GitTheGate Lab
Last updated
Last updated
Q1) Using the "View Surrounding Documents" option, find the ID of the document that is 14 documents before (older) the id GDQOB3IBwJHf9VOW-r0Y?
_id: GDQOB3IBwJHf9VOW-r0Y
Answer: tzQOB3IBwJHf9VOW-Lyd
Q2) Using the "View Surrounding Documents" option, find the IP of the document that is 16 documents after (newer) the id vDQOB3IBwJHf9VOW-Lyd?
Answer: 191.189.39.130
Q3) How many requests have come from the IP address 2.49.53.218 between the 6th of May and the 13th of May? (time is in UTC)
ip: 2.49.53.218
Answer: 7
Q4) What percentage of logs are from windows 8 machines on the 11th of May? (time is in UTC)
Answer: 21.74%
Q5) How many 503 errors were there on the 8th of May? (time is in UTC)
response: 503Answer: 8
Q6) How many connections to the host "www.elastic.co" were made on the 12th of May? (time is in UTC)
host: www.elastic.coAnswer: 82
Q7) What is the second most common extension of files being accessed on the 12th of May? (time is in UTC)
Answer: .gz
Q8) Find the first IP address to connect to the host elastic-elastic-elastic.org on the 12th of May. (time is in UTC)
host: "elastic-elastic-elastic.org"Answer: 114.246.225.218
Q9) What was the username used that failed to log in on the 15th of May at 10:44 pm? (time is in UTC)
event.type: "authentication_failure"Answer: deploy
Q10) According to the logs, which vulnerable version of Kibana was identified as running in the stack?
Answer: 7.6.2
Q11) Using current data in the auditbeat index, what is the name of the elasticsearch node? (one word)
Answer: elkstack
Q12) What is the name of the beat to collect windows logs? (one word)
Answer: winlogbeat
Q13) What is the name of the beat that sends network data? (one word)
Answer: packetbeat
Q14) How many fields are in the auditbeat-* index pattern?
Answer: 437
Q15) On the 14th of May, how many failed authentication attempts did the host server receive? (time is in UTC)
event.type: authentication_failureAnswer: 762
Q16) On the 13th and 14th of May, how many bytes were received by the source IP 159.89.203.214 (time is in UTC)
source.ip: "159.89.203.214"Answer: 492,919
Q17) What username did they crack?
event.type: 'authentication_success'event.type: 'authentication_failure'Answer: johnny
Q18) What host was attacked?
Answer: sshbox
Q19) How many were failed attempts made on the machine?
event.type: 'authentication_failure'Answer: 12523
Q20) What time was the last failed attempted login?
event.type: 'authentication_failure' and host.name: 'sshbox'Answer: 11:39:31
Q21) What time did the attacker successfully login?
Based on the scenario, the attack is believed to have occurred on May 25th between 9:00 AM and 11:30 AM.
Answer: 11:50:13
Q22) What tool did the attacker use to get the exploit onto the machine?
Answer: git
Q23) Shortly after getting the exploit on the machine, the attacker used vim to create a file. What is the name of that file?
Answer: ElasticCTFisFun!
Q24) What is the filename of the exploit that was run?
Answer: CVE-2019-7609-kibana-rce.py
Q25) What is the first ID of the log that shows the exploit being run?
agent.hostname:"sshbox" and *CVE-2019-7609-kibana-rce.py*Answer: _SHbS3IBCEolQs9lAD3z
Q26) What parameter turned the script from testing to exploiting?
From this link: https://github.com/LandGrey/CVE-2019-7609
Answer: --shell
Q27) Determining the destination IP is key to tracing the attacker’s actions. What is the destination IP address where the malicious shell was sent?
agent.hostname:"sshbox" and process.name:"nc"Answer: 10.116.0.2
Q28) Identifying new users is vital to uncovering unauthorized access. What was the name of the user they created?
process.name: useradd Answer: Thanks4Playing
