started with using elastic search ELK SOC tool in theory and then applied my knowledge with the practical part and had more fun attacking as with the Red team tasks ## KQL : Kibana Query Language **Query/Syntax** **Description** **Example** " " The two quotation marks are used to search for specific values within the documents. Values in quotation marks are used for **exact** searches. "TryHackMe" *The asterisk denotes a wildcard, which searches documents for similar matches to the value provided. United* (would return United Kingdom and United States) OR This logical operator is used to show documents that contain **either** of the values provided. "United Kingdom" OR "England" AND This logical operator is used to show documents that contain **both** values. "Ben" AND "25" : This is used to search the (specified) field of a document for a value, such as an IP address. Note that the field you provide here will depend on the fields available in the index pattern. ip.address: 10.10.10.10 ## File Upload Vulnerabilities File upload vulnerabilities occur when a website doesn't properly handle the files that users upload. If the site doesn't check what kind of file is being uploaded, how big it is, or what it contains, it opens the door to all sorts of attacks. For example: * **RCE**: Uploading a script that the server runs gives the attacker control over it. * **XSS**: Uploading an HTML file that contains an XSS code which will steal a cookie and send it back to the attacker's server. ## What is Remote Code Execution (RCE) Remote code execution (RCE) happens when an attacker finds a way to run their own code on a system. This is a highly dangerous vulnerability because it can allow the attacker to take control of the system, exfiltrate sensitive data, or compromise other connected systems. ## What Is a Web Shell A web shell is a script that attackers upload to a vulnerable server, giving them remote control over it.Once a web shell is in place, attackers can run commands, manipulate files, and essentially use the compromised server as their own. They can even use it to launch attacks on other systems. For example, attackers could use a web shell to: * Execute commands on the server * Move laterally within the network * Download sensitive data or pivot to other services ## Getting practical : ### Red team : on the website `http://frostypines.thm` found the following path `/admin` without a password so I was already in, searched in the main routes found in the navbar and found in the `/add_room` ability to add a room with the ability to add the image to it, since the advent of cyber day 3 is talking about RCE methods I will try to upload a web shell file and gain remote access to the server `shell.php` ```html

&1'); 
    }
?>

``` Wow! upload succeeded regardless of the file type.\ opened one of the images in a new tab `http://frostypines.thm/media/images/rooms/4.jpg` ok here's the path of the assets let's hit the one with the `shell.php` Whoop! we have access to the server: ![flag png](https://res.cloudinary.com/dyhiuslp7/image/upload/v1741393220/RCE_example_e2ibwg.png#w=392&a=center) and here's `flag.txt`. ### blue team : open elastic on discover, between October 3rd between 00 and 23:30\ you will see there are multiple of requests, let's search for the ones that contain the shell file `message : "shell.php"` we will find the attacker used IP address, where's `shell.php`

Blog

Prefer security content?