CyberDefenders: GitTheGate blueteam challenge.

GitTheGate

SHA1SUM	a9a8ad28b3b90b9d5adaa7ddb44ec3b1dc8e6dce
Published	Oct. 14, 2020
Author	0ldMate
Size	3.8 GB
Tags	Kibana ELK SIEM elastic

Instructions	Unzip the VM (pass: cyberdefenders.org) Virtualbox: Start the VM and access Kibana from the host machine via http://127.0.0.1:5601 VMware: login to the VM using vagrant/vagrant and grab the IP address of the VM using "ip address" command. Access Kibana from the host machine using the IP address assigned to the VM via http://x.x.x.x:5601 Challenge Files: GitTheGate.ova (Memory: 4 GB, CPU: 2 Cores, Disk: 13.8 GB). Make sure to change the default timezone in Kibana to UTC

Your progress

0% Completed0/31 Questions

Your score

0/2550

SIEM Case Investigation

Last solve

Description:

An introductory ELK challenge to get you started with Kibana.

Scenario:

Overnight we've had an attack on our network, we have two devices in the cloud and it appears both have been compromised.

The attack appears to have taken place on the 25th of May between 9am and 11:30am. Our network is composed of one box that is front facing with an SSH port open to the web and a second server behind it running an old Elastic Stack. Please recover the information requested in these challenges so we can piece together what happened.

Thanks, OussHr and th3c0rt3x for reveweing the challenge.

#	Question	Weight	Solved
#1	Using the "View Surrounding Documents" option, find the ID of the document that is 14 documents after the id GDQOB3IBwJHf9VOW-r0Y?	50	87
Hint Report an issue

#2	Using the "View Surrounding Documents" option, find the ip of the document that is 16 documents before the id vDQOB3IBwJHf9VOW-Lyd?	50	83
Hint Report an issue

#3	How many requests have come from the IP address 2.49.53.218 between the 6th of May and the 13th of May? (time is in UTC)	50	104
Hint Report an issue

#4	What percentage of logs are from windows 8 machines on the 11th of May? (time is in UTC)	50	72
Hint Report an issue

#5	How many 503 errors were there on the 8th of May? (time is in UTC)	50	99
Hint Report an issue

#6	How many connections to the host "www.elastic.co" were made on the 12th of May? (time is in UTC)	50	91
Hint Report an issue

#7	What is the second most common extension of files being accessed on the 12th of May? (time is in UTC)	50	90
Hint Report an issue

#8	Find the first IP address to connect to the host elastic-elastic-elastic.org on the 12th of May. (time is in UTC)	50	91
Hint Report an issue

#9	What was the username used that failed to log in on the 15th of May at 10:44 pm? (time is in UTC)	50	74
Hint Report an issue

#10	What's the host machine's hostname?	50	78
Hint Report an issue

#11	Using current data, what version of the stack is running?	50	83
Hint Report an issue

#12	Using current data in the auditbeat index, what is the name of the elasticsearch node? (one word)	50	50
Hint Report an issue

#13	What is the name of the beat to collect windows logs? (one word)	50	76
Hint Report an issue

#14	What is the name of the beat that sends network data? (one word)	50	74
Hint Report an issue

#16	How many fields are in the auditbeat-* index pattern?	50	62
Hint Report an issue

#17	On the 14th of May, how many failed authentication attempts did the host server receive? (time is in UTC)	100	60
Hint Report an issue

#18	On the 13th and 14th of May, how many bytes were received by the source IP 159.89.203.214 (time is in UTC)	100	51
Hint Report an issue

#19	What username did they crack?	100	55
Hint Report an issue

#20	What host was attacked?	100	53
Hint Report an issue

#21	How many were failed attempts made on the machine?	100	45
Hint Report an issue

#22	What time was the last failed attempted login?	100	46
Hint Report an issue

#23	What time did the attacker successfully login?	100	45
Hint Report an issue

#24	What is the first command the attacker ran on the box?	100	47
Hint Report an issue

#25	What tool did the attacker use to get the exploit onto the machine?	100	53
Hint Report an issue

#26	Shortly after getting the exploit on the machine, the attacker used vim to create a file. What is the name of that file?	100	48
Hint Report an issue

#27	What is the filename of the exploit that was run?	100	50
Hint Report an issue

#28	What is the first ID of the log that shows the exploit being run?	100	29
Hint Report an issue

#29	What parameter turned the script from testing to exploiting?	150	44
Hint Report an issue

#30	Using filebeat data - What IP was the shell sent to?	150	43
Hint Report an issue

#31	Using filebeat data - After running the exploit, they accessed the /etc/passwd file, what is the ID of the doc that shows this?	150	30
Hint Report an issue

#32	Using filebeat data - We think they created a new user. What was the name of that user?	150	32
Hint Report an issue