Learn / Linux Fundamentals / Investigations

Live Log Detective

challengemedium 45 min · 100 points

First Bit is still up for grabs: be the first to finish this room.

The static Log Detective handed you a copy of the log. This time you get the server itself: web01, a small web server that was broken into on the night of 21 September. Its logs are still on disk, and the attacker left something behind.

This is a challenge room with a live lab. Press Launch in CybRange, then open the terminal on your attack box. Everything else happens from there.

CYB//RANGE Live lab

Task 1 Get on the box

Your attack box and web01 sit on their own private network, and nothing else can reach it. web01 is at 10.66.0.10. The company gave you an analyst account:

user: analyst
password: case-file-2026

From your attack box's terminal:

ssh [email protected]

Type yes the first time it asks about the host key, then the password. You'll know you're in when the prompt changes.

If long lines wrap oddly in the attack box's terminal, type resize there once.

What is the server's hostname?

Task 2 Read the evidence

On Debian, SSH logins and sudo commands are recorded in /var/log/auth.log. As analyst you can read it (you're in the adm group).

Useful commands:

less /var/log/auth.log reads it a page at a time (q quits, /word searches).
grep 'Failed password' /var/log/auth.log shows only the failed logins.
grep 'Accepted' /var/log/auth.log shows the logins that worked.
grep 'COMMAND=' /var/log/auth.log shows what people ran with sudo.

Which IP address carried out the brute-force attack?

How many failed password attempts came from that address?

Which account did the attacker get into?

At what time did that successful login happen? (HH:MM:SS)

**:**:**

The attacker created an account to keep access. What is it called?

Task 3 Follow the trail

Once in, the attacker used sudo to run a few commands. The last one was hidden: they encoded it in base64 so that a casual look at the log wouldn't show what it did.

Decode it, work out what file it created, and read that file. Its folders don't allow listing, so tools like ls and find won't help: you need the exact path the attacker used.

The attacker's last command left a file on this server. What flag is in it?

RZ{************************}