Learn / Linux Fundamentals / Investigations

Log Detective

challengemedium 45 min · 100 points

First Bit is still up for grabs: be the first to finish this room.

This is a challenge room: no lessons, just evidence and questions. Everything you need is in the log below. If you get stuck, the Navigating the Shell room and a little patience will carry you further than you think.

Task 1 The evidence

It's Monday morning. Over the weekend the monitoring on web01 flagged "unusual sudo activity", and you've been handed this excerpt of /var/log/auth.log from Saturday night.

Work out what happened. Every answer is in the log. When a question asks for a time, use the log's own clock (HH:MM:SS).

Sep 14 02:11:11 web01 sshd[40213]: Accepted publickey for ada from 192.0.2.10 port 51514 ssh2: ED25519 SHA256:q3n0...
Sep 14 02:11:14 web01 sshd[40216]: Failed password for invalid user test from 198.51.100.23 port 40222 ssh2
Sep 14 02:11:18 web01 sshd[40217]: Failed password for invalid user oracle from 198.51.100.23 port 40230 ssh2
Sep 14 02:11:20 web01 sshd[40220]: Failed password for invalid user admin from 203.0.113.45 port 47290 ssh2
Sep 14 02:11:24 web01 sshd[40221]: Failed password for invalid user admin from 203.0.113.45 port 44992 ssh2
Sep 14 02:11:25 web01 sshd[40223]: Failed password for root from 203.0.113.45 port 49634 ssh2
Sep 14 02:11:29 web01 sshd[40225]: Failed password for root from 203.0.113.45 port 49447 ssh2
Sep 14 02:11:33 web01 sshd[40228]: Failed password for root from 203.0.113.45 port 47591 ssh2
Sep 14 02:11:34 web01 sshd[40229]: Failed password for invalid user ubuntu from 203.0.113.45 port 37337 ssh2
Sep 14 02:11:38 web01 sshd[40230]: Failed password for invalid user admin from 203.0.113.45 port 48909 ssh2
Sep 14 02:11:41 web01 sshd[40233]: Failed password for root from 203.0.113.45 port 39143 ssh2
Sep 14 02:11:45 web01 sshd[40234]: Failed password for deploy from 203.0.113.45 port 43327 ssh2
Sep 14 02:11:46 web01 sshd[40235]: Failed password for deploy from 203.0.113.45 port 59956 ssh2
Sep 14 02:11:50 web01 sshd[40237]: Failed password for deploy from 203.0.113.45 port 49472 ssh2
Sep 14 02:11:53 web01 sshd[40240]: Accepted password for deploy from 203.0.113.45 port 51877 ssh2
Sep 14 02:11:54 web01 sshd[40241]: pam_unix(sshd:session): session opened for user deploy(uid=1001) by (uid=0)
Sep 14 02:13:01 web01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/sbin/useradd -m -s /bin/bash sysupdate
Sep 14 02:13:02 web01 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by deploy(uid=1001)
Sep 14 02:13:02 web01 useradd[41377]: new user: name=sysupdate, UID=1002, GID=1002, home=/home/sysupdate, shell=/bin/bash
Sep 14 02:13:17 web01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/sbin/usermod -aG sudo sysupdate
Sep 14 02:13:39 web01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/bash -c echo ZWNobyAnUlp7bDBnc19uM3Yzcl9mMHJnM3R9JyA+IC9kZXYvbnVsbA== | base64 -d | bash
Sep 14 02:15:15 web01 sshd[40243]: Received disconnect from 203.0.113.45 port 51877:11: disconnected by user

Useful habits: read top to bottom once before answering anything; count with care (a tool like grep -c would help on a real box); and when you see a long string of letters, digits, + and / ending in =, you're probably looking at base64, which decodes with base64 -d.

Which IP address carried out the brute-force attack?

How many failed password attempts came from that address?

Which account did the attacker successfully log in to?

At what time did that successful login happen? (HH:MM:SS)

**:**:**

The attacker created a new account to keep access. What is it called?

Which group was the new account added to, giving it admin rights?

Decode the attacker's last command. What flag did they leave behind?

RZ{****_*****_******}