CyberDefenders: BlueTeam CTF Challenges

Hammered

SHA1SUM	c5282824e485cbafe4b13a942759fd6720433929
Published	Oct. 25, 2020
Author	The Honeynet Project
Size	944 KB
Tags	Log Analysis Honeypot Apache2 WebServer

Instructions	Unzip the challenge (pass: cyberdefenders.org), analyze logs, and find the answers. Challenge files: kern.log auth.log daemon.log dmesg apache2

Your progress

0% Completed0/12 Questions

Your score

0/1200

Log Analysis

Last solve

1 day ago by nalim

This challenge takes you into the world of virtual systems and confusing log data. In this challenge, figure out what happened to this webserver honeypot using the logs from a possibly compromised server.

Thanks, th3c0rt3x for reviewing the challenge.

#	Question	Weight	Solved
#1	Which service did the attackers use to gain access to the system?	50	727
Hint Report an issue

#2	What is the operating system version of the targeted system? (one word)	50	666
Hint Report an issue

#3	What is the name of the compromised account?	50	695
Hint Report an issue

#4	Consider that each unique IP represents a different attacker. How many attackers were able to get access to the system?	50	563
Hint Report an issue

#5	Which attacker's IP address successfully logged into the system the most number of times?	100	551
Hint Report an issue

#6	How many requests were sent to the Apache Server?	100	536
Hint Report an issue

#7	How many rules have been added to the firewall?	100	538
Hint Report an issue

#8	One of the downloaded files to the target system is a scanning tool. Provide the tool name.	100	539
Hint Report an issue

#9	When was the last login from the attacker with IP 219.150.161.20? Format: MM/DD/YYYY HH:MM:SS AM	100	468
Hint Report an issue

#10	The database displayed two warning messages, provide the most important and dangerous one.	150	497
Hint Report an issue

#11	Multiple accounts were created on the target system. Which one was created on Apr 26 04:43:15?	150	525
Hint Report an issue

#12	Few attackers were using a proxy to run their scans. What is the corresponding user-agent used by this proxy?	200	490
Hint Report an issue

Submit Writeup