> For the complete documentation index, see [llms.txt](https://0xmedhat.gitbook.io/whoami/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xmedhat.gitbook.io/whoami/writesup/hammered-cyberdefenders.md). # Hammered Cyberdefenders Category : Digital Forensics Log Analysis Honeypot Apache2 * [Details](https://cyberdefenders.org/blueteam-ctf-challenges/42#nav-overview) This challenge takes you into the world of virtual systems and confusing log data. In this challenge, figure out what happened to this webserver honeypot using the logs from a possibly compromised server. Challenge files: * kern.log * auth.log * daemon.log * dmesg * apache2 * [Questions](https://cyberdefenders.org/blueteam-ctf-challenges/42#nav-questions) #### Q1 Which service did the attackers use to gain access to the system? let's investigate auth.log file to see the authentication of accounts ```bash cat auth.log | grep -F 'Failed' ```

by greping failed authentication attempets we can see that there are many attempts to login by sshd . okay the service is ssh **Ans : ssh** #### Q2 What is the operating system version of the targeted system? (one word) we can look in the kern.log file, as it contains information logged by the kernel ```bash head kern.log ```

**Ans : 4.2.4-1ubuntu3** #### Q3 What is the name of the compromised account? We can back to auth.log file to see which account was successfully login ```bash cat auth.log | grep -F 'Accepted password' ```

**Ans : root** #### Q4 Consider that each unique IP represents a different attacker. How many attackers were able to get access to the system? let's grep failed auth ip ```bash grep sshd auth.log| grep "authentication failure" | awk '{print $14}' | sort | uniq -c | sort -n ```

and success ip ```bash cat auth.log |grep "Accepted" | awk '{print $11}' | sort | uniq -c | sort -n ```

By comparing them we found it's 6 login to system 219.150.161.20, 222.66.204.246, 121.11.66.70, 222.169.224.197, 122.226.202.12, 61.168.227.12 **Ans : 6** #### Q5 Which attacker's IP address successfully logged into the system the most number of times? The two IP addresses 188.131.23.37 and 219.150.161.20 are the highest value but 188.131.23.37 appears only six times in auth.log, and appears 219.150.161.20 many times. ```bash grep "Accepted" auth.log| grep Accepted | grep root | awk '{print $11}' | sort | uniq -c | sort -n ```

Ans : 219.150.161.20 #### Q6 How many requests were sent to the Apache Server? The requests store in www-access.log

Ans : 365 #### Q7 How many rules have been added to the firewall?

**Ans : 6** #### Q8 One of the downloaded files to the target system is a scanning tool. Provide the tool name. We can Look for installed package in dpkg.log file

**Ans : nmap** #### Q9 When was the last login from the attacker with IP 219.150.161.20? Format: MM/DD/YYYY HH:MM:SS AM back to auth.log file and grep login success from the attacker ip address ```bash grep "Accepted password" auth.log | grep "219.150.161.20" ```

last log in Apr 19 05:56:05 Ans : 04/19/2010 05:56:05 AM #### Q10 The database displayed two warning messages, provide the most important and dangerous one. database information stores in daemon.log

The most dangerous one is creates root users **without passwords** **Ans : mysql.user contains 2 root accounts without password!** #### Q11 Multiple accounts were created on the target system. Which one was created on Apr 26 04:43:15? grep the time in the Q

**Ans : wind3str0y** #### Q12 Few attackers were using a proxy to run their scans. What is the corresponding user-agent used by this proxy? Grep User-Agent Value from www-access.log file ```bash cat apache2/www-access.log | cut -d ' ' -f 12 | sort | uniq ```

Ans : pxyscand/2.1\ \ \ \ Thanks UUUUUUUUUUUUUUUUUU 🥰