【blueteam-ctf-challenges流量取证部分】EscapeRoom Blue Team Challenge

EscapeRoom Blue Team Challenge

这是一道流量分析结合可执行程序木马的逆向题目，难度适中

Q1

What service did the attacker use to gain access to the system?
SSH

Q2

What attack type was used to gain access to the system?(one word)

bruteforce

流量中可以看到有多次ssh连接，所以推测是暴力破解。运行SSH的服务器通常是暴力攻击的软目标

Q3

What was the tool the attacker possibly used to perform this attack?

hydra

搜一搜常见的ssh攻击工具，然后尝试得到是海德拉

Q4

How many failed attempts were there?

52

一共有54个连接ssh的tcp的请求，其中有两个传输的数据较多，所以判断出有两个连接成功，所以有52个失败了

Q5

What credentials (username:password) were used to gain access? Refer to shadow.log and sudoers.log.

manager:forgot

直接解hash就可以了，然后看哪些有root权限

Q6

What other credentials (username:password) could have been used to gain access also have SUDO privileges? Refer to shadow.log and sudoers.log.

和第五题一样，剩下几个跑不出密码

sean:spectre

Q7

What is the tool used to download malicious files on the system?

wget

这个是攻击机，后面是上传马的过程
wget下载的

Q8

How many files the attacker download to perform malware installation?

3

用networkminer分析一下文件，发现上传了3个elf
最后一个伪装了html

Q9

What is the main malware MD5 hash?

772b620736b760c1d736b1e6ba2f885b

可以看出来执行命令的内容，判断出1是主要的马，添加了+x权限，用networkminer可以查看md5

Q10

What file has the script modified so the malware will start upon reboot?

/etc/rc.local

GPT分析法

第3行说明了自动启动的程序

Q11

Where did the malware keep local files?

/var/mail/

将文件1移动到了/var/mail/mail，所以文件在/var/mail/

Q12

What is missing from ps.log?

/var/mail/mail

前面可以知道mail会运行，但是在ps中没有他

Q13

What is the main file that used to remove this information from ps.log?

sysmod.ko

还是代码分析，可以看出来利用sysmod.ko，将mail程序隐藏了

Q14

Inside the Main function, what is the function that causes requests to those servers?

requestFile

开始逆向一下1.html，先查壳，发现有upx壳

利用**upx -d 1.html **脱壳
用ida查看，发现好多函数，看到requestfile有点像访问的函数，F5点进去看一下

发现是wget的脚本，所以可以确定是这个函数

一个简单的逆向

Q15

One of the IP’s the malware contacted starts with 17. Provide the full IP.

174.129.57.253

直接梭哈

Q16

How many files the malware requested from external servers?

9

一共13个文件，三个elf，剩下9个都是上传的图片马

Q17

What are the commands that the malware was receiving from attacker servers? Format: comma-separated in alphabetical order

Nop,Run

最后这个有回到了前面的逆向，要找到返回执行的命令

查看这个函数，看着像是要找的函数（message嘛


里面都是文件读取啥的

没有发现啥，看另一个函数

然后将上面判断的编码改为char

fwrite函数输出了a1