling what's going on.
327300	331760	But we may run across the other scenario on the right-hand side there, where there's the
331760	336640	sanctioned cloud applications that may have CASB that is not in line or other security
336640	342600	controls, but they're also using a personal version of Google Drive or OneDrive or something
342600	348500	like that. And that may bypass some of those shadow IT or security controls that the defenders
348500	354420	put in place. So what are some of these gems that we may uncover as we see that there is
354680	359600	a cloud file storage application on a system we've compromised and what can we get from
359600	364020	that? Well, if you think of cloud file storage solutions as replacements of file servers,
364020	368220	we may see customer data, financials, employee data, HR. You wouldn't believe some of the
368220	373940	things that I have seen people store in cloud file storage solutions and with lax security
373940	378740	around them. Some of the things that these cloud file storage applications may leave
378740	384260	behind that are of interest to us, cached files. So whether those files are stored on
384260	389740	the cloud or local or local, but then they were deleted, we may be able to recover these
389740	393940	cached files and actually see or recreate some of those files. We may see the local
393940	398340	files, we'll get a database with all the files that are stored locally, but more importantly
398340	402800	in the cloud as well. So we can see what is out there that maybe the user doesn't have
402800	407680	stored locally. We'll see file usage and their behavior around those files, what files they're
407680	412880	accessing most frequently. We'll be able to find traces of possibly deleted files as well.
413460	419120	So as I mentioned, there is either a business or enterprise account and that may be company
419120	424620	issued. There may be additional logging and security controls that the security team or
424620	431240	IT team has, such as CASB. There's also more logging generally in the cloud if it is a
431240	435480	business or enterprise account. Whereas if you stumble upon a free account that someone
435480	439580	has on a system you've compromised, it may not be company issued, so there may be no
439580	447240	knowledge of it. There may be no access to the actual account itself. That may be not
447240	452740	synced with Active Directory or LDAP or single sign-on, so we may not be able to gain access
452740	457520	to that right away. There's no central visibility by the defenders though, so they're not going
457520	462100	to see the things we're poking around or accessing. And then we're also going to be able to find
462100	466560	some local logs there. And so the difference between those business enterprise accounts
466560	470580	and the personal free accounts is that there's a lot more storage with the business accounts
470580	474480	that are built in. Obviously it depends on what you're paying for, but you might have
474480	479160	G Suite, the equivalent to a personal account would be Google Drive. It's not exactly called
479160	484040	that, we'll get into that in a second, but 15 gigs of free space there. So even if it's
484040	488460	not a sanctioned account and someone just installs the Google Drive app, you can have
488460	494800	up to 15 gigs of gems you can find there. With Office 365, it comes with OneDrive subscription
494800	500160	there. OneDrive Basics, the free alternative with only five gigs. Box, business or enterprise,
500160	503640	you can have different levels of storage, but you can also get two gigs of free storage
503640	510800	with a basic account. Dropbox Pro, the equivalent for a free account is Box Starter. This may
510800	515800	have changed since I built this slide a while back. It used to be able to get about a hundred
515800	521240	gigs of space. I think they have limited that. So let's talk about Microsoft OneDrive first.
521240	526700	Let's get into it. That's the one that's baked into Windows 8 and above. It must be enabled.
526700	531320	So it's installed, but you need to enable it via authentication. So once you sign in,
531320	536420	it does a couple of things, add some registry keys, as well as it creates the OneDrive directory
536420	541700	sitting in AppData Local Microsoft. So that folder will not be there, that directory will
541700	547120	not be there until you authenticate with the OneDrive application. Now, if you have a personal
547120	552060	account, you're going to see within AppData Local Microsoft OneDrive logs, you're going
552060	558700	to see a personal folder directory. If they have a business version of OneDrive, you're
558700	563200	going to see business one. Now, I believe the reason they do business one is because
563200	567800	that you can install or sign into more than one account. And so you might see business
567800	571920	one, business two, business three, but the primary account should be business one. With
571920	582020	Office 365, the defenders do have a unified logging, and it is by default enabled for
582020	589060	my record collection up to 90 days. Now, from the instance I've been working more recently,
589060	593920	and what we see with something like the Mandiant dwell times and Verizon DBI reports and whatnot,
593920	598660	is that our dwell time is getting better, but it's still pretty long. And so that 90
598660	602720	days of retention may not be enough for defenders to see what's going on, especially in the
602720	609880	red team engagement. But even with a personal account, though, there's no central logging
609880	615960	from what I can see on the web interface of OneDrive. So all those logs are stored locally.
615960	620460	And obviously, maybe you can subpoena Microsoft or get whatever logs they have, but at least
620460	625340	from the availability for IT and security professionals who are trying to investigate
625340	630640	what might have happened or who accessed this, it's a bit limited. And so on the left-hand side
630640	635600	there, we can see in AppData, local Microsoft OneDrive logs, we've got a couple of different
635600	639520	logs that are stored locally on the endpoint. And on the right-hand side, we see the business
639520	644960	unified logs. So a couple of interesting directories and folders that I've outlined here
644960	649940	for you is that some of the things we can see if we've gained access to a system that is
649940	655500	syncing with OneDrive is that the user profile slash OneDrive is the default data store
655500	659900	of where things are going to go. If it is a Office 365 or business account, it'll be
659900	663920	OneDrive dash and the company name. So we'll be able to see what company they work for as well
663920	671500	and make sure it's obviously in scope. We'll then see the root directory within the logs
672560	677160	directory, which is kind of strange. We'll also be able to see some metadata for local
677160	681800	and cloud files. So even if the file is not synced locally, we may be able to see it
681800	685720	in the sync diagnostics log. There is a big maybe there I'll talk about in a second.
686180	692000	And then we're going to have a DAT and INI file. And those two files, it's going to start...
692000	696500	the actual file name is going to be the customer ID or the CID of the user.
697020	701540	So you'll see with the CID.DAT, you'll see a list of local and cloud file names.
701540	704620	So even things that are not synced locally, you'll be able to see those.
704620	709600	And the CID.INI file, we'll be able to see the file store locations, some sync time,
709600	714720	usage details, and some other metadata there. We're going to see another file that starts
714720	719360	with the CID of the user, followed by a dash and ProfileServiceResponse.txt.
719380	725360	That will give us the name, email, CID, email, phone, and title, etc. of the user.
725460	730040	That only is the case, though, for personal accounts. When I tried it with Office 365
730040	735420	or paid versions, I did not get this file. I find that interesting because most people
735420	740260	aren't going to sign in or add their title and phone number and address and stuff like that.
740280	744380	I'll show you a more detailed version in a second here. And most of the time,
744380	746520	you're going to see that as null, but at least you can see the email address
746520	750360	that they have associated with OneDrive. And then you're going to also find
752580	755380	a obfuscationStringMap.txt file, and that's going to be important to map back
755380	758940	to obfuscated file names. And I'll show you how that works in a second, too.
759660	765900	So within the SyncDiagnostics.log file, I have observed two different types of files.
765900	770060	And so you may get one of two versions. And I think I've narrowed it down,
770060	774320	but I haven't had enough test cases to verify this. I'm going to call one
774320	777680	the Summary SyncDiagnostics file, and the other one I'm going to call
777680	781840	the Details SyncDiagnostics file. And now, what I've noticed is that
781840	788740	if I install Office 365 OneDrive and I look at the SyncDiagnostics file,
788740	794080	I keep getting the summary version. But if I try a personal version,
794080	798420	and I've tried multiple labs and syncing it, what I've generally seen is that
798420	802740	the first machine you activate OneDrive on will have the Detailed SyncDiagnostics
803480	806940	log file, and then every subsequent system you sync with will have
806940	810080	the summary version. So that's my theory to this point.
810080	814400	Again, I need more testing for that. And I'll show you what those look like.
814400	817980	So on the left-hand side here, we've got the Detailed SyncDiagnostics log,
817980	821500	and you can see that there's, in the bottom part of that, there's files
821500	824920	and folders that are presumably added or synced. And you can see some type
824920	830240	of mount point with possibly a GUID, and then there is a backslash,
830240	837480	and then a three-word string. So far, jump, sue, sue, bat, egg, and so on.
837480	842400	So those are obfuscated file names, and I'll show you how to decode those
842400	845060	in a second. On the right-hand side, you have the summary version
845060	850680	of the SyncDiagnostics file. It's not as verbose. You have statistical data,
850680	856380	sync progress, you've got last sync time, bytes downloaded, bytes uploaded,
856380	860500	that kind of stuff. And so here's, again, a little bit more of the summary version
860500	864460	where you could see the number of changed folders, deleted folders.
864460	869140	It's really high-level information there. Now, if you happen to get that detailed
869140	873140	version of the SyncDiagnostics log, what you can go ahead and do is,
873140	876260	obviously, we don't know what C, bat, egg is, but you can go ahead and open up
876260	880300	that obfuscation string map. And again, all of these files that I'm talking about,
880300	885780	with the exception of Dropbox, they are all clear text. So these files,
885780	889280	it's not something special I've had to open up. The obfuscation string map
889280	893960	is just sitting in a directory that anyone can access. And when we look
893960	899140	at the SyncDiagnostics, we're going to have to take that three-word string there,
899140	903520	like C, bat, egg, and we're going to have to go map that to our obfuscation
903520	907440	string map text file. And so there we can see that C, bat, egg essentially
907440	910820	equals the desktop. So it looks like a folder was added to Sync,
910820	914200	and that folder was desktop. So it's a little bit of work,
914200	916520	but you can go ahead and map those back and forth there.
917720	921580	Just a little bit more on that obfuscation string map text file.
921640	924620	I think that last slide showed it in great detail.
926000	929800	Okay, and then so the CID of the user.dat, if we open that up,
929800	933480	that's going to show us the list of file names both locally and in the cloud.
933480	936500	So even if it's not synced to the local file system, we can see what that user
936500	940280	has access to in the cloud. And it is a little bit challenging to read this
940280	944000	dat file. It's not formatted in the greatest way. So you can open it up
944000	948580	in a hex editor, and you can even see searching for strings isn't the best.
948940	953260	However, if you use something like strings or vstrings, that will let you
953260	956140	go ahead and pull that out, and you can then obviously pipe that to find
956140	959000	string or grep, and you can look for whatever you're interested in,
959000	960740	or just manually parse through that.
962100	965580	Okay, and in the business version, though, of the CID.dat file,
965580	968020	it's a little bit different. So obviously this last one here was the personal
968020	971360	version, and we were able to easily see those directory names.
971380	975940	With the business version, though, it's a little less apparent.
976040	980080	And so from what I've seen here, if you open up that CID.dat file,
980080	983440	the files, it either is a hash or some type of GWT there.
983440	986440	And so when I thought maybe it was obfuscated, and if I just open up
986440	991240	that obfuscation string map text file and correlate that or cross-reference it,
991240	997000	I was able to find some hits, but it was more so on the deobfuscation side,
997000	1000740	and I wasn't really able to go ahead and figure out what those file names were.
1000740	1005480	So it may also be an MD5 hash or some type of GWT.
1005480	1009040	I haven't really been able to figure out how on the business version
1009540	1011340	to see all the file names.
1012620	1016260	Okay, so with Microsoft OneDrive, the CID.ini file, as I mentioned,
1016260	1020560	it's going to be a couple of different variables that you're going to see in there
1020560	1022360	depending if it's personal or business.
1022360	1027000	But essentially what you are going to be able to see is the CID of the user
1027000	1031680	and the location, the URL of OneDrive for that user.
1031680	1035700	You'll be able to see the last time they synced in Unix Epoch time.
1035700	1039360	You'll be able to see the sync activity, bytes transferred,
1039360	1042800	so you can see how active they are using OneDrive.
1044300	1049940	The CID-ProfileServiceResponse file, that one gives us a plethora of information.
1049940	1054800	However, I have not seen this file get created for business or Office 365 accounts.
1054800	1057620	It only seems like it's for personal accounts.
1057740	1059400	If you got the personal account, though, as I mentioned,
1059400	1062880	you're going to see the display name, first name, last name, CID, email address,
1062880	1065320	phone number, title, address, and so much more.
1065500	1070820	However, a lot of those things like job title, when I created my sock bucket account here
1070820	1076180	for OneDrive, it did not ask me for a title or address or phone number.
1076180	1080000	So maybe a user would go into their profile and update that stuff.
1080000	1085700	But by default, that's not a required field to create a OneDrive account or a live account.
1085700	1088800	And so I did not need to do that. Therefore, I didn't fill it out.
1088800	1091080	And that's why you're going to see a lot of null fields there.
1092560	1096760	So when I did a red shot and I took a look at what registry keys are being created here by OneDrive,
1096760	1101460	we can see that with the business version, we have quite a few registry keys.
1101460	1104640	With personal, it's less. And then I did a difference on those.
1104800	1109100	And so the difference is that... or the common is all the way on the right-hand side.
1109100	1113520	And then the registry keys that the personal account had that the business did not have
1113520	1118180	is going to be the IsUpgradeAvailable and VaultShortcutPath.
1118400	1123360	Otherwise, the keys that the personal account had were similar to the business account.
1124480	1128500	So the other cool thing you're going to see if you look at the registry hive,
1128500	1133620	and you can take a look within HKeyCurrentUser, Software, Sync Engines, Providers, OneDrive.
1133620	1140880	On a business account, if you look in there, you possibly are going to see some different random characters.
1140880	1145820	It may be a CID or a GUID. But essentially, when you look at that,
1145820	1150760	those are items that are shared with the user that you are enumerating.
1150800	1156660	And so what that tells me is that they have received shared files from another user within OneDrive.
1156780	1160500	If you actually do a reg query on any one of those, you're going to go ahead
1160500	1164680	and then get more details about that, such as what the actual share name is.
1164680	1168760	And so we can see there on the amount point, it is where it's located,
1168760	1173180	and it also tells us the name. So it was called something project documents.
1174440	1178380	And then we actually get the URL namespace for that as well that we can go ahead and try.
1179260	1186400	Now, one thing about this, whether it's personal or business, that I've noticed is that you will have to accept the share.
1186400	1190140	So if someone just shares it for you and you see it in OneDrive online,
1190140	1192620	it doesn't mean that you're going to see that registry key here created.
1192620	1198360	What happens is you have to click the add share. So if someone shares it with you and you click it to add it to your OneDrive,
1198360	1204280	that action of adding that folder will go ahead and then create that registry key on all endpoints that are synced.
1204280	1214720	So I created a second sock puppet account and created a file or a directory called test and added that to this user's OneDrive account.
1214720	1218620	And once I click add, that's when that was created. And with a personal account,
1218620	1222460	unlike the business account where you get more of that long string of random characters,
1222460	1225440	with the personal account, you don't even need to go any deeper.
1225440	1232900	Just as soon as you go into the OneDrive key, you're going to see there's the sub key called test and that was added there.
1232900	1239880	So rather than creating that CID or some unique ID for the share, it's going to have the actual name of the share in there.
1240280	1247480	And then if you actually go into that sub key of test, you're going to go ahead and see the CID of the user that shared it.
1247480	1251440	So you won't get their email address or username, but you will actually see the CID.
1251440	1255620	And maybe you've compromised that other user in the environment,
1255620	1259380	and you can then go ahead and just cross-reference that to see who the owner is.
1260740	1263640	So Microsoft also has this feature called Space Saver.
1264660	1268300	And so what they do with Space Saver is that they back... let me start again...
1268300	1274960	with the early days of cloud file storage, whether it was Google Drive or Box or Dropbox,
1274960	1279980	getting them all mixed up here, they were... you could selectively sync files and folders,
1279980	1283880	but it was kind of a pain if you had nested folders and you only wanted certain things synced.
1283980	1288480	I remember I had terabytes of stuff up in Box or Dropbox, one of those solutions,
1288480	1294280	and it was just challenging to figure out on all my computers which ones I wanted to sync or didn't sync.
1294280	1300240	And so a lot of these cloud file storage solutions have adopted the philosophy of caching files.
1300280	1306420	And so Microsoft, they have this new solution that allows users to view files and their names,
1306420	1310760	but they're not actually stored on the machine. Unless you open them, they're going to pull them down.
1311200	1315720	So in Dropbox, for example, they have Smart Sync. It's a similar type of feature.
1315980	1319580	If you've ever looked at OneDrive, you see those different icons on the status.
1319580	1323480	That's telling you if it's cloud only, always local, or cached locally.
1324640	1327780	So let's now talk about Google Drive.
1328500	1331640	So in Google Drive, I keep calling Google Drive just because I'm old school,
1331640	1336580	but really the personal account or personal version of Google Drive is going to be called Backup and Sync.
1336580	1339700	With Business, they have migrated that over.
1339700	1344700	So if you have G Suite, what they're going to use is a tool called Drive File Stream.
1344920	1350860	I tested mostly the personal account just because I didn't have a G Suite account,
1350860	1358020	but they are using SQL-like databases rather than text files and registry keys like OneDrive used.
1358020	1364420	So within Google Drive, if you are using the business version, the Drive File Stream,
1364420	1368740	what happens is it creates a virtual volume in FAT32, and it mounts that.
1368740	1372180	So it's almost like a mounted drive if you were a network share.
1373280	1379200	Synced Google formatted files, what's interesting about those is that if you actually open up these files,
1379200	1385440	like a Google Sheets document that was created on the web version, it's going to download that,
1385440	1390120	but you can see the size there of one kilobyte. It's super small in Windows Explorer.
1390120	1394920	And what's happening is that any Google native files, whether it's presentation, document,
1394920	1399820	if that is a Google native file type, what's downloaded is not the actual file.
1399820	1405000	What it actually does is kind of like a shell item, which has the URL, the doc ID, and the email address
1405980	1409600	associated with that file. And so a couple of cool things is just looking at that,
1409600	1414240	if you open it up in Notepad or a hex editor, you should be able to see the actual file path
1414240	1420040	to get to that Google Drive link or that document. You'll see the ID, which isn't super relevant,
1420040	1423700	but you also could see the email address associated with that, which is kind of cool.
1425040	1428540	Some of the other files and folders and databases and stuff that we'll see,
1428540	1434700	we'll be able to see in the sync-config.db, we'll see the user info, their preferences,
1434700	1438560	initial application, install information, so when they installed Google Drive.
1438560	1445360	In the cloud-graph.db database, we'll see metadata for local cloud and shared files and folders,
1445360	1452960	which is cool. sync-log.log is files added, deleted, modified, renamed within Google Drive.
1452960	1458000	The snapshot.db database has local file metadata within it.
1458000	1466200	The content-cache directory has local file caches for G Suite users only.
1466200	1469640	So we can actually see content that possibly had been deleted.
1469820	1473180	And then within the metadata-underscore-sqlite-underscore-db,
1473180	1477380	we'll see offline files, cloud, and deleted file metadata.
1478480	1480660	So we look at that sync-config database.
1480660	1484220	There's a couple of things just to look at to identify who the user is.
1484220	1488800	We can see their user email address and some of the sync time, the application version,
1488800	1490660	see if there's any vulnerabilities with that.
1490660	1495780	Sort of looks something like this if you open it up with db-browser for SQLite.
1496580	1502480	And within the cloud-graph database, we'll see things like the Google Drive document IDs,
1502480	1505600	which are unique file and folder object IDs.
1506100	1509920	We'll see file names, the original or human-readable file names.
1509920	1513340	We'll see the time when the file was added to Google Drive.
1513340	1516520	Most of the stuff we're going to take a look at with timestamps, time and date stamps,
1516520	1519420	are going to be in Unix epoch times. Just keep that in mind.
1519420	1524920	And the ECL role column, we're going to see whether or not the user you're looking at
1524920	1527260	is the owner of the file or it's a different user,
1527260	1529580	so whether someone else shared it with that user or not.
1529780	1534220	And probably the most verbose piece, and more so than any other solution we'll look at,
1534220	1537140	is the doc-type column within this database.
1537140	1541380	And so if you look at the cloud-graph entry table within this database,
1541380	1544280	that's going to go ahead and give you the doc-type column.
1544280	1547720	And there you're going to see different numeric values,
1547720	1551720	and those are going to tell you whether the object you're looking at is a folder,
1551880	1555100	a traditional file, so let's say a PDF or Microsoft Word document.
1555200	1561900	And then the numbers 2 through 13 are reserved for Google native files.
1561900	1566560	So it'll actually tell you whether or not it was a Google native presentation,
1566560	1567840	which would be a number 2.
1567840	1570960	4 would be a Google native spreadsheet, so Google Sheets.
1570960	1575940	And then 6 would tell you if it's a Google Word document, essentially,
1575940	1577640	if it's a native Google Word document.
1578000	1581840	And then the removed column, I could not get that to fire off,
1581840	1583800	so when I deleted things locally in the cloud,
1583800	1586060	I wasn't getting any modification of that column.
1586120	1588360	And then Google also gives you an MD5 hash.
1588360	1591200	Most of the other solutions will give you a SHA-1 hash,
1591200	1594840	but Google gives you the MD5 hash of that file that you're looking at,
1594840	1597000	which could be useful in certain situations.
1597960	1603420	Here's an image of what it would look like if you open it up in DB Browser for SQLite,
1603420	1605220	all the columns I was talking about.
1606120	1612160	And then our synclog.log file is insight into user's activity and their personal accounts.
1612160	1615680	So whether they are creating files, deleting files, modifying files,
1615680	1618880	renaming files, changing files, and so on, changing ownership,
1618880	1623880	it is a bit messy and convoluted, so I do recommend you either grep it out
1623880	1627760	or you put it in some type of sim where you can manipulate the data
1627760	1629400	and get what you're looking for.
1629400	1633200	I do recommend grepping or parsing for those keywords as action.create,
1633200	1635600	action.delete to try and find things for you.
1636880	1640240	The synclog.log will also give us other things about direction.
1640240	1643900	So it'll tell us whether the file was first added to Google Drive
1643900	1647800	or if it was added locally by the user and then uploaded to Google Drive,
1647800	1650520	whether or not it's shared with other users in the organization.
1651120	1655540	And then the other thing you can grep for or parse for is name equals you
1655540	1659120	and then semi-quotes around the file name you're looking for.
1659120	1661940	So if there's a specific file name or you wanted to do a wild card
1661940	1665360	like pass or password, you could obviously do that format as well
1665360	1669020	and just parse out any words that have those keywords that you're looking for,
1669020	1672760	which is definitely helpful when you're looking for sensitive data on a pen test.
1673440	1675880	Okay, and here's just an example I wanted to show you.
1675880	1681480	If you're taking a look at the synclog.log, I used Sumo Logic just to do a log reduce
1681480	1683240	and so we could see some of those actions.
1683240	1688800	In this case, we can see that there was 22 download actions that were taken.
1688800	1692860	So something was pulled from Google Drive to the local system
1692860	1696380	and you could just kind of get a count on the different activities there.
1696380	1700800	But again, however you want to do this to try and figure out what's going on
1700800	1703880	or every use case can be different for what you're looking for
1703880	1707300	if you're using this on a penetration test or a red team engagement.
1708080	1710540	The snapshot.db, we're going to get all kinds of stuff here.
1710540	1714680	There's another database that we just looked at prior that was very similar.
1714680	1717900	The thing that this database adds is that we're going to also be able to see
1717900	1720940	whether or not the item is shared with other users.
1720940	1724860	So that's some additional functionality we get with the snapshots.db database.
1725860	1727880	Here's a screenshot of what that would look like
1727880	1730620	if you're looking at it with DB Browser for SQLite.
1731160	1736360	Now one thing you can do is you can recreate the folder structure
1736720	1739440	that the user would be seeing within Google Drive here.
1739440	1742620	And so looking at some of these, you might see the doc IDs
1742620	1745980	but not really know is this document you found within this folder
1745980	1747420	or where is it sitting?
1747780	1751580	And so looking at the cloud relations table within,
1751580	1755140	I believe it's within snapshots.db and cloud underscore graph.db,
1755140	1757920	you'll be able to then see the child and parent doc ID
1757920	1760040	and you can recreate some of these things
1760520	1763280	and figure out where these objects are stored.
1763280	1765460	And so it's not super straightforward
1765460	1770100	and I don't have a expedited process for you here just with my testing,
1770100	1775060	but this is what you would do is if you take the cloud entries
1775060	1776860	or whatever you're looking at there,
1776860	1778800	but you'd see that there's a document called finance
1778800	1781120	or a document called the Mike Wiley something.
1781860	1785800	And you would then have to go over to the cloud relations table
1785800	1788760	and in there we can then map those like I have on the screen
1789740	1792820	and we can see which files are in which folders
1792820	1796520	or are they in the root or where are they sitting within Google Drive.
1797540	1799600	Let's go ahead and take a look at Dropbox real quick.
1799600	1802680	Now I did not do a lot of testing on Dropbox
1802680	1806360	because one, time constraint, two, I was having issues
1806360	1810180	with how Dropbox is handling their databases.
1810180	1813400	So kudos to Dropbox, since 2011,
1813400	1817140	they've been using encrypted SQLite databases.
1817140	1821740	So they're using SQLite encryption extension, SCE, since 2011.
1821800	1823960	So all these other solutions we have talked about
1823960	1827320	and are going to talk about is that anyone who has access
1827320	1831080	to the databases or log files can see all of these artifacts,
1831080	1833340	activity and file names and whatnot,
1833640	1836840	whereas with Dropbox that is protected.
1837040	1838600	Now the key is stored in registry
1838600	1842640	and it's encrypted using Windows Data Protection API, DPAPI.
1843180	1845640	And so there's a couple of options.
1845640	1847860	You can either brute force the password, good luck.
1848000	1850540	Some of you probably have rigs way better than mine
1850540	1851840	that can go ahead and do that,
1851840	1855660	but that didn't seem feasible to me in my time constraints.
1855760	1859460	You could also then extract DPAPI from memory.
1859460	1863320	There is another talk about that, where this worked.
1863320	1868100	I tried to follow some of the stuff from the DEC WinDB toolkit
1868100	1871680	to extract those keys, but I didn't have success with that
1871680	1873580	in the limited time I had for testing.
1873860	1880220	So what you can do is look at some of the Dropbox.cache files.
1880220	1884020	Those contain miscellaneous temporary cache files
1884020	1886580	that possibly were deleted by other users.
1886580	1888080	I was able to get to some of that stuff
1888080	1891360	without obviously having to get through encryption
1891360	1893220	or find the decryption keys.
1895640	1899720	The deleting on files that are local.
1899720	1900900	So if you go ahead and delete something,
1900900	1904640	it's going to send it to the local recycle bin on Windows machines,
1904640	1906760	and that does not get purged,
1906760	1908580	unless obviously the user purges it.
1908580	1912220	Whereas on the cloud, if a user deletes something,
1912220	1914620	it goes to the cloud, recycle bin, or trash can,
1914620	1916780	and it's going to sit there for 30 to 120 days
1916780	1919420	depending on their subscription level and how much they're paying.
1919600	1922380	But locally, though, it could still be sitting in a recycling bin.
1922380	1923620	So if you are looking for something,
1923620	1925520	I do encourage you to look in the recycling bin.
1925520	1926480	And if they haven't cleared that,
1926480	1928400	you may be able to see purged things there.
1930060	1934320	And so those encryption keys, as we were talking about,
1934320	1936460	give the different locations on the screen here
1936460	1937860	of where you can find that.
1937900	1941120	Now, Nicholas and Florian did a talk called
1941120	1947320	A Critical Analysis of Dropbox Software Security at HackLU in 2012.
1947360	1950100	I recommend taking a look at that.
1950100	1951960	If you are more interested in this,
1951960	1956600	they were able to get into Dropbox databases.
1956740	1960620	I did try some of the stuff that they talked about
1960620	1962240	and some of the toolkits out there.
1962240	1965380	There are PS1 files, so PowerShell scripts,
1965380	1968840	as well as I believe they were Python scripts,
1968840	1971100	and neither of them really worked for me.
1971100	1972780	So I got different errors.
1972780	1976240	I tried debugging for a while and eventually moved on to the next tool.
1976240	1978660	So it has been done, can be done.
1978900	1981660	If you are really interested, I encourage you to go check that out.
1981660	1987180	Again, A Critical Analysis of Dropbox Software Security at HackLU 2012.
1987180	1989420	I believe there's a YouTube video out there on this.
1989980	1992580	This is allegedly, you can go to the GitHub,
1992580	1994320	play with it yourself, but you should be able to
1994320	1995600	if you tweet that a little bit.
1995600	1997620	And if you do, please let me know on LinkedIn or Twitter.
1997640	2000420	I'm curious on what you had to do to get it to work.
2000420	2001640	Probably something simple.
2002620	2006080	Some of the files and folders and databases that were created
2006080	2007560	when I installed Dropbox.
2007560	2010060	We can see that there are the Dropbox cache
2010060	2013140	and the .Dropbox files that are temporary files
2013140	2014700	that are possibly opened or cached.
2014700	2018380	So you can dig into that without decrypting the databases.
2018940	2022140	Anything else though, like the FileCache.dbx,
2022140	2026600	there are some duplicate directories as far as,
2026600	2030400	not directories, but databases, Host.db and Host.dbx,
2030880	2033800	they look similar, just slight difference in the extension type.
2033800	2035820	I could not access either one of them.
2035820	2038340	And so any one of those that you see,
2038340	2040880	oh, look, it's actually .db and it's not .dbx,
2040880	2041980	I can get in there.
2041980	2045160	From my testing, those were still unreadable.
2046700	2049320	The other thing you can find is there's an info.json
2049320	2052380	that's unencrypted and you can find the file store path,
2052380	2055000	host ID, team setting, subscription level and type,
2055000	2056080	how much they're paying.
2056220	2059840	Not terribly useful, but you can get a tiny bit of information
2059840	2061600	from that, but Dropbox really,
2061600	2064080	I liked that they did encrypt the databases
2064080	2066940	and didn't give you a whole lot of information
2066940	2069980	without decrypting those databases.
2069980	2071320	So kudos to them again.
2072040	2074000	Let's take a look at some of the box files.
2074080	2076700	So obviously you'll find the default file store,
2076700	2079860	but probably one of my favorites is the cache directory.
2079860	2080900	And within the cache directory,
2080900	2083920	you're going to find full copies of files
2083920	2087020	that were previously opened by the user locally.
2087020	2090960	So if they have box and they go ahead and open a file,
2090960	2092560	whether or not that file still exists
2092560	2095120	within the box file store,
2095120	2097960	you still will be able to, in most cases,
2097960	2098620	even if it's deleted,
2098620	2101620	you'll be able to find a version of that file
2101620	2103020	in the cache directory.
2103020	2105680	And so I have tried in lab environments
2105680	2107360	when I had deleted the files in box
2107360	2109920	and the cache copy is still in the cache directory.
2110020	2112500	Now the file name will not be the existing file name.
2112500	2114280	So obviously you can go into some of the other databases
2114280	2115720	and map that back,
2115720	2119180	but you can easily open the file in the cache directory
2119180	2120740	in a hex editor or text editor
2120740	2123220	and be able to see what type of file it is
2123220	2125340	and open it in its respective application.
2125580	2126700	Within the logs directory,
2126700	2128640	we'll find a bunch of different log files,
2128640	2131080	such as the box-version.log,
2131080	2132920	which is a detailed activity log.
2132920	2136480	We'll find the box UI underscore some random number
2136480	2138800	underscore the date.log.
2138800	2141440	And that is going to be generally things associated
2141440	2143020	with the box application.
2143020	2145940	So when the user signs into the local application,
2145940	2148180	they sign out, network activity.
2148300	2152480	It's a very detailed user interface logging.
2152480	2153820	I'll call it that.
2153860	2157060	We also see the box underscore stream underscore number
2157060	2159020	and then underscore date.log.
2159020	2160580	And that's going to have file activity,
2160580	2163800	such as files, paths, level of logging,
2163800	2166540	free space on the volume, et cetera.
2166540	2168080	It's got a lot of detailed information
2168080	2171780	about files in, out, and activity around them.
2171780	2174020	The data directory is going to have a path
2174020	2175220	to our databases.
2175220	2177800	We'll see databases such as the syncdb,
2177800	2181900	streamfs.db, and metrics.db.
2186200	2188480	So if we take a look at the box underscore streams
2188480	2191040	underscore number underscore the date,
2191040	2192340	and you'll find quite a few.
2192340	2193360	In my test environment,
2193360	2196800	I had just a handful of files and folders,
2196800	2198320	maybe less than 30 files.
2198320	2200660	And I was already seeing multiple versions
2200660	2203560	of this log file with different dates on them.
2203560	2205420	So it does seem like it rolls over pretty quickly
2205420	2207500	and there's a lot of activity in these files.
2207500	2209940	We'll see things with key actions,
2209940	2212120	kind of like we saw on prior applications.
2212320	2214560	We'll see add file, add folder,
2214560	2216360	on delete file, on delete folder,
2216360	2218160	on open file, on close file,
2218160	2220560	on read file, on create file,
2220560	2223260	on write file, and on get file info.
2223260	2225100	These are some actions that I've identified
2225100	2226900	just parsing through a couple of these logs
2226900	2227760	that look interesting
2227760	2230180	and things that may be relevant to you.
2230780	2233600	If we take a look at the box underscore streams
2233600	2237580	underscore number underscore date dot log,
2237580	2238380	as you can see there,
2238380	2240600	we'll see things like the cache path.
2240600	2242600	So if that was modified or changed
2242600	2243480	or anything like that,
2243480	2245960	you could see the cache location.
2245960	2248220	You'll see database paths.
2248220	2250560	You'll see the mount path, etc.
2250560	2252220	You'll see a lot of stuff in there.
2252520	2254380	And my favorite is that,
2254380	2257440	as I mentioned, that box cache directory.
2257440	2258920	And so you can see there within the directory,
2258920	2260460	we've got these what look like GWT,
2260460	2263060	possibly a hash, file names.
2263060	2265040	It doesn't tell us what the originals were,
2265040	2266260	but if you open them up,
2266260	2267480	what you're going to see there,
2267480	2268280	and this one was easy,
2268280	2269300	I opened up in a text editor
2269300	2271120	and we could see the magic byte there
2271120	2272780	and we could tell what type of file it was,
2272780	2274680	but it may be a file type
2274680	2276760	that Notepad's not going to understand.
2276760	2277960	And so if we do have a hex editor,
2277960	2279640	opening that up and taking a look at the magic byte
2279640	2281760	is going to be the preferred option there.
2281760	2283100	And we can actually recreate
2283100	2285800	or view those cache documents,
2285800	2286620	which is great.
2286620	2289260	The box.u, as I mentioned,
2289260	2290420	log file there,
2290420	2292500	you can see things like driver install,
2292500	2296160	driver events, sign-ins, cache events,
2296160	2297180	all kinds of activities
2297180	2299900	around the box application itself.
2300360	2303020	The box-version.log there,
2303020	2305220	we can see that there are some file names,
2305220	2308340	test.txt, when content was created,
2308340	2310660	again, in Unix epoch time.
2311220	2312980	And then we've got that database directory
2312980	2314820	with a couple of those databases we've talked about
2314820	2316660	in the sync.db database.
2316660	2318820	We're going to have a ID of objects
2318820	2320540	or files, folders within box.
2320540	2321660	We're going to have a type,
2321660	2322840	whether it's a file or folder.
2322840	2324360	We don't get that granular level
2324360	2327340	of document type like we saw with Google Drive,
2327340	2329220	but at least we can tell if it's a file or folder.
2329220	2330840	We can then see the parent ID
2330840	2334080	so we can recreate the folder structure within box.
2334240	2335340	The file name,
2335340	2338640	we get the owner ID of whoever owns that file.
2338640	2340180	So if someone else owns that file,
2340180	2342740	we should see the owner ID of that user.
2343260	2345480	We will see a hash in this case.
2345480	2346680	Unlike other applications,
2346680	2347760	we saw an MB5 hash.
2347760	2349800	We'll see a SHA1 hash within box.
2350300	2354120	We see when the file was created, updated.
2354120	2355700	I will mention with these,
2355700	2358560	I have not tested the created date
2358560	2361800	or updated time to verify when they're triggered,
2361800	2364160	when they're modified and that kind of stuff.
2364160	2365160	So that's a little bit more research
2365160	2366520	or something you may want to take a look at
2366520	2369020	and not just trust those dates out of the box.
2369880	2371060	No pun intended.
2371060	2373900	Sync.db within that database.
2373900	2375500	As I mentioned in the last slide,
2375500	2376840	we've got those different fields.
2376840	2378340	Here's an example of what you might see
2378340	2381040	if you open it up in DB Browser for SQLite.
2381200	2384960	The streamfsdb, there we're going to see a touch sequence.
2384960	2386100	I could not find documentation
2386100	2390580	or really reverse engineer what that was doing.
2390580	2393360	We see a cache data ID
2393360	2397340	and that's the file name of the cached version
2397340	2398760	that's sitting in that cache directory.
2398760	2400020	So a few slides ago,
2400020	2402420	we saw that cache directory and it looked like a grid
2402420	2405440	or some hash of the file name.
2405440	2406840	It wasn't the original file name.
2406840	2408300	Here's where we can actually see
2408300	2410980	and map that back to its original file name.
2410980	2416240	So that's the cache data ID is the cached version file name.
2416480	2418340	And then obviously the inode ID,
2418340	2421460	we can look at that and then reverse engineer that,
2421460	2424100	if you will, looking at the prior databases
2424100	2425920	and find that inode ID
2425920	2427920	and be able to see the original file name.
2427920	2429420	And then also we'll get an age column,
2429420	2432000	which gives us the when a file was cached.
2432260	2435740	Zero, you'll see in that column, if it is not cached.
2435900	2439800	If it is a one, it is cached.
2439800	2441100	So we'll take a look at that,
2441100	2441980	or I'm sorry, not a one,
2441980	2444340	but we'll see the epoch, Unix epoch time
2444900	2446940	of when that file was cached locally.
2446940	2448260	So on that far right column there,
2448260	2450580	you'll see a few different date timestamps
2451200	2452580	when those files were cached
2452580	2453800	and then all the other ones there
2453800	2455800	that were not cached locally
2455800	2458560	on the system that we've compromised.
2460120	2465860	Okay. And so with the streamsfs.db database,
2465860	2467160	if we take a look at that,
2467160	2469880	obviously there you can see in the names column
2470420	2471740	of the syncdb,
2471740	2473740	and that's where we can recreate the file name.
2473740	2476800	So again, going back to the streamsfsdb,
2476800	2481040	we can see that there's a GWT or hash there
2481040	2483780	of A1, B4, 5, et cetera.
2483780	2484840	That's what we would have seen
2484840	2485820	in the cache directory.
2485820	2487600	If we want to know the original file name,
2487600	2489880	we go over to the inode ID column.
2489880	2491040	We see that it's 13.
2491040	2493740	We then open up the syncdb database
2493740	2497120	and we can look at the inode ID for 13,
2497120	2499580	which then go into the left-hand side there.
2499580	2500820	We can see in the names column,
2500820	2502240	it was called business plan.
2502240	2504160	So that's how we can recreate those file names
2504160	2506320	if we do find interesting cached files
2506320	2508400	sitting in that cache directory.
2509060	2510340	And here's just another example
2510340	2512380	of a cached item that we can open up
2512380	2513600	in the cache directory.
2513600	2517340	And we can see the magic byte of PK.
2517480	2518560	And essentially we can see
2518560	2520420	that that is a docx document.
2520420	2523260	So we can open up that in Microsoft Word
2523260	2525740	or change the file extension to .docx
2525740	2527380	and open it that way.
2528080	2529280	And here we can see,
2529280	2531620	obviously I didn't have Microsoft Office installed,
2531620	2533280	but I was able to open it up in WordPad.
2533280	2534200	And we can now see that
2534200	2535800	that is in fact the business plan
2535800	2539200	for startup business document that we saw.
2540240	2540920	Okay.
2541020	2543360	And just a couple of things on those columns
2543360	2544700	within the stream FSDB.
2544700	2545360	We can obviously see
2545360	2546600	whether it's a file or folder,
2546600	2548720	the parent's inode ID,
2548720	2549820	the name of the file.
2549820	2552080	We'll see multiple timestamps,
2552080	2553620	the created at timestamp,
2553620	2554860	the modified timestamp,
2554860	2555980	access timestamps.
2555980	2557140	Again, you may want to do
2557220	2558080	a little bit of testing on this
2558080	2559520	if that's important to you.
2559540	2561660	I don't know exactly what events
2561660	2562580	will trigger that,
2562580	2564420	and I just want to warn you of that.
2564540	2565760	We'll also see the inode ID
2565760	2567580	of the object we're taking a look at.
2567580	2569020	And we'll see whether or not
2569020	2570540	the item or the object
2570540	2572360	is marked for offline use.
2573860	2577000	Essentially kept offline or cached.
2577000	2577640	And then we'll also see
2577640	2580160	folder fetch timestamp.
2580160	2580840	So it's, again,
2580840	2582020	Unix epoch timestamp
2582020	2583560	or the last folder sync
2583560	2585140	for that object.
2586140	2587400	Let's go ahead and talk about
2587400	2589700	Citrix share file for a second here.
2589700	2591160	A little intro to it.
2591160	2593220	The application to download,
2593220	2594320	unlike all the other applications
2594320	2595360	we've talked about,
2595360	2597440	it's behind a signup wall.
2597440	2599760	So you cannot just go download it
2599760	2601400	like you would for OneDrive
2601400	2604540	or Dropbox or anything else like that.
2604540	2605580	You actually need to register
2605920	2607240	for a trial of it
2607240	2608780	using what they say
2608900	2610900	a business or enterprise account.
2611280	2612460	However, I was able to use
2612560	2615280	a Gmail account for a trial request.
2615280	2616580	Instantly got the download link
2616580	2618240	for that and signed up.
2618760	2621660	And then upon installing share file,
2621660	2622700	what it looks like is it creates
2622820	2625300	a virtual volume, FAT32,
2625300	2626340	similar to what Google Drive
2626340	2628140	is doing with FileStream.
2628220	2630240	And it will automatically create
2630400	2632080	a mounted S drive for you
2632080	2633880	on that Windows system.
2634140	2634740	From what I see,
2634740	2636120	the databases are SQLite
2636120	2637400	and they are unencrypted.
2637400	2639840	So yet another unencrypted database.
2640240	2642420	The key things that I've noted here
2642420	2644260	from testing is that obviously
2644260	2645900	the S drive or volume
2645900	2648640	is what the default file store.
2648660	2651760	We'll see within user profile,
2651760	2654920	there's app data, local Citrix.
2654920	2655980	And then within Citrix,
2655980	2656860	you'll see a couple other
2656860	2658860	directories and files of interest.
2658860	2662060	Within Citrix files slash DB,
2662060	2663320	there's an ID.
2663320	2664560	And this ID seemed to change.
2664560	2667200	It was probably based off of my trial.
2667760	2669140	That seems to be where the most
2669140	2670520	of the databases are stored.
2670520	2672840	So possibly the ID directory is created
2672840	2674120	so that if you have different
2674120	2675660	share file accounts,
2675660	2677800	they're stored in different directories.
2677880	2679060	The remote DB,
2679060	2680620	it appeared to have a list
2680620	2682580	of all files that were remote
2682580	2686080	and folders as well.
2686080	2688020	And then we have a local item.db
2688020	2689620	and that lists all the local
2689620	2691120	files and folders.
2691260	2692760	There's also a logs directory
2692760	2693600	and that's where they store
2693600	2695140	all the different log files.
2695180	2698200	And then there's a Citrix file underscore
2698200	2699240	and then a date.log
2699560	2701240	and that seemed to have detailed activity
2701240	2704100	about what's going on with share file.
2704220	2705620	And then I also identified
2705620	2707340	that they had part cache directory
2707340	2708400	and that seemed to have
2708400	2709380	all of the cache files
2709380	2710440	that I opened up locally
2710440	2711720	on the Windows system.
2712000	2713440	So if we see here,
2713440	2714140	the DB directory
2714140	2716200	and then some ID or GWT number,
2716200	2716920	that's where we've got
2716920	2718740	all the different databases.
2718740	2719380	You can see there's more
2719380	2721700	than I mentioned on the prior slide.
2722020	2722760	And the reason for that
2722760	2723920	is that there are certain databases
2723920	2725080	that were near empty
2725080	2726920	or didn't seem to be having
2726920	2728020	unique information,
2728020	2729580	so I kind of left those out.
2730480	2731560	Within the remote DB,
2731560	2734680	we'll have a couple of different columns
2734680	2735840	if we open that up
2735840	2737760	in a database viewer for,
2737760	2739220	a browser for SQLite.
2739220	2741000	We've got folder IDs,
2741000	2742040	parent folder IDs,
2742040	2742740	file names,
2742740	2744800	and global share file IDs.
2744800	2746400	So it's assigned a unique ID.
2746800	2747880	And we can see here
2747880	2749220	the different files
2749220	2751260	that I had within share file.
2751460	2753060	We can kind of see the name.
2753060	2754260	There's a bunch of different file names
2754260	2755140	that I had for testing
2755140	2756500	and then the unique ID
2756500	2757680	to the right of that.
2757980	2761400	The remote DB database,
2761400	2763640	it's got a object ID
2763640	2764480	in the database.
2764480	2766680	It has a parent object ID.
2766740	2768220	It has an identifier
2768220	2770480	for the item,
2770480	2770940	whether or not
2770940	2772360	if it was a file or folder,
2772360	2773700	so you can just see indications.
2773700	2775160	Again, similar to the last example
2775160	2775740	we looked at,
2775740	2777340	not as detailed as Google Drive,
2777340	2777980	but at least we can tell
2777980	2779240	if it's a file or folder.
2779240	2780540	We get a created date
2780540	2782220	and Unix epoch time.
2782220	2783860	We have a file hash
2783860	2785820	and quite a few other columns
2785820	2787400	that didn't seem super relevant
2787400	2788580	for this talk.
2789160	2790480	So here's just a sample.
2790480	2791360	You can see there's a lot
2791360	2792820	of different columns here.
2792820	2795040	Quite a few were nulled out
2795040	2796320	and other ones
2796320	2797200	just didn't seem relevant
2797200	2799620	for offensive security purposes.
2799760	2801220	The local item database,
2801220	2803060	we can see things like the key,
2803060	2805060	there are certain columns here
2805060	2807460	I didn't have great explanations for,
2807460	2808520	so I left those blank.
2808520	2811040	But again, we've got the change date,
2811040	2811880	last access date,
2811880	2812740	last write date,
2812740	2813920	an ID number,
2813920	2815340	which not sure how that differs
2815340	2818180	from the share file unique ID
2818180	2819360	we saw prior.
2819640	2821000	There's a content ID,
2821000	2822060	again, not sure how that differs
2822060	2823520	from the key or the ID.
2823700	2825700	And then the creation date,
2825700	2826860	time an object was created
2826860	2828300	in Unix epoch.
2828300	2829740	We did get another interesting one
2829740	2831220	is there's a URL column,
2831220	2832980	and that gives us a cloud URL
2832980	2834800	so it's the instance ID.
2834800	2835620	I don't know if this changes
2835620	2837860	for paid accounts versus trials,
2837860	2840780	but I had some kind of trial instance ID
2840780	2843800	.sf-api.com
2843800	2846160	.sf-v3
2846160	2847200	.sf-v3
2847200	2847700	.sf-v3
2847700	2847720	.sf-v3
2847720	2848480	.sf-v3
2848480	2848900	.sf-v3
2848900	2849640	.sf-v3
2849640	2850880	.sf-v3
2850880	2853180	.sf-v3
2853180	2861980	.sf-v3
2862520	2864260	Now, I would like to do
2864260	2865300	some further testing on that
2865300	2866660	and figure out if we can
2868060	2870460	use other tools aside from a browser
2870460	2871980	to go ahead and access those files
2871980	2872800	without authentication.
2873080	2874600	That seems like it may be
2874840	2876540	a security issue for share file,
2876540	2878740	but I have not validated that yet.
2880160	2881440	We also see a file hash
2881440	2883300	and there's quite a few other columns
2883300	2884260	that we see.
2884280	2887080	Within the directory entry.db database,
2887080	2889220	we just get very limited information,
2889220	2890420	a parent ID of an object,
2890420	2892320	a file name, ID of an object.
2893100	2894380	If we go ahead and take a look
2894380	2896940	at the Citrix files underscore date,
2896940	2897720	and then it actually has
2897720	2899760	the date of the file, .log,
2899760	2901860	we'll see other actions
2901860	2903100	that we may want to parse out
2903100	2904860	using strings or grep
2904860	2906300	or something like that.
2907300	2909520	Upload file, these are all in brackets.
2909640	2910920	You want to search for those.
2910920	2913440	File system notifier, local,
2913440	2916480	win, FSP, delete item,
2916480	2918420	download, upload, read callback.
2918420	2919540	Those are all interesting things
2919540	2922200	that I found within those log files.
2922280	2922820	And if we go ahead
2922820	2925440	and take a look at that part cache file,
2925440	2926820	it's exactly the same as we saw
2926820	2928420	in the last example for Box,
2928420	2929960	where in this case, though,
2929960	2930840	it seemed to rename it
2930840	2932340	rather than some type of GWT.
2933140	2934740	The directory, the parent directory
2934740	2936140	would be some type of GWT
2938300	2939460	or hash or something
2939460	2940700	that identified that file.
2940700	2941920	But then within that,
2941920	2944000	it was a single cached file.
2944320	2947300	It was generally called 0.part.
2947520	2948560	However, if you open that up
2948560	2949540	and put it in with a hex editor,
2949540	2950640	you'd see the magic byte.
2950640	2952880	You see that it's a Word doc,
2952880	2954040	and we could just change
2954040	2956000	the file extension to .docx,
2956000	2956740	and we could go ahead
2956740	2958020	and open up that file.
2958020	2959060	Whether or not it was deleted
2959060	2959900	within share file,
2959900	2962440	we now have a cached version of that.
2963360	2965360	So in closing, one other way
2965360	2965840	that you may be able
2965840	2966720	to take a look at things,
2966720	2968740	if a user is not actually,
2968740	2969600	or they have not installed
2969600	2970440	the application,
2970440	2971120	but they are using
2971120	2972420	cloud file storage solutions,
2972420	2973320	you want to enumerate a little bit
2973320	2974600	about what they're doing.
2975880	2977120	I identified some things
2977120	2978440	within Google Drive,
2978440	2980520	where if they were using
2980520	2981720	or viewing or editing
2981720	2983260	Google Spreadsheets,
2983260	2984120	you would see within
2985100	2987740	their browser history,
2987740	2988980	docs.google.com
2988980	2990120	slash spreadsheets.
2990120	2991140	If they were editing
2991140	2992200	or viewing a presentation,
2992200	2994060	you could see docs.google.com
2994060	2995580	slash presentation.
2995580	2996920	Not a ton of great information
2996920	2997860	from that, other than
2997860	2998880	that they are using
2998880	3000940	Google Docs in the environment,
3000940	3002140	and you may have to then
3002820	3004780	attempt to gather documents
3004780	3006480	else or a different method.
3006480	3009040	But obviously,
3009040	3010240	if they are using a browser
3010240	3010780	and you have access
3010780	3012420	to their browser,
3012420	3013840	Google never signs you out,
3013840	3014820	so you should be able
3014820	3016040	to obviously just open
3016160	3017720	a browser and access
3017720	3018520	the documents there.
3018520	3019940	But this is a telltale sign
3019940	3020760	that they are using
3020760	3022160	probably G Suite
3022160	3022960	or Google Docs
3022960	3024260	for the workplace.
3025480	3026740	We can also see
3026740	3027980	other tools,
3027980	3029520	for example, Box,
3029520	3030460	whether they were
3030460	3031420	in the root directory,
3031420	3032040	it's going to have
3032860	3034300	app.box.com
3034300	3034960	slash folder
3034960	3035980	slash zero,
3035980	3037320	and then we will see
3037320	3038200	other indications
3038200	3039220	of different folders,
3039220	3040320	but at least you can see
3040320	3041220	that they have
3041220	3041980	signed in
3041980	3042740	and that they were
3042740	3043580	looking at the root
3043580	3044560	of box.com,
3044560	3045120	if you see that
3045120	3046460	folder slash zero.
3046800	3048100	With OneDrive,
3048100	3048860	you're going to see
3048860	3050640	onedrive.live.com
3050640	3051260	slash
3051260	3052140	question mark
3052140	3052920	ID equal
3052920	3053720	root,
3053720	3054460	and you'll see that
3054460	3055080	they have a personal
3055080	3055780	account there,
3055780	3056440	and they are looking
3056440	3057380	in the root directory.
3057380	3058480	You'll also see the CID
3058480	3060440	of their personal
3060440	3061320	OneDrive account.
3061320	3062100	For business,
3062100	3063460	it's a little bit different.
3064200	3065000	They're probably going
3065000	3065300	to be using
3065300	3066340	SharePoint.
3067260	3068280	If you're using
3068280	3068960	Dropbox,
3068960	3069740	we can see that it's
3069740	3070660	just dropbox.com
3070660	3071360	slash home,
3071360	3072040	which wasn't a great
3072040	3072800	indication of what
3072800	3073200	they were doing
3073200	3074460	within Dropbox.
3074680	3076460	With viewing an
3076460	3077240	actual document,
3077240	3077520	though,
3077520	3078060	showing that they
3078060	3078840	have signed in
3078840	3079160	and they are
3079160	3079640	actually viewing
3079640	3080740	content,
3080740	3081220	you'll see
3081220	3082060	dropbox.com
3082060	3082440	slash
3083080	3083880	SCL,
3083880	3084740	and that will
3084740	3085420	indicate that they
3085420	3086160	have actually
3086160	3086880	viewed documents
3086880	3088180	within Dropbox.
3089080	3090120	Also, if they are
3090120	3091240	viewing the content
3091240	3092640	of a folder,
3092640	3093280	you're going to go
3093280	3093680	ahead and actually
3093680	3094140	see the folder
3094140	3094860	name as well.
3094860	3095320	So it's going to be
3095320	3096300	dropbox.com
3096300	3097000	slash home
3097000	3097700	slash the
3097700	3098780	folder name.
3098960	3099420	You'll get some
3099420	3100020	indication of the
3100020	3100660	different folders,
3100660	3100880	whether it's
3100880	3101540	accounting,
3101540	3102820	HR, etc.
3104200	3105360	Now, one thing I did
3105360	3106160	create for you,
3106160	3106660	if you want to go
3106660	3107480	ahead and shoot me
3107600	3108280	a message on
3108280	3109200	LinkedIn or Twitter,
3109200	3109780	happy to share
3109780	3110720	this with you.
3111060	3111720	Once I created
3111720	3112740	my lab environment
3112740	3113500	and I wanted to
3113500	3113940	go ahead and
3113940	3116480	collect the metadata
3116480	3117100	and the artifacts
3117100	3117620	that were left
3117620	3119320	behind, what I did
3119320	3120380	is I created a
3120380	3121560	CAPE target.
3121560	3123080	And so I utilized
3123080	3123780	CAPE, which
3123780	3124320	generally I would
3124320	3125880	use more in an
3125880	3126380	incident response
3126380	3127600	or a digital
3127600	3128540	forensic case,
3128540	3130160	to do a triage
3130320	3131220	image of the
3131220	3131840	system.
3131840	3132560	The reason that I
3132560	3132920	like using this
3132920	3133900	tool is that you
3133900	3135580	can see here,
3135580	3136860	using this custom
3136860	3138380	target that I
3138380	3139260	created, it
3139260	3140040	took 12 seconds,
3140040	3140460	just under 12
3140460	3141200	seconds, to go
3141200	3141720	ahead and collect
3141720	3142240	all that data.
3141940	3142940	So if you want to
3142240	3142760	play around with
3142760	3144300	this or try and
3144300	3145100	test this out,
3145100	3145800	see what kind of
3145800	3146480	cache files are
3146480	3147080	left behind or
3147080	3147440	that you can
3147440	3149380	enumerate, it's
3149380	3150240	very easy to do.
3150240	3150740	You can obviously
3150740	3151620	pull these yourself,
3151620	3152320	but I found it
3152320	3154160	useful to use a
3154160	3154960	CAPE target so
3154960	3155940	that I could just
3155940	3156640	collect all of the
3156640	3157160	different data from
3157160	3158180	the different cloud
3158180	3158920	providers very
3159300	3159740	quickly.
3159740	3160360	And so I've
3160360	3161040	got a snippet
3161040	3161260	there.
3161260	3164080	I can give you
3164080	3164340	the GitHub link
3164340	3164940	if you go ahead
3164940	3165720	and send me a
3165720	3166000	message on LinkedIn
3170240	3171240	or Twitter, as I
3166000	3166960	mentioned.
3167120	3167940	And that wraps
3167940	3168000	up this session.