CodeArena кибер
Войти Регистрация
← Все комнаты Путь «Форензика» →
СреднийФорензика Флаг Осенний CTF

Ночной гость

Прогресс комнаты 0 / 4
Задание 1Введение

Цель: Находить в логах следы атаки перебором паролей.

Ночью сервер вёл себя странно. Перед вами фрагмент /var/log/auth.log. Найдите IP-адрес, с которого было больше всего неудачных попыток входа. Флаг — CTF{IP}.

Задание 2Теория и инструменты

SSH записывает каждую попытку входа в /var/log/auth.log: Failed password — неудачная, Accepted password — успешная.

Перебор выглядит как много ошибок с одного IP за короткое время, часто с разными именами пользователей (root, admin, test).

Инструменты

  • grep 'Failed' auth.log | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -rn
  • Python: re + collections.Counter

Больше теории — в разделе «Обучение: Форензика».

Задание 3Практика: найдите флаг
Данные задания7036 символов
Oct 12 03:14:20 srv-web-01 sshd[6978]: Failed password for ivan from 185.220.101.47 port 43431 ssh2
Oct 12 03:14:27 srv-web-01 sshd[9280]: Failed password for olga from 10.0.1.200 port 34282 ssh2
Oct 12 03:14:50 srv-web-01 sshd[1292]: Accepted password for deploy from 10.0.1.200 port 50371 ssh2
Oct 12 03:15:13 srv-web-01 sshd[8551]: Failed password for invalid user test from 185.220.101.47 port 37768 ssh2
Oct 12 03:15:29 srv-web-01 sshd[5339]: Failed password for olga from 10.0.2.148 port 59960 ssh2
Oct 12 03:15:42 srv-web-01 sshd[2183]: Accepted password for deploy from 10.0.2.100 port 32875 ssh2
Oct 12 03:16:09 srv-web-01 sshd[1280]: Failed password for invalid user test from 185.220.101.47 port 33527 ssh2
Oct 12 03:16:22 srv-web-01 sshd[6149]: Accepted password for ivan from 10.0.2.148 port 59643 ssh2
Oct 12 03:16:23 srv-web-01 sshd[1750]: Accepted password for deploy from 10.0.2.100 port 44994 ssh2
Oct 12 03:16:59 srv-web-01 sshd[3962]: Failed password for deploy from 185.220.101.47 port 44001 ssh2
Oct 12 03:17:33 srv-web-01 sshd[9104]: Accepted password for deploy from 10.0.2.100 port 33305 ssh2
Oct 12 03:18:11 srv-web-01 sshd[8988]: Failed password for ivan from 10.0.1.200 port 64229 ssh2
Oct 12 03:18:46 srv-web-01 sshd[5288]: Failed password for deploy from 185.220.101.47 port 46861 ssh2
Oct 12 03:18:51 srv-web-01 sshd[6178]: Accepted password for ivan from 10.0.2.237 port 41148 ssh2
Oct 12 03:18:57 srv-web-01 sshd[1878]: Accepted password for deploy from 10.0.2.148 port 46583 ssh2
Oct 12 03:19:33 srv-web-01 sshd[6721]: Failed password for invalid user admin from 185.220.101.47 port 57987 ssh2
Oct 12 03:20:12 srv-web-01 sshd[5710]: Failed password for ivan from 10.0.2.237 port 58176 ssh2
Oct 12 03:20:22 srv-web-01 sshd[2120]: Accepted password for olga from 10.0.4.183 port 54932 ssh2
Oct 12 03:20:36 srv-web-01 sshd[4502]: Failed password for deploy from 185.220.101.47 port 47279 ssh2
Oct 12 03:20:49 srv-web-01 sshd[5143]: Accepted password for deploy from 10.0.2.148 port 58153 ssh2
Oct 12 03:21:00 srv-web-01 sshd[4187]: Failed password for olga from 10.0.2.148 port 55752 ssh2
Oct 12 03:21:27 srv-web-01 sshd[6270]: Failed password for invalid user admin from 185.220.101.47 port 60750 ssh2
Oct 12 03:21:30 srv-web-01 sshd[6028]: Accepted password for ivan from 10.0.4.183 port 58670 ssh2
Oct 12 03:22:05 srv-web-01 sshd[6001]: Failed password for olga from 10.0.4.189 port 44751 ssh2
Oct 12 03:22:34 srv-web-01 sshd[7229]: Failed password for invalid user test from 185.220.101.47 port 54841 ssh2
Oct 12 03:22:44 srv-web-01 sshd[7314]: Failed password for deploy from 10.0.2.100 port 45513 ssh2
Oct 12 03:22:50 srv-web-01 sshd[5509]: Accepted password for olga from 10.0.1.200 port 35622 ssh2
Oct 12 03:23:22 srv-web-01 sshd[3286]: Failed password for invalid user test from 185.220.101.47 port 55477 ssh2
Oct 12 03:23:25 srv-web-01 sshd[2862]: Accepted password for ivan from 10.0.2.100 port 59118 ssh2
Oct 12 03:23:41 srv-web-01 sshd[6827]: Accepted password for deploy from 10.0.4.189 port 43924 ssh2
Oct 12 03:24:16 srv-web-01 sshd[2686]: Failed password for deploy from 185.220.101.47 port 48138 ssh2
Oct 12 03:24:26 srv-web-01 sshd[9130]: Failed password for deploy from 10.0.2.100 port 32832 ssh2
Oct 12 03:24:45 srv-web-01 sshd[9010]: Accepted password for olga from 10.0.4.183 port 35264 ssh2
Oct 12 03:25:15 srv-web-01 sshd[4158]: Failed password for root from 185.220.101.47 port 41486 ssh2
Oct 12 03:25:26 srv-web-01 sshd[8219]: Failed password for deploy from 10.0.2.148 port 32772 ssh2
Oct 12 03:25:56 srv-web-01 sshd[6125]: Failed password for deploy from 10.0.2.237 port 50113 ssh2
Oct 12 03:25:58 srv-web-01 sshd[2678]: Failed password for ivan from 185.220.101.47 port 53139 ssh2
Oct 12 03:26:09 srv-web-01 sshd[3571]: Failed password for olga from 10.0.4.183 port 42697 ssh2
Oct 12 03:26:22 srv-web-01 sshd[5022]: Accepted password for deploy from 10.0.4.183 port 56521 ssh2
Oct 12 03:26:26 srv-web-01 sshd[7810]: Failed password for ivan from 185.220.101.47 port 44904 ssh2
Oct 12 03:26:48 srv-web-01 sshd[2210]: Accepted password for deploy from 10.0.2.100 port 42725 ssh2
Oct 12 03:26:53 srv-web-01 sshd[6913]: Failed password for deploy from 10.0.4.183 port 38923 ssh2
Oct 12 03:27:11 srv-web-01 sshd[1453]: Failed password for invalid user test from 185.220.101.47 port 54814 ssh2
Oct 12 03:27:12 srv-web-01 sshd[9845]: Failed password for ivan from 10.0.2.237 port 33879 ssh2
Oct 12 03:27:48 srv-web-01 sshd[9553]: Failed password for olga from 10.0.4.183 port 48241 ssh2
Oct 12 03:28:24 srv-web-01 sshd[1115]: Failed password for deploy from 185.220.101.47 port 40218 ssh2
Oct 12 03:28:51 srv-web-01 sshd[1211]: Accepted password for ivan from 10.0.4.189 port 51129 ssh2
Oct 12 03:29:30 srv-web-01 sshd[8144]: Accepted password for ivan from 10.0.4.183 port 54516 ssh2
Oct 12 03:29:57 srv-web-01 sshd[3846]: Failed password for ivan from 185.220.101.47 port 61008 ssh2
Oct 12 03:29:58 srv-web-01 sshd[2203]: Failed password for ivan from 10.0.1.200 port 42420 ssh2
Oct 12 03:30:26 srv-web-01 sshd[3588]: Accepted password for deploy from 10.0.2.148 port 64274 ssh2
Oct 12 03:30:53 srv-web-01 sshd[4661]: Failed password for invalid user admin from 185.220.101.47 port 35271 ssh2
Oct 12 03:31:26 srv-web-01 sshd[9956]: Accepted password for olga from 10.0.2.148 port 64270 ssh2
Oct 12 03:31:46 srv-web-01 sshd[5612]: Failed password for deploy from 10.0.4.183 port 51063 ssh2
Oct 12 03:31:50 srv-web-01 sshd[6337]: Failed password for ivan from 185.220.101.47 port 54037 ssh2
Oct 12 03:31:52 srv-web-01 sshd[2695]: Accepted password for olga from 10.0.4.189 port 44161 ssh2
Oct 12 03:32:27 srv-web-01 sshd[9660]: Accepted password for ivan from 10.0.4.183 port 56357 ssh2
Oct 12 03:32:53 srv-web-01 sshd[1001]: Failed password for root from 185.220.101.47 port 56148 ssh2
Oct 12 03:32:56 srv-web-01 sshd[2349]: Accepted password for olga from 10.0.2.237 port 59915 ssh2
Oct 12 03:33:17 srv-web-01 sshd[4492]: Accepted password for olga from 10.0.2.100 port 63496 ssh2
Oct 12 03:33:23 srv-web-01 sshd[7091]: Failed password for ivan from 185.220.101.47 port 53801 ssh2
Oct 12 03:33:26 srv-web-01 sshd[3683]: Accepted password for ivan from 10.0.2.148 port 56786 ssh2
Oct 12 03:33:35 srv-web-01 sshd[8934]: Accepted password for olga from 10.0.2.148 port 55324 ssh2
Oct 12 03:33:57 srv-web-01 sshd[4536]: Failed password for root from 185.220.101.47 port 54469 ssh2
Oct 12 03:34:08 srv-web-01 sshd[5603]: Failed password for olga from 10.0.2.100 port 35621 ssh2
Oct 12 03:34:39 srv-web-01 sshd[3378]: Accepted password for ivan from 10.0.4.189 port 43421 ssh2
Oct 12 03:34:50 srv-web-01 sshd[1037]: Failed password for invalid user admin from 185.220.101.47 port 32865 ssh2
Oct 12 03:34:54 srv-web-01 sshd[4264]: Failed password for ivan from 10.0.2.148 port 50310 ssh2
Oct 12 03:34:59 srv-web-01 sshd[7201]: Accepted password for deploy from 10.0.2.237 port 64413 ssh2
Oct 12 03:35:25 srv-web-01 sshd[4031]: Failed password for root from 185.220.101.47 port 43080 ssh2
Войдите, чтобы ответить

Пошаговый план — открывайте по одному шагу

  1. 1
    Оставьте только строки с Failed password.

Подсказки — каждая до решения стоит −25 очков

Войдите, чтобы открыть подсказку 1
Войдите, чтобы открыть подсказку 2
Задание 4Как защититься

Отключите вход по паролю (только ключи), запретите вход root и поставьте fail2ban — он банит IP после нескольких ошибок.

Разборы участников

Разборы открываются после того, как вы решите комнату, — чтобы не спойлерить ответ.