Meerkat

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

As a fast growing startup, Forela have been utilising a business management platform. Unfortunately our documentation is scarce and our administrators aren't the most security aware. As our new security provider we'd like you to take a look at some PCAP and log data we have exported to confirm if we have (or have not) been compromised.

Key Questions

1. What indicators of compromise exist?
2. What attack chain / MITRE techniques were used?
3. What is the full timeline?

Investigation Timeline

Evidence Analysed

• Tools: wireshark, wget, ssh.
• Artifacts: PCAP, pcap.

Detailed Investigation

1. In this challenge we're given two files.

1ST QUESTION --> ANS : REDACTED

1. To answer it, I started by analyzing the .pcap file.

2. Found out that there are several request with POST method to 172.31.6.44. The endpoint is /bonita/loginservice.

3. Searching for Bonita at the .json file, shall resulting to Bonitasoft. Great now we know the ans is Bonitasoft.

2ND QUESTION --> ANS: REDACTED

1. Continue analyzing the logs, noticed several response with status code 401 which indicates unauthorized access.

2. I tried to follow few of them and found several different creds used.

3. If you noticed, the mail which used as the username always ends with .forela.co.uk. This indicates a company email.

4. Remembering status code is 401 for both (actually more), it means the attacker is bruteforcing.

5. The passwords also seem to be specific (?) and few of them seem to be complicated.

6. This kind of attacks is called Credential Stuffing.

3RD QUESTION --> ANS: REDACTED

1. Searching for keyword CVE at the .json file shall found the answer for this.

4TH QUESTION --> ANS: REDACTED

1. Reading the CVE documentation, shall found a statement that the attacker is appending ;i18ntranslation or /../i18ntranslation/ to the end of an URL.

5TH QUESTION --> ANS: REDACTED

1. To get the answer, a filter command is needed for quick analyze.

2. Simply execute --> urlencoded-form.key == "username".

3. To see the username value, luckily wireshark allows us to do custom columns.

4. Hence we can create a custom column --> edit -> preferences -> columns, then set the column type to custom.

5. Next, to modify the column, right click at the column area then choose edit column and set the fields to --> urlencoded-form.value.

6. Noticed at the bottom right it states 118 data displayed.

7. Scrolling down the packets, noticed several packets which unnecesarry is included.

8. Hence let's add another filter which denied install.

9. Filter command --> urlencoded-form.key == "username" && !(http contains "install").

10. Now it shows 59 but there are still duplicated username.

11. Hence the answer is 59 - 3 --> 56.

6TH QUESTION --> ANS: REDACTED

1. To answer this, we can filter the response which status code is below 300. Filter command --> http.response.code < 300.

2. After analyzing each log, seems only the packets with status code 204 which is a response of the login request. 204 indicates the server has successfully fulfilled the request and that there is no additional content to send in the response payload body.

7TH QUESTION --> ANS: REDACTED

1. To answer this, we can simply filter the packet using --> http.request.method.

8TH QUESTION --> ANS: REDACTED

1. To get the hash, we need to export the objects of our previous packet.

2. Running file command it states that the exported objects is a JSON data.

3. Reading it shall found the endpoint of the script used by hacker, run wget shall download the script.

4. To get the md5checksum simply run md5sum.

9TH QUESTION --> ANS: REDACTED

1. Accessing the pastes.io shall resulting to this:

2. Based from the bash script, we can identified that hffgra4unv contains the public key.

3. Simply wget it then get the md5sum.

10TH QUESTION --> ANS: REDACTED

1. The answer is the destination of the public key.

11TH QUESTION --> ANS: REDACTED

1. Searching ssh shall resulting to these:

2. The first one should be our interest.

3. It discussed the same method used by the attacker.

Findings

1. Persistence mechanism — As documented in the investigation steps.
2. Initial access — The threat actor established access via the vector described in the investigation steps.
3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

Answers / Flags

• 1ST QUESTION --> ANS : REDACTED
• 2ND QUESTION --> ANS: REDACTED
• 3RD QUESTION --> ANS: REDACTED
• 4TH QUESTION --> ANS: REDACTED
• 5TH QUESTION --> ANS: REDACTED
• 6TH QUESTION --> ANS: REDACTED
• 7TH QUESTION --> ANS: REDACTED
• 8TH QUESTION --> ANS: REDACTED
• 9TH QUESTION --> ANS: REDACTED
• 10TH QUESTION --> ANS: REDACTED
• 11TH QUESTION --> ANS: REDACTED

Lessons Learned

1. Identifying Credential Stuffing attacks.
2. Bonitasoft CVE.
3. Packet filtering and custom column value.