GitTheGate Lab

Q1) Using the "View Surrounding Documents" option, find the ID of the document that is 14 documents before (older) the id GDQOB3IBwJHf9VOW-r0Y?

_id: GDQOB3IBwJHf9VOW-r0Y

Answer: tzQOB3IBwJHf9VOW-Lyd

Q2) Using the "View Surrounding Documents" option, find the IP of the document that is 16 documents after (newer) the id vDQOB3IBwJHf9VOW-Lyd?

Answer: 191.189.39.130

Q3) How many requests have come from the IP address 2.49.53.218 between the 6th of May and the 13th of May? (time is in UTC)

ip: 2.49.53.218

Answer: 7

Q4) What percentage of logs are from windows 8 machines on the 11th of May? (time is in UTC)

Answer: 21.74%

Q5) How many 503 errors were there on the 8th of May? (time is in UTC)

response: 503

Answer: 8

Q6) How many connections to the host "www.elastic.co" were made on the 12th of May? (time is in UTC)

host: www.elastic.co

Answer: 82

Q7) What is the second most common extension of files being accessed on the 12th of May? (time is in UTC)

Answer: .gz

Q8) Find the first IP address to connect to the host elastic-elastic-elastic.org on the 12th of May. (time is in UTC)

host: "elastic-elastic-elastic.org"

Answer: 114.246.225.218

Q9) What was the username used that failed to log in on the 15th of May at 10:44 pm? (time is in UTC)

event.type: "authentication_failure"

Answer: deploy

Q10) According to the logs, which vulnerable version of Kibana was identified as running in the stack?

Answer: 7.6.2

Q11) Using current data in the auditbeat index, what is the name of the elasticsearch node? (one word)

Answer: elkstack

Q12) What is the name of the beat to collect windows logs? (one word)

Answer: winlogbeat

Q13) What is the name of the beat that sends network data? (one word)

Answer: packetbeat

Q14) How many fields are in the auditbeat-* index pattern?

Answer: 437

Q15) On the 14th of May, how many failed authentication attempts did the host server receive? (time is in UTC)

event.type: authentication_failure

Answer: 762

Q16) On the 13th and 14th of May, how many bytes were received by the source IP 159.89.203.214 (time is in UTC)

source.ip: "159.89.203.214"

Answer: 492,919

Q17) What username did they crack?

event.type: 'authentication_success'

event.type: 'authentication_failure'

Answer: johnny

Q18) What host was attacked?

Answer: sshbox

Q19) How many were failed attempts made on the machine?

event.type: 'authentication_failure'

Answer: 12523

Q20) What time was the last failed attempted login?

event.type: 'authentication_failure' and host.name: 'sshbox'

Answer: 11:39:31

Q21) What time did the attacker successfully login?

Based on the scenario, the attack is believed to have occurred on May 25th between 9:00 AM and 11:30 AM.

Answer: 11:50:13

Q22) What tool did the attacker use to get the exploit onto the machine?

Answer: git

Q23) Shortly after getting the exploit on the machine, the attacker used vim to create a file. What is the name of that file?

Answer: ElasticCTFisFun!

Q24) What is the filename of the exploit that was run?

Answer: CVE-2019-7609-kibana-rce.py

Q25) What is the first ID of the log that shows the exploit being run?

agent.hostname:"sshbox"  and *CVE-2019-7609-kibana-rce.py*

Answer: _SHbS3IBCEolQs9lAD3z

Q26) What parameter turned the script from testing to exploiting?

From this link: https://github.com/LandGrey/CVE-2019-7609

Answer: --shell

Q27) Determining the destination IP is key to tracing the attacker’s actions. What is the destination IP address where the malicious shell was sent?

agent.hostname:"sshbox"  and process.name:"nc"

Answer: 10.116.0.2

Q28) Identifying new users is vital to uncovering unauthorized access. What was the name of the user they created?

process.name: useradd 

Answer: Thanks4Playing