2024 HITCON Cyber Range 學生場 Writeup

Table of Contents

在來之前完全沒摸過藍隊，但就是秉持著我是來學習的精神(X
就是沒有參加初賽的快樂學生，AIS3讚!
從開始說明規則之後就完全茫掉了
跟題目乾瞪眼到中午之後才大概知道要怎麼做，才開始瘋狂解題。
~~但解到後面之後發現可以善用刪去法、條件、跟答案爆破~~

環境介紹 #

大概長這樣但我沒很懂(~~資網重修~~

然後會像這樣有題目要填找到的答案

全對才有分，錯了會有禁答懲罰(最多3分鐘)，但會告訴你哪個錯

所以可以把可能答案填一填，說不定就矇對了(X

Log Viewer像這樣，要學一下怎麼用，是splunk的

Digital Storm (+50 pts) #

Our intrusion detection system has flagged unusual network activity indicative of automated scanning tools. The scans appear to be systematically probing our network for vulnerabilities.
Investigate this incident and determine the nature and extent of the scanning activity.

有人在做壞壞的掃描
Apache Log打開就看的到

所以

Web Intrusion (+100 pts) #

After automated scanning, a targeted attack was detected.
An attacker exploited a vulnerability in our web server to gain unauthorized access to the system.

那個壞壞的人掃描完，就在web幹壞事
設定status 200 找他有存取成功的指令
在看到第6頁的時候發現他掃描完開始幹大事了，看來就是這裡

綜合在Apache log首頁看到的version資訊

問題是這是哪個CVE
2.4.58其實版本蠻新的，||，加上大哥的場外救援||加上這是Hitcon 2024 Cyber Range
只能是橘神啦

Config Raid (+50 pts) #

Our security monitoring system flagged suspicious activity on a critical server, including unexpected account usage followed by unusual file access.
Sensitive configuration files appear to have been accessed and downloaded. Investigate this incident and provide details about the timing and destination of the data movement.

他web shell完開始偷東西了!
綜合題目說的意外的帳戶使用

試了一下這個就成功了

VPN interfusion (+50 pts) #

Following the web server breach, the attacker discovered VPN credentials in the stolen configuration files.
These credentials were then used to establish an unauthorized VPN connection.

這隊友寫的

Internal Recon (+75 pts) #

After gaining unauthorized VPN access, the attacker initiated an internal network scan.
Detect and analyze this scanning activity to understand the attacker’s reconnaissance efforts within our network.

也是神隊友