Day 3 TryHackMe | Advent of Cyber 2024

By 𝓞𝓟 𝓚𝓮𝓿𝓲𝓷 ッ | 3/ 12/ 2024

“Even if I wanted to go, their vulnerabilities wouldn’t allow it.”

Overview

In today’s task, we dive deep into the investigation of a web attack from two perspectives:

1. Operation Blue: The defensive (blue team) approach to analyze and understand the attack using log analysis tools like ELK (Elasticsearch, Logstash, Kibana).
2. Operation Red: The offensive (red team) perspective to explore how an attacker exploited vulnerabilities in the application.

Learning Objectives

• Understand the basics of log analysis with ELK.
• Learn how KQL (Kibana Query Language) helps in filtering and querying logs.
• Explore how insecure file uploads can lead to Remote Code Execution (RCE).

Operation Blue: Investigating the Attack

Tools and Setup

In this section, we focus on the tools and techniques to investigate a web attack using the ELK stack. ELK is widely used for log aggregation, visualization, and analysis, making it an essential tool in any SOC analyst’s toolkit.

Log Analysis Using ELK

Our task is to analyze logs from the WareVille Rails booking platform, which was targeted on October 1, 2024. We aim to uncover:

• How the attack was carried out.
• The commands executed by the attacker.

Steps to Investigate

1. Set Time Range in Kibana
   Set the time range in Kibana to the attack period:

• Start Time: October 1, 2024 @ 00:00:00.000
• End Time: October 2, 2024 @ 00:00:00.000

1. Timeline Analysis

• A spike in activity between 11:30:00 and 11:35:00 indicates suspicious behavior.
• Logs show that a file named “shell.php” was accessed with parameters c and d.

2. Search Query
Use the following Kibana Query Language (KQL) syntax to filter logs:

message: "shell.php"

1. This query retrieves all log entries containing the term shell.php.
2. Fields to Observe
   Add the following fields to analyze the attack effectively:

• clientip: Identifies the attacker’s IP address.
• request: Tracks the accessed file or endpoint.
• verb: Monitors HTTP methods (e.g., GET or POST).
• auth: Checks authentication status.
• bytes: Observes data transfer size.

Observations

• A web shell was uploaded to the server via an insecure file upload mechanism.
• The attacker executed malicious commands via the shell.php file.

Operation Red: The Attack Perspective

Vulnerability Exploited

The attacker exploited an insecure file upload feature in the WareVille Rails web app. This allowed them to upload a malicious PHP file (shell.php), granting them remote access to the server.

Steps of the Attack

1. Upload the Web Shell

• The attacker identified a file upload functionality lacking proper validation.
• Uploaded shell.php containing malicious code.

2. Access the Shell

• Used a crafted HTTP GET request to execute commands through the shell:

GET /shell.php?c=whoami

3. Commands Executed

• The attacker ran commands to gather system information, escalate privileges, and compromise the server further.

KQL Syntax for Investigation

Here are some helpful Kibana Query Language (KQL) commands for investigating logs:

“Practical Insights: Investigating and Exploiting a Vulnerability”
In today’s challenge, we will tackle a two-part task:

1. Blue Team Activity: Investigate the attack logs in Kibana to uncover critical evidence.
2. Red Team Activity: Recreate the attack to understand its execution and retrieve the flag.

We will analyze logs between 11:30 AM and 12:00 PM on October 3, 2024 and then perform the attack on the vulnerable website Frosty Pines Resort.

Blue Team Task: Investigating the Attack with Kibana

Step 1: Access Kibana

• Visit Kibana at http://MACHINE_IP:5601.
• Set the time filter to focus on the attack window:
• Start: October 3, 2024, 11:30 AM
• End: October 3, 2024, 12:00 PM

Step 2: Analyze Logs to Answer Questions

Where Was the Web Shell Uploaded?

• Search for shell.php in Kibana using the query:

message: "shell.php"

• Look for logs indicating the upload location. Typically, the request or url field contains this information.

1. What IP Address Accessed the Web Shell?

• Once the upload location is identified, filter for logs where the shell.php file was accessed.
• Query for shell.php and add the clientip field to observe the IP address that interacted with the web shell.

Example Queries

• To find the web shell’s upload location:

message: "shell.php"

To identify the accessing IP:

request: "/path/to/shell.php"

Red Team Task: Exploiting the Vulnerability

Step 1: Modify the Hosts File

• Map the domain frostypines.thm to the machine IP.

echo "MACHINE_IP frostypines.thm" >> /etc/hosts

Step 2: Access the Vulnerable Website

• Visit the website at http://frostypines.thm.

Step 3: Exploit the Vulnerability

• Upload Malicious Web Shell:
• Find the file upload functionality on the website.
• Use a malicious PHP file, such as shell.php, to exploit the insecure file upload mechanism.
• Trigger the Web Shell:
• Access the uploaded file using a browser or a crafted HTTP GET request.
  Example:

curl "http://frostypines.thm/path/to/shell.php?c=whoami"

Step 4: Retrieve the Flag

• Use the web shell to navigate the server’s directory structure and locate the flag.txt file.
  Example:

curl "http://frostypines.thm/path/to/shell.php?c=cat /path/to/flag.txt"

Walkthrough of Answers

Blue Question 1: Where Was the Web Shell Uploaded?

• Search logs for the upload event using shell.php.
• Identify the directory path in the request or url field.
• Answer Format: /directory/directory/directory/filename.php.

Blue Question 2: What IP Address Accessed the Web Shell?

Get GDB HackerOne’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Filter logs for interactions with the uploaded shell.php.

• Look for the IP address in the clientip field.
• Answer Format: **.**.**.**.

Red Question: What Is the Content of the Flag?

Exploit the vulnerability and execute a command to read the flag.txt file.

• Answer Format: ***{***************}.

Takeaways

Blue Team Takeaways

• Log Analysis: Effective use of Kibana Query Language (KQL) is essential for pinpointing attack details.
• Monitoring and Alerts: Setting up alerts for suspicious file uploads or accesses can help detect attacks early.
• Blue Team Perspective: Always monitor logs for anomalies and set up alerts for suspicious activity.

Red Team Takeaways

• Input Validation: Ensure all user inputs, including file uploads, are thoroughly validated.
• Restricted Execution: Prevent execution of unauthorized files on the server.
• Red Team Perspective: Test for insecure features, such as file uploads, during vulnerability assessments.

Next Steps

For further learning:

• Investigate how to secure file upload functionalities.
• Explore advanced KQL queries and ELK visualization techniques.

Conclusion

This practical task highlights the importance of both offensive and defensive cybersecurity practices. By investigating logs and recreating the attack, we gain a deeper understanding of vulnerabilities, and the steps required to secure web applications effectively.

By utilizing the ELK stack and KQL effectively, we were able to uncover the details of the attack and gain insights into how it was executed. This highlights the importance of log analysis in understanding the attack lifecycle and implementing effective defenses.

Happy Hunting and Stay Secure!