Tutorial Challenge Writeup#

Question#

What is the flag in tutorial.txt?

Answer#

1
TryHarder

Solution Steps#

1. Extract the tutorial file from the provided ZIP:

   1
   unzip 49fbd8f1cf0f2755d4f29ef3210cb147-tutorial.zip
   2
   cd tutorial
   

2. Inspect the file contents:

   1
   cat tutorial.txt
   

   Output:

   1
   VGhlIGFuc3dlciB0byB0aGlzIGV4ZXJjaXNlIGlzICdUcnlIYXJkZXInIC0gbm90IGV4YWN0bHkgb3JpZ2luYWwsIGJ1dCBjbGVhcmx5IGVmZmVjdGl2ZS4gSW4gdGhlIGludGVyZXN0IG9mIHNhdmluZyB0aW1lLCBJJ3ZlIGFscmVhZHkgZXh0cmFjdGVkIHRoZSBBcGFjaGUgYWNjZXNzIGxvZyBmcm9tIHRoZSBzZXJ2ZXIgYW5kIGluY2x1ZGVkIGl0IGluIHRoZSBmaWxlcyBmb3IgdGhpcyBleGVyY2lzZS4gVGhlIGFjY2VzcyBsb2cgY29udGFpbnMgZXZlcnkgcmVxdWVzdCBtYWRlIHRvIHRoZSBzZXJ2ZXIgaW4gdGhlIGxhc3QgNDggaG91cnMuCgpJJ3ZlIGFsc28gaW5jbHVkZWQgdGhlIHNvdXJjZSBjb2RlIGZvciB0aGUgd2ViIGFwcGxpY2F0aW9uIGluIGNhc2UgeW91IHdhbnQgdG8gdW5kZXJzdGFuZCBob3cgaXQgd29ya3MuIEJ1dCB0byBiZSBob25lc3QsIHlvdSBkb24ndCByZWFsbHkgbmVlZCB0byBsb29rIGF0IHRoZSBjb2RlIHRvIGZpZ3VyZSBvdXQgd2hhdCBoYXBwZW5lZCDigJMganVzdCBhbmFseXplIHRoZSBsb2dzLgoKPCEtLW1vcmUgZmxhdm9ydGV4dA==
   

3. Recognize Base64 encoding (the == padding at the end is a giveaway)

4. Decode the Base64 string:

   1
   base64 -d tutorial.txt
   

   Decoded Output:

   1
   The answer to this exercise is 'TryHarder' - not exactly original, but clearly effective. In the interest of saving time, I've already extracted the Apache access log from the server and included it in the files for this exercise. The access log contains every request made to the server in the last 48 hours.
   2
   
   3
   I've also included the source code for the web application in case you want to understand how it works. But to be honest, you don't really need to look at the code to figure out what happened  just analyze the logs.
   4
   
   5
   <!--more flavortext--[truncated]
   

5. Extract the flag: TryHarder

Key Takeaways#

• Always check for common encoding schemes (Base64, hex, URL encoding)
• Base64 strings are often recognizable by character set (A-Za-z0-9+/=) and padding
• Use tools: base64 -d on Linux/Mac, [System.Convert]::FromBase64String() on PowerShell

Question#

Analyze the file access.log and determine how the attacker gained access to the server and identify what data they were able to extract.

Context#

The access log contains 48 hours of HTTP requests to a web server. The goal is to identify malicious activity and determine what data was compromised.

Attack Analysis#

1
192.168.1.101

1
# Look for suspicious patterns in the log
2
grep -E "(\.\.\/|%2e%2e|etc/passwd|\.ssh)" access.log
3

4
# Identify the source IP
5
grep "../../../../" access.log | awk '{print $1}' | sort -u

1
01/Oct/2025:08:17:55 +0000

1
192.168.1.101 - - [01/Oct/2025:08:17:55 +0000] "GET /public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa HTTP/1.1" 200 1678

1
Path Traversal / Directory Traversal Vulnerability

1
GET /public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa HTTP/1.1

1
/public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa
2
 /public/plugins/../../../../../../../../home/dave/.ssh/id_rsa
3
 /public/../../../../../../../../home/dave/.ssh/id_rsa
4
 /../../../../../../../../home/dave/.ssh/id_rsa
5
 /home/dave/.ssh/id_rsa

1
SSH Private Key (id_rsa) belonging to user "dave"

Attack Timeline Reconstruction#

Step 1: Reconnaissance (Not shown in logs)

• Attacker likely scanned the web application
• Identified plugin directory structure
• Tested for path traversal vulnerability

Step 2: Exploitation

1
01/Oct/2025:08:17:55 +0000
2
GET /public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa
3
 Response: 200 OK, 1678 bytes

Step 3: Post-Exploitation (Likely)

• Attacker downloads the private key
• Attempts SSH login: ssh -i id_rsa dave@target-ip
• Gains shell access to the server

Step 4: Potential Next Actions

• Establish persistence
• Escalate privileges
• Exfiltrate additional data
• Cover tracks (delete logs)

How to Detect This Attack#

1. Log Analysis:

1
# Detect path traversal attempts
2
grep -E "(\.\.\/|\.\.\\|%2e%2e)" access.log
3

4
# Find successful exfiltration (200 response to traversal)
5
grep -E "(\.\.\/|%2e%2e)" access.log | grep " 200 "
6

7
# Identify sensitive file access
8
grep -E "(id_rsa|passwd|shadow|authorized_keys)" access.log

2. Intrusion Detection System (IDS) Rules:

1
alert http any any -> any any (
2
    msg:"Path Traversal Attempt";
3
    content:"../";
4
    nocase;
5
    classtype:web-application-attack;
6
    sid:1000001;
7
)

3. File Integrity Monitoring:

• Monitor access to sensitive files (/home/*/.ssh/*)
• Alert on unusual file reads by web server process

4. Behavioral Analysis:

• Web server process (www-data, nginx) accessing SSH keys is abnormal
• Unexpected outbound SSH connections after web request

How to Prevent This Attack#

1. Input Validation:

1
# Python example
2
import os
3

4
def safe_path_join(base_dir, user_input):
5
    # Resolve to absolute path
6
    requested_path = os.path.abspath(os.path.join(base_dir, user_input))
7

8
    # Ensure the path is within base_dir
9
    if not requested_path.startswith(os.path.abspath(base_dir)):
10
        raise ValueError("Path traversal attempt detected")
11

12
    return requested_path

2. Web Server Configuration:

Nginx:

1
location /public/ {
2
    alias /var/www/public/;
3
    # Prevent directory traversal
4
    if ($request_uri ~* "\.\.") {
5
        return 403;
6
    }
7
}

Apache:

1
<Directory /var/www/public>
2
    # Deny access to parent directories
3
    AllowOverride None
4
    Options -Indexes -FollowSymLinks
5
</Directory>

3. Filesystem Permissions:

1
# Web server should NOT have read access to SSH keys
2
chmod 600 /home/dave/.ssh/id_rsa
3
chown dave:dave /home/dave/.ssh/id_rsa
4

5
# Restrict web server user permissions
6
usermod -s /sbin/nologin www-data

4. Security Hardening:

• Run web server in a chroot jail
• Use SELinux/AppArmor to restrict file access
• Implement Web Application Firewall (WAF)
• Regular security audits and penetration testing

5. Monitoring & Response:

• Real-time log analysis (SIEM)
• Alert on path traversal patterns
• Automated blocking of malicious IPs
• Incident response procedures

Question 1: Tutorial Flag#

Flag: TryHarder
Method: Base64 decode tutorial.txt

Question 2: Attack Analysis#

Technical Skills Learned#

1. Log Analysis: Parse Apache/Nginx logs to identify attacks
2. Path Traversal: Understand how ../ sequences bypass access controls
3. SSH Keys: Recognize the value of private keys in post-exploitation
4. Base64 Decoding: Use encoding/decoding tools for CTF challenges

Security Principles#

1. Input Validation: Never trust user input
2. Principle of Least Privilege: Web servers shouldn’t access SSH keys
3. Defense in Depth: Multiple security layers (WAF, IDS, file permissions)
4. Logging & Monitoring: Detect attacks through log analysis

Real-World Relevance#

• Path traversal is a common vulnerability (OWASP Top 10)
• SSH key theft enables persistent access
• Many breaches start with simple web vulnerabilities
• Proper log analysis can detect attacks before major damage