← Back to Writeups
HTBEasySOC/DFIR
Bookmark

Ultimatum

D3v0o0Nu119/2/20266 min read
#soc/dfir#htb#easy

Ultimatum

Platform: HackTheBox | Type: SOC/DFIR | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Scenario

One of the Forela WordPress servers was a target of notorious Threat Actors (TA). The website was running a blog dedicated to the Forela Social Club, where Forela employees can chat and discuss random topics. Unfortunately, it became a target of a threat group. The SOC team believe this was due to the blog running a vulnerable plugin. The IT admin already followed the acquisition playbook and triaged the server for the security team. Ultimately (no pun intended) it is your responsibility to investigate the incident. Step in and confirm the culprits behind the attack and restore this important service within the Forela environment.

Key Questions

  1. What indicators of compromise exist?
  2. What attack chain / MITRE techniques were used?
  3. What is the full timeline?

Investigation Timeline

TimeEventEvidence / Source
09:01:04After reviewing it, indeed an error happened at timestamp 09:01:04 right after the file is edited at 09:00:51.

Evidence Analysed

  • Tools: wpscan, linpeas, linenum.
  • Artifacts: MFT.

Detailed Investigation

  1. This time we're tasked to investigate an incident from Forela WordPress Servers. It is known that the server running a website with a vulnerable plugin. We're asked to hunt and confirm the culprits and restore the service.
  2. Based from the acquisition performed, it is clear that the IT admin team is using a Linux acquisition tool named CatScale.

1ST QUESTION --> ANS: REDACTED

  1. To identify fingerprinting activity, we can review log at Logs directory.

  2. Our interest should be log inside --> ip-172-31-11-131-20230808-0937-var-log.tar.gz.

  3. Upon extracting it, found several Apache directory which indicates a web server log. Great!

  4. Upon reviewing the log, found the scanning tool used by the attacker and it's version.

  5. It's WPScan version 3.8.24.

2ND QUESTION --> ANS: REDACTED

  1. It's not efficient to review the log using text editor. It's best to integrate it with ELK stack or other tools which help user in collect and visualize data.

  2. Anyway, long story short found an agent named Secragon Offensive.

  3. Search it on the internet, resulting to few CVEs POC.

  4. Both POC states the same objective --> to be authorized for admin access.

  5. Also noticed a plugin is used previously. This could be a hint to our CVE version guess.

  6. Searching about CVE related to the plugin, resulting to same CVE version we found before.

  7. Reviewing the first website, seems it matched our finding. Actually our finding itself is not enough to identify wheter we found the correct CVE.

  8. For better analysis, another artifacts and further correlation is needed, but I am just too lazy to do it.

  9. Reviewing another log file named --> access.log.1 found different plugin version used. But this match the CVE details we read before.

NOTES:

The plugin does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing
attackers to create administrator accounts at will. This is actively being exploited in the wild.

  1. Another outsource found WPScan documentation that shows convincing details.

  2. Remembering the very first log we analyzed is identified using version 2.6.4. We can tell that we already find the correct CVE version!

  3. As you can see afterwards the plugin is accessed, the threat actor can access the admin resource. The threat actor IP is 198.16.74.45.

  4. Interesting it is a public cloud IP, this could indicates that the attacker manually explored the website after logging in.

3RD QUESTION --> ANS: REDACTED

  1. Now to identify the real threat actor IP, we need to find the initial access OR the easiest way simply by check the IP used for the scanning activity.

  2. Great! Now we know the real threat actor IP is 23.106.60.163.

4TH QUESTION --> ANS: REDACTED

  1. To identify backdoor user, simply search the attempt to register account after the exploitation attempt.

  2. Great! Now we know the backdoor user is secragon.

5TH QUESTION --> ANS: REDACTED

  1. Noticed after it gained access to admin resource, the attacker IP changed to the public cloud IP --> 198.16.74.45.

6TH QUESTION --> ANS: REDACTED

  1. Long story short, found a suspicious file access inside the admin resource. It's a php file named hidden-comments.

  2. It's because afterwards, a shell execution is attempted.

  3. More interestingly, the plugin used is a plugin that can upload, edit, create, and remove theme files.

  4. It's very straight forward that hidden-comments.php is a theme file that used for persistence.

  5. Anyway let's correlate with error.log, remembering it's a source file which edited and it's human activity, hence an error could happen during the code writing.

  6. After reviewing it, indeed an error happened at timestamp 09:01:04 right after the file is edited at 09:00:51.

error.log

access.log

  1. Remembering no other theme files opened, hence it's clear that hidden-comments.php is the backdoor file.
  2. For the full path can be seen at the error.log.

7TH QUESTION --> ANS: REDACTED

  1. Now to review the code of it, we need to traverse to Misc -> ip-172-31-11-131-20230808-0937-pot-webshell-first-1000.txt.

  2. Then search for --> hidden-comments.php.

  3. $shell variable contains uname -a; w; id; /bin/bash -i

  4. Shortly those commands are for gather system information and user details by printig the systems's kernel version and arch.

  5. Also shows logged-in user and their activities, and displaying current user's UID, GID, and groups.

  6. Lastly it launch an interactive shell.

8TH QUESTION --> ANS:

REDACTED 41. It looks like contain a master file table of the OS.

ip-172-31-11-131-20230808-0937-full-timeline.csv

  1. Great! Now we know the size is 2592.

9TH QUESTION --> ANS: REDACTED

  1. To identify the C2 IP and port, simply check the reverse shell payload and check the ip and port variable.

10TH QUESTION --> ANS: REDACTED

  1. Next, to identify the process ID which enabled the threat actor to gain hands-on access to the server, we need to review the Process and Network logs.

  2. Our interest should be the process of opening shell as interactive mode.

  3. Great! Now we know the PID is 234521.

11TH QUESTION --> ANS: REDACTED

  1. A common tool used to enumerate for privesc path at Linux should be linpeas or linenum.

  2. To identify the existence of those files, simply review the Misc logs.

  3. Actually we can check the MFT and search for both file.

  4. Searching it resulting to the existence of linenum.sh.

  5. Great! Now we've investigated the case!

Findings

  1. Persistence mechanism — An autostart/persistence mechanism was established on the host (see timeline).
  2. Initial access — The threat actor established access via the vector described in the investigation steps.
  3. Impact — As documented in the investigation steps.

MITRE ATT&CK Mapping

TacticTechniqueID
Lateral MovementRemote ServicesT1021
PersistenceBoot or Logon Autostart ExecutionT1547
Privilege EscalationAbuse Elevation Control MechanismT1548

Answers / Flags

  • 1ST QUESTION --> ANS: REDACTED
  • 2ND QUESTION --> ANS: REDACTED
  • 3RD QUESTION --> ANS: REDACTED
  • 4TH QUESTION --> ANS: REDACTED
  • 5TH QUESTION --> ANS: REDACTED
  • 6TH QUESTION --> ANS: REDACTED
  • 7TH QUESTION --> ANS: REDACTED
  • 8TH QUESTION --> ANS:REDACTED
  • 9TH QUESTION --> ANS: REDACTED
  • 10TH QUESTION --> ANS: REDACTED
  • 11TH QUESTION --> ANS: REDACTED

Lessons Learned

  1. Reviewing catscale data acquisition.
  2. Identify CVE version related to ultimate-member plugin.
  3. Identify backdoor user and persistence activity.