CyberDefenders: BlueTeam CTF Challenges

Hammered

SHA1SUM	c5282824e485cbafe4b13a942759fd6720433929
Published	Oct. 25, 2020
Author	The Honeynet Project
Size	944 KB
Tags	Log Analysis Honeypot Apache2 WebServer

Instructions	Unzip the challenge (pass: cyberdefenders.org), analyze logs, and find the answers. Challenge files: kern.log auth.log daemon.log dmesg apache2

Your progress

0% Completed0/12 Questions

Your score

0/1200

Digital Forensics

Last solve

today by thienphi148

This challenge takes you into the world of virtual systems and confusing log data. In this challenge, figure out what happened to this webserver honeypot using the logs from a possibly compromised server.

Thanks, th3c0rt3x for reviewing the challenge.

#	Question	Weight	Solved
#1	Which service did the attackers use to gain access to the system?	50	835
Hint Report an issue

#2	What is the operating system version of the targeted system? (one word)	50	773
Hint Report an issue

#3	What is the name of the compromised account?	50	802
Hint Report an issue

#4	Consider that each unique IP represents a different attacker. How many attackers were able to get access to the system?	50	657
Hint Report an issue

#5	Which attacker's IP address successfully logged into the system the most number of times?	100	647
Hint Report an issue

#6	How many requests were sent to the Apache Server?	100	628
Hint Report an issue

#7	How many rules have been added to the firewall?	100	630
Hint Report an issue

#8	One of the downloaded files to the target system is a scanning tool. Provide the tool name.	100	629
Hint Report an issue

#9	When was the last login from the attacker with IP 219.150.161.20? Format: MM/DD/YYYY HH:MM:SS AM	100	554
Hint Report an issue

#10	The database displayed two warning messages, provide the most important and dangerous one.	150	585
Hint Report an issue

#11	Multiple accounts were created on the target system. Which one was created on Apr 26 04:43:15?	150	613
Hint Report an issue

#12	Few attackers were using a proxy to run their scans. What is the corresponding user-agent used by this proxy?	200	573
Hint Report an issue

Submit Writeup