We covered using Linux forensics to investigate a cyber incident. We covered reading and extracting evidence from log files and command history. This was part of TryHackMe Disgruntled

Initial Investigation & Privileged Commands

I started by looking for privileged commands executed by the employee. To find commands run with sudo, I checked the authentication logs using cat /var/log/auth.log | grep -i "COMMAND". I then refined this to filter for commands related to package installation with cat /var/log/auth.log | grep -i "sudo" | grep "install". This revealed the installation of “dokuwiki.” From the same log entry, I identified the present working directory when “dokuwiki” was installed as /home/cyberT.

User Creation and Privilege Escalation

Next, I looked for user creation events after the package installation using cat /var/log/auth.log | grep -i "add user". This showed a user named “it-admin” was created, and the timestamp indicated this happened shortly after the dokuwiki installation.

I then checked when the sudoers file was updated to grant this new user sudo privileges. I used cat /var/log/auth.log | grep -i "vi /sudo" (implying visudo was used, which logs as vi /etc/sudoers.tmp or similar). The log entry associated with the cyberT user’s working directory was the relevant one.

Suspicious Script Activity

I investigated for files opened with the vi text editor. Initially, I checked for saved files using cat /home/it-admin/.viminfo | grep "save as", which revealed a file /bin/always_update was saved. To find opened files, I checked the authentication logs again, specifically filtering for vi commands executed by the it-admin user. This showed a script file named “bump.sh” was opened.

Suspecting bump.sh to be malicious but finding it deleted, I looked for how it was created by checking the bash history of the it-admin user. I navigated to /home/it-admin and ran cat .bash_history. This revealed the bump.sh script was downloaded using curl from an IP address and saved as bump (curl <IP_ADDRESS>/bump -o bump).

The script was then renamed and moved, so I checked scheduled tasks as the user likely wanted it to execute later. I used cat /etc/crontab, which showed a script /bin/OS-update was scheduled to run. This was the new name and location of the bump.sh script.

Analyzing the Malicious Script

I checked the last modification time of the /bin/OS-update script using ls -la /bin/OS-update. Then, I examined its contents with cat /bin/OS-update. The script contained commands to remove a package and echo taunting messages, including “I told you you would regret this” and “goodbye.” From the echo command output redirection within the script, I identified that a file named good_evidence would be created when this script executed. The crontab entry confirmed the /bin/OS-update script was scheduled to run daily at 8:00 AM.

In summary, I discovered that the disgruntled employee installed a package, created a new user (it-admin), granted it sudo privileges, downloaded a malicious script (bump.sh), renamed and moved it to /bin/OS-update, and scheduled it to run via cron to cause damage and leave taunting messages.

TryHackMe Disgruntled Room Answers

The user installed a package on the machine using elevated privileges. According to the logs, what is the full COMMAND?

What was the present working directory (PWD) when the previous command was run?

Which user was created after the package from the previous task was installed?

A user was then later given sudo priveleges. When was the sudoers file updated? (Format: Month Day HH:MM:SS)

A script file was opened using the “vi” text editor. What is the name of this file?

What is the command used that created the file bomb.sh?

The file was renamed and moved to a different directory. What is the full path of this file now?

When was the file from the previous question last modified? (Format: Month Day HH:MM)

What is the name of the file that will get created when the file from the first question executes?

At what time will the malicious file trigger? (Format: HH:MM AM/PM)

Video Walkthrough

About the Author

Mastermind Study Notes is a group of talented authors and writers who are experienced and well-versed across different fields. The group is led by, Motasem Hamdan, who is a Cybersecurity content creator and YouTuber.

View Articles