We covered investigating a cyber incident scenario ,where PhpMyAdmin database was hacked along with its e-commerce website, using the elastic stack (logstash, Kibana and elastic search) and KQL queries. We uncovered the scanner the attacker used to fingerprint the database, the directory enumeration tool and the credential brute-force tool used to gain access to the admin panel of the website. This was part of TryHackMe Slingshot room.
Notas de estudio del equipo azul
Notas de estudio de seguridad cibernética
TryHackMe Slingshot Challenge Description
Slingway Inc., a leading toy company, has recently noticed suspicious activity on its e-commerce web server and potential modifications to its database. To investigate the suspicious activity, they’ve hired you as a SOC Analyst to look into the web server logs and uncover any instances of malicious activity.
To aid in your investigation, you’ve received an Elastic Stack instance containing logs from the suspected attack. Below, you’ll find credentials to access the Kibana dashboard. Slingway’s IT staff mentioned that the suspicious activity started on July 26, 2023.
By investigating and answering the questions below, we can create a timeline of events to lead the incident response activity. This will also allow us to present concise and confident findings that answer questions such as:
- What vulnerabilities did the attacker exploit on the web server?
- What user accounts were compromised?
- What data was exfiltrated from the server?
Reflejos
¿Qué es el Elastic Stack?
Elastic stack es la colección de diferentes componentes de código abierto vinculados entre sí para ayudar a los usuarios a tomar los datos de cualquier fuente y en cualquier formato y realizar una búsqueda, analizar y visualizar los datos en tiempo real.
Búsqueda elástica
Elasticsearch es un motor de análisis y búsqueda de texto completo que se utiliza para almacenar documentos con formato JSON. Elasticsearch es un componente importante que se utiliza para almacenar, analizar, realizar correlaciones de datos, etc.
Está construido sobre Apache Lucene y proporciona una solución escalable para búsqueda de texto completo, consultas estructuradas y análisis de datos.
Elasticsearch admite API RESTFul para interactuar con los datos.
Alijo de registros
Logstash es un motor de procesamiento de datos que se utiliza para tomar datos de diferentes fuentes, aplicarles el filtro o normalizarlos y luego enviarlos al destino, que podría ser Kibana o un puerto de escucha.
kibana
Kibana es una visualización de datos basada en web que funciona con elasticsearch para analizar, investigar y visualizar el flujo de datos en tiempo real. Permite a los usuarios crear múltiples visualizaciones y paneles para una mejor visibilidad.
Respuestas de la habitación
What was the attacker’s IP?
10.0.2.15
WWhat was the first scanner that the attacker ran against the web server?
NMAP Scripting Engine
What was the User Agent of the directory enumeration tool that the attacker used on the web server?
Mozilla/5.0 (Gobuster)
In total, how many requested resources on the web server did the attacker fail to find?
1867
What is the flag under the interesting directory the attacker found?
a76637b62ea99acda12f5859313f539a
WhWhat login page did the attacker discover using the directory enumeration tool?
/admin-login.php
What was the user agent of the brute-force tool that the attacker used on the admin panel?
Mozilla/4.0 (Hydra)
HWhat username:password combination did the attacker use to gain access to the admin page?
admin:thx1138
WWhat flag was included in the file that the attacker uploaded from the admin directory?
THM{ecb012e53a58818cbd17a924769ec447}
What was the first command the attacker ran on the web shell?
quién soy
WhicWhat file location on the web server did the attacker extract database credentials from using Local File Inclusion?
/etc/phpmyadmin/config-db.php
Qué directory did the attacker use to access the database manager?
/phpmyadmin
Look at the file input plugin documentationWhat was the name of the database that the attacker exported?
customer_credit_cards
LoWhat flag does the attacker insert into the database?
c6aa3215a7d519eeb40a660f3b76e64c
Tutorial en vídeo
