all investigations
SOC / Triageeasy
Brute Force at Dawn
At 04:00 UTC our monitoring flagged a spike in failed SSH logins on `web-prod-01`. Review the authentication log excerpt and determine whether the attacker got in — and if so, how.
// evidence
auth.log (excerpt)— Last 20 relevant lines from /var/log/auth.log
Apr 03 04:00:11 web-prod-01 sshd[2211]: Failed password for root from 45.88.13.204 port 51001 ssh2 Apr 03 04:00:12 web-prod-01 sshd[2213]: Failed password for root from 45.88.13.204 port 51004 ssh2 Apr 03 04:00:14 web-prod-01 sshd[2215]: Failed password for admin from 45.88.13.204 port 51010 ssh2 Apr 03 04:00:15 web-prod-01 sshd[2217]: Failed password for admin from 45.88.13.204 port 51013 ssh2 Apr 03 04:00:17 web-prod-01 sshd[2219]: Failed password for deploy from 45.88.13.204 port 51019 ssh2 Apr 03 04:00:19 web-prod-01 sshd[2221]: Failed password for deploy from 45.88.13.204 port 51022 ssh2 ... (1,204 failed attempts from 45.88.13.204 between 04:00 and 04:37) ... Apr 03 04:37:52 web-prod-01 sshd[4102]: Accepted password for deploy from 45.88.13.204 port 60122 ssh2 Apr 03 04:37:52 web-prod-01 sshd[4102]: pam_unix(sshd:session): session opened for user deploy by (uid=0) Apr 03 04:38:20 web-prod-01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/bin/bash Apr 03 04:39:03 web-prod-01 sshd[4102]: pam_unix(sshd:session): session closed for user deploy
// tasks (0/3)
1
What is the source IP address of the attack? · 10 pts
// graded hints — spend XP to unstick
2
Which username did the attacker finally authenticate with? · 15 pts
// graded hints — spend XP to unstick
3
What did the attacker do immediately after logging in to escalate? (one word: the command binary) · 20 pts
// graded hints — spend XP to unstick