APIWizards Breach
Investigate a security breach at APIWizards Inc.
medium
90 min
To access material, start machines and answer questions login.
You were hired as a dedicated external DFIR specialist to help the APIWizards Inc. company with a security incident in their production environment. APIWizards develop REST APIs on demand and hosts them on separate Ubuntu servers. The company suspects that one of its servers is compromised.
APIWizards CISO:
"This is our third breach for this year: we see strange web requests in Nginx logs, then some unexpected changes in system files, and after a few days, we see our data in Telegram! We tried cleaning infected files, but hackers are always one step forward.”
“Yesterday, we observed a similar web scan on our newly deployed API server, and suspect it might be the same threat actors. We quickly isolated the server from the network and desperately hope for your help!”
SSH credentials:
- IP Address:
MACHINE_IP - Username:
dev - Password:
d3v-p455w0rd
What is the IP address that attacked the web server?
Which vulnerability was found and exploited in the API service?
Which file contained the credentials used to privesc to root?
What file did the hacker drop and execute to persist on the server?
Which service was used to host the “rooter2” malware?
What is the C2 server IP address of the malicious actor?
What port is the backdoored bind bash shell listening at?
How does the bind shell persist across reboots?
What is the absolute path of the malicious service?
How do the firewall rules persist across reboots?
How is the backdoored local Linux user named?
Which privileged group was assigned to the user?
What is the strange word on one of the backdoored SSH keys?
Can you spot and name one more popular persistence method? Not a MITRE technique name.
What are the original and the backdoored binaries from question 6?
What technique was used to hide the backdoor creation date?
According to the dropped dump, what is the server’s kernel version?
Which active internal IPs were found by the “rooter2” network scan?
How did the hacker find an exposed HTTP index on another internal IP?
What command was used to exfiltrate the CDE database from the internal IP?
What is the most secret and precious string stored in the exfiltrated database?
Ready to learn Cyber Security? Create your free account today!
TryHackMe provides free online cyber security training to secure jobs & upskill through a fun, interactive learning environment.
Already have an account? Log in