Bitrixxx

Platform: taipanbyte | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: data_exfiltration_detection, hex_decoding, ip_frequency_analysis, log_analysis

Summary

Task: Analyze Bitrix CMS access log (10,000 lines) to find hidden flag. Solution: IP frequency analysis revealed anomalous IP with 31 requests containing hex-encoded characters in char= parameter; decoding hex values extracted the flag.

Bitrixxx — TaipanByte

Description

Given a Bitrix CMS access log file (bitrix_access.log) — 10,000 lines in standard Apache combined log format. Need to analyze the logs and find the flag.

Analysis

Reconnaissance

• Format: standard Apache combined log
• Time range: January 15, 2024
• 17 unique IP addresses
• Direct flag search (TB{}, FLAG{}, ctf{}) — nothing found
• Search for typical attacks (SQLi, LFI, command injection, base64, eval) — nothing found
• Conclusion: flag is encoded/hidden within the log data itself ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Anomaly Detection

Analysis of unique URLs revealed suspicious requests:

/bitrix/tools/upload.php?action=write&char=XX

where XX are hex values. These requests stood out sharply against normal Bitrix CMS traffic (CSS, scripts, OAuth endpoints).

Attacker Identification

IP address frequency analysis:

• Most IPs: ~600–674 requests each
• IP 185.14.30.22: only 31 requests — all to upload.php with char= parameter

This IP is the attacker performing character-by-character data exfiltration. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Download and analyze the log

 bash read-only • copy allowed Copy
# Unique URLs — notice the action=write&char= pattern
awk '{print $7}' bitrix_access.log | sort -u

2. IP frequency analysis

 bash read-only • copy allowed Copy
# Find the anomalous IP with 31 requests
awk '{print $1}' bitrix_access.log | sort | uniq -c | sort -rn

Result:

 674 203.0.113.45
 665 198.51.100.12
 ...
  31 185.14.30.22      ← anomaly!

3. Extract and decode the flag

 bash read-only • copy allowed Copy
# Sort requests by time, extract hex values, decode
grep "action=write&char=" bitrix_access.log | sort -t'[' -k2 | \
  sed 's/.*char=\([0-9a-f]*\).*/\1/' | \
  while read hex; do printf "\\x$hex"; done

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

31 requests from 21:33:35 to 21:34:35 (every 2 seconds) contained hex values:

54 42 7b 31 5f 48 40 74 65 5f 42 31 74 72 69 78
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 7d

Decoding hex → ASCII:

TB{REDACTED}

Log Analysis Methodology