# APIWizards Breach-Tryhackme Walkthrough

Link to the room [https://tryhackme.com/room/apiwizardsbreach](https://tryhackme.com/room/apiwizardsbreach)

## **Task 1:Preparation**

You were hired as a dedicated external DFIR specialist to help the APIWizards Inc. company with a security incident in their production environment. APIWizards develop REST APIs on demand and hosts them on separate Ubuntu servers. The company suspects that one of its servers is compromised.

**APIWizards CISO:**\*  
“This is our third breach for this year: we see strange web requests in Nginx logs, then some unexpected changes in system files, and after a few days, we see our data in Telegram! We tried cleaning infected files, but hackers are always one step forward.”\*

*“Yesterday, we observed a similar web scan on our newly deployed API server, and suspect it might be the same threat actors. We quickly isolated the server from the network and desperately hope for your help!”*

## **Task 2:Initial Access**

> ***Which programming language is a web application written in?***

*look into the apiservice dir in your home we can see file name with .py*

***Ans: python***

> ***What is the IP address that attacked the web server?***

*we are dealing with nginx server so check for /var/log/nginx/access\* logs*

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/06442592-f9d0-4d57-b41b-550d5453b618.png align="center")

files show enumeration commands like “**whoami**”, “**pwd**”, “**id**”, etc which is typical of attacker behaviour

***Ans: 149.34.244.142***

> ***Which vulnerability was found and exploited in the API service?***

*checking the access logs we can see that some url encoded commands are being injected and you can also check the* [*api.py*](http://api.py) *code where you’ll find the vuln lines in \\time function*

***Ans: Os command injection***

> ***Which file contained the credentials used to privesc to root?***

*checking the dev user’s bash histor****y***

*cat /home/dev/.bash\_history*

*we can see what commands are run by the attacker & look for the files accessed*

*you can use realpath to get the absolute path*

***Ans: /home/dev/apiservice/src/***[***config.py***](http://config.py)

> ***What file did the hacker drop and execute to persist on the server?***

so w*e knew from the before question that attacker escalated privilege so check out the root’s bash history a file is being downloaded and executed*

sudo su and dev’s passwd

![](https://cdn.hashnode.com/uploads/covers/6a8bfea2c4d92e5440cafcc6/e9bfd058-2222-4e9e-91ec-b4a06cf8b501.png align="center")

Download & execute binary  
↓  
Inspect /root and SSH keys  
↓  
Upload .dump.json externally  
↓  
Scan internal host/ports  
↓  
Probe internal service on :8080  
↓  
Download cde-backup.csv  
↓  
Clear login history/logs  
↓  
Rename the downloaded file  
↓  
Check nginx / apiservice  
↓  
Check localhost

***Ans: /tmp/rooter2***

> ***Which service was used to host the “rooter2” malware?***

***Ans:*** [***transfer.sh***](http://transfer.sh)

## **Task 3:Further Actions**

*“No way it was so easy to exploit! While we are calling the developer, please check if there are any backdoors left by the hackers. They were extremely clever the previous two times, so be vigilant!”*

### **Common persistance techniques:**

*   **cron job**
    
*   **systemd services**
    
*   **init scripts**
    
*   **shell startups (bashrc, bash prof)**
    
*   **ssh keys**
    
*   **users**
    

> ***Which two system files were infected to achieve cron persistence?***

*checking for the common persistence technique we see a suspicious cron job with a env variable*

*echo $SYSTEMUPDATE*

![](https://miro.medium.com/v2/resize:fit:875/1*d4Rv1h80QaYbkOmz2VLUHQ.png align="center")

a reverse shell

***Ans: /etc/crontab, /etc/environment***

> ***What is the C2 server IP address of the malicious actor?***

***Ans: 5.230.66.147***

> ***What port is the backdoored bind bash shell listening at***\*?\*

Key point:

*   **Bind shell** = victim listens, attacker connects.
    
*   **Reverse shell** = attacker listens, victim connects back with a shell
    

we’ll list the listening ports using ss

![](https://miro.medium.com/v2/resize:fit:1250/1*XnnrvbrdcwKP0qxB0iNgwA.png align="center")

we can see the process nc

![](https://miro.medium.com/v2/resize:fit:875/1*U0C3136FllwTuRROtJ_1RQ.png align="center")

***Ans: 3578***

> ***How does the bind shell persist across reboots?***

check for other persistence areas….

services!!!!! we’ll check out which services contains this line

grep -R ‘nc -l’ /etc/systemd/system/

![](https://miro.medium.com/v2/resize:fit:1250/1*-ZqirAaQj2MFrA_8uBZmDQ.png align="center")

***Ans: systemd service***

> ***What is the absolute path of the malicious service?***

***Ans: /etc/systemd/system/socket.service***

## **Task 4:Even More Persistence**

*“We finally reached the developer and he said he would need two weeks to fix the vulnerability! Meanwhile, can you please proceed with the DFIR? We need every malicious indicator you can find to hunt for them on other APIWizards servers.”*

### **Common persistance techniques:**

*   **cron job**
    
*   **systemd services**
    
*   **init scripts**
    
*   **shell startups (bashrc, bash prof)**
    
*   **ssh keys**
    
*   **users**
    

> ***Which port is blocked on the victim’s firewall?***

![](https://miro.medium.com/v2/resize:fit:784/1*YoULmVvr7uPlry62oDslPA.png align="center")

***Ans: 3578***

> ***How do the firewall rules persist across reboots?***

checking other persistence areas…..

![](https://miro.medium.com/v2/resize:fit:861/1*tVXqmgS3_I6UtzFgm6-n4A.png align="center")

ip tables(firewall rule in linux) are designed in way to allow attackers ip i/o and block every other ip on that port

***Ans: /root/.bashrc***

> ***How is the backdoored local Linux user named?***

***cat /etc/passwd***

***Ans: support***

> ***Which privileged group was assigned to the user?***

***id support***

***Ans: sudo***

> ***What is the strange word on one of the backdoored SSH keys?***

***cat /root/.ssh/authorized\_keys***

***Ans: ntsvc***

> ***Can you spot and name one more popular persistence method? Not a MITRE technique name.***

***Ans: SUID binary***

setting suid to binary ,on execution it will run with the binary owner’s privilege

> ***What are the original and the backdoored binaries from question 6?***

find / -perm -u=s -type f 2>/dev/null searches for files with suid set

![](https://miro.medium.com/v2/resize:fit:610/1*famlpksMnhqaP9SbVONXrg.png align="center")

a suspicious binary names clamav which is antivirus

running clamav — help

gives you the options for bash shell, so the original binary is bash and backdoored is av

***Ans:/usr/bin/bash, /usr/bin/clamav***

> ***What technique was used to hide the backdoor creation date?***

***Ans: Timestomping***

## **Task 5:Final Target**

*“That’s a lot of persistence! But why would the hackers reveal all their techniques? Maybe to use the server as an entry point to our cardholder data environment? Please check for any traces of lateral movement or data exfiltration; perhaps dumps are still there.”*

> ***What file was dropped which contained gathered victim information?***

*from root’s bash history*

***Ans: /root/.dump.json***

> ***According to the dropped dump, what is the server’s kernel version?***

*cat /root/.dump.json use cyberchef for base64 decode …copy paste the each value separately*

***Ans: 5.15.0–78-generic***

> ***Which active internal IPs were found by the “rooter2” network scan?***

*base64 decode the dump*

***Ans: 192.168.0.21, 192.168.0.22***

> ***How did the hacker find an exposed HTTP index on another internal IP?***

*bash history of root, a type of port scanning*

***Ans: nc -zv 192.168.0.22 1024–10000 2>&1 | grep -v failed***

> ***What command was used to exfiltrate the CDE database from the internal IP?***

*bash history*

***Ans: wget 192.168.0.22:8080/cde-backup.csv***

> ***What is the most secret and precious string stored in the exfiltrated database?***

**cat the file .review.csv**

***Ans: pwned{v3ry-secur3-cardh0ld3r-data-environm3nt}***

**THANK YOU FOR READING!!! ❤️💫**