Brutus

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

In this very easy Sherlock, you will familiarize yourself with Unix auth.log and wtmp logs. We'll explore a scenario where a Confluence server was brute-forced via its SSH service. After gaining access to the server, the attacker performed additional activities, which we can track using auth.log. Although auth.log is primarily used for brute-force analysis, we will delve into the full potential of this artifact in our investigation, including aspects of privilege escalation, persistence, and even some visibility into command execution.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: curl.
• Artifacts: auth.log, wtmp.

Detailed Investigation

1. In this task we're given a unix auth.log and wtmp logs.

Notes:

WTMP is a system log file in Unix and Unix-like operating systems. The wtmp file records all user logins and logouts.
It's located in the /var/log directory in most Unix systems.

1ST QUESTION --> ANS: REDACTED

1. Upon reviewing the log traffic, we can identify 2 IPs. Those are 203.101.190.9 and 65.2.161.68.

2. Noticed the first IP tried to login as root and is authenticated at 06:19:54. It's only 1 attempt, could means a normal user or the rightful owner of the account.

3. For the second IP, it tried few attempts to login as admin(?) from 06:31:31.

4. Checking for the IP's reputation, found it's marked as suspicious but not marked as abuse IP.

5. However the IP resulting in massive failed login attempt which leads to a security concern. Hence can be marked as the suspect.

2ND QUESTION --> ANS: REDACTED

1. Further analysis, found the initial attempt from the suspect IP for root account login.
2. Noticed, after several bruteforce attempts, the suspect finally authenticated as root at 06:31:40 then logout again not long.

3RD QUESTION --> ANS: REDACTED

1. To identify the initial manual entry is quite tricky. If we analyze further, we shall identified that the attacker did a manual login to root user at 06:32:44.

2. However, the 06:32:44 is the timestamp for the attempt for successfull login.

3. So the timestamp for the account's access should be at 06:32:45.

4TH QUESTION --> ANS: REDACTED

1. After the attacker did a manual login to the root account, a new session number is created. It's 37.

5TH QUESTION --> ANS: REDACTED

1. For the lateral movement, the attacker created a new user and new group named cyberjunkie.
2. Then the attacker also add cyberjunkie to the sudo group so it can execute sudo permissions or open any files that requires sudo.

6TH QUESTION --> ANS: REDACTED

1. Searching on the internet about MITRE ATT&CK, we can identify that persistence has several tech and sub tech.

2. Judging from what the attacker did, the correct one should be the Create Account technique with Local Account as it's sub-technique.

7TH QUESTION --> ANS: REDACTED

1. Upon reviewing the wtmp log file, we're sure that the attacker's session for the root account is destroyed at 06:37 (UTC+8).

2. To identify the second time, review the auth.log which states remove session or close session.

3. Then to calculate the session should be a cumulative time from:

06:32:45 - 06:37:24 --> 279 seconds.

8TH QUESTION --> ANS: REDACTED

1. Furthermore the attacker logged in to the server as cyberjunkie and executed sudo command at 06:39:38.

Findings

1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS: REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Reviewing UNIX auth.log.
2. Identifying the suspect's IP.
3. Identify the timestamp for initial manual account logged in / manual entry.
4. Reviewing wtmp log file.