← Back to Writeups
HTBEasySOC/DFIR
Bookmark

Bumblebee

D3v0o0Nu119/2/20265 min read
#soc/dfir#htb#easy

Bumblebee

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

An external contractor has accessed the internal forum here at Forela via the Guest WiFi and they appear to have stolen credentials for the administrative user! We have attached some logs from the forum and a full database dump in sqlite3 format to help you in your investigation.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
—In this challenge, we're given 2 files. A log file and a sqlite3 file.
—To get the username of the external contractor, we can start by accessing the sqlite3 database dump.
—I start by execute query --> SELECT name FROM sqlite_master WHERE type='table';, which resulting to a few results. ...
—Execute this query --> SELECT * FROM phpbb_users; to check all columns and it's value.
—Noticed, there's a username with contractor mail, hence we can identified the external contractor is should be `apool...
—To identify the IP address, we need to just need to check the column value.
—To find the malicious post that the contractor made, we need to enumerate tables in the database and search for post_...
—Long story short, I found one table that should be our interest, the phpbb_posts table.
—Noticed at post_id 9, the poster_ip is the exact same as the contractor's ip.
—Then, analyzing the post_text we can intrepret that the contractor post is indeed malicious.
—I'm SPECULATING that the contractor tried to do XSS to get users's cookie.
—For the URI path, we just need to analyze the malicious content.

Evidence Analysed

  • Tools: strings, sqlite3.
  • Artifacts: sqlite, database, dump.

Detailed Investigation

  1. In this challenge, we're given 2 files. A log file and a sqlite3 file.

1ST QUESTION --> ANS: REDACTED

  1. To get the username of the external contractor, we can start by accessing the sqlite3 database dump.

  2. I start by execute query --> SELECT name FROM sqlite_master WHERE type='table';, which resulting to a few results. But one table_name caught should be our interest.

  3. Execute this query --> SELECT * FROM phpbb_users; to check all columns and it's value.

  4. Noticed, there's a username with contractor mail, hence we can identified the external contractor is should be apoole or apoole1.

2ND QUESTION --> ANS: REDACTED

  1. To identify the IP address, we need to just need to check the column value.

3RD QUESTION --> ANS: REDACTED

  1. To find the malicious post that the contractor made, we need to enumerate tables in the database and search for post_id column.

  2. Long story short, I found one table that should be our interest, the phpbb_posts table.

  3. Noticed at post_id 9, the poster_ip is the exact same as the contractor's ip.

  4. Then, analyzing the post_text we can intrepret that the contractor post is indeed malicious.

I'm SPECULATING that the contractor tried to do XSS to get users's cookie.

4TH QUESTION --> ANS: REDACTED

  1. For the URI path, we just need to analyze the malicious content.

  2. Searching for the attacker's ip address shall gave us the URI path.

Why searching for the attcker's IP?
-> Since I am SPECULATING that the attacker is doing XSS to steal user's cookie, hence the attacker COULD be
reflected the cookie back him.

5TH QUESTION --> ANS: REDACTED

  1. To find the UTC time, I started by analyzing the access.log file but did not find any supporting evidence.
  2. Hence, I started to analyze the phpbb_log table and found a column named log_operation which indicates a successful login attempt for admin role.

6TH QUESTION --> ANS: REDACTED

  1. To get the password name, I just strings the database and grep for "ldap".

7TH QUESTION --> ANS: REDACTED

  1. Simply check the user agent for ip --> 10.255.254.2 because we already identified before that the IP is Forela's.

8TH QUESTION --> ANS: REDACTED

  1. Again, we need to check LOG OPERATION to get the time.

  2. As you can see, after the attacker successfully logged in as admin, he began to add his own user account as part of the admin group.

  3. To identify the timestamp, simply convert the epoch time to UTC.

9TH QUESTION --> ANS: REDACTED

  1. This time, I found the evidence when reviewing the access.log file.

  2. Previously at table phpbb_log we can identify that the attacker attempted to do DB backup, then the timestamp is added at the backup's filename.

  3. At this point, we are VERY sure this is the backup file.

  4. Based from this log's line, we can see a GET request is made, the attacker tried to download the backup file the system previously created.

  5. To get the UTC timestamp, simply substract 12 by 1 because the log's timestamp is +1.

10TH QUESTION --> ANS: REDACTED

  1. Besides the status code, we can see the bytes or lengths for current request.

Findings

  1. Persistence mechanism — As documented in the investigation steps.
  2. Initial access — As documented in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
ExfiltrationExfiltration Over C2 ChannelT1041
Command and ControlIngress Tool TransferT1105

Answers / Flags

  • 1ST QUESTION --> ANS: REDACTED
  • 2ND QUESTION --> ANS: REDACTED
  • 3RD QUESTION --> ANS: REDACTED
  • 4TH QUESTION --> ANS: REDACTED
  • 5TH QUESTION --> ANS: REDACTED
  • 6TH QUESTION --> ANS: REDACTED
  • 7TH QUESTION --> ANS: REDACTED
  • 8TH QUESTION --> ANS: REDACTED
  • 9TH QUESTION --> ANS: REDACTED
  • 10TH QUESTION --> ANS: REDACTED

Lessons Learned

  1. Analyzing sqlite3 file.