Timeline of an incident
Yesterday we reported 203.0.113.77; today Il Forno Veloce discovers that data has left the server. Rebuild the timeline across auth.log and access.log: at what exact time did the attacker GET IN for the first time after the failed attempts? Reports are named after the time of the event.
Lab 3 of 6 in the Blue Team / Defense path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 120 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Follow the attacker in the SSH log (grep the address) (80 XP)
- Isolate the successful logins (Accepted) (100 XP)
- See what it did on the site (access.log) (100 XP)
- Decode the report for the right time (120 XP)
Topics: defense, log, incidente, cronologia.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.grep: finds the lines that contain a word, even across whole folders with -r. It is the main tool for analysing text and logs.ls: lists the files in a folder; with -l it shows permissions and owners, with -a hidden files too. It is the first command on any machine.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Reconstructing an incident means lining up the facts: site scan, burst of wrong passwords, first successful login, commands run, data downloaded. A grep on a single address and a second grep on 'Accepted' isolate the moment of entry; cross-checking access.log shows what was touched. For the picture to be reliable, server clocks must be synchronised (NTP) and logs kept elsewhere too. Defense: an alert when a success follows many failures, keys instead of passwords, least privilege for the service account, and database credentials out of reach of ordinary users.
Before and after this lab
To unlock it you must have solved:
- Who keeps pushing? (Blue Team / Defense, medium)
After this lab you can move on to:
- Responding to an incident (Blue Team / Defense, hard)
The Blue Team / Defense path
Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.