TryHackMe // Write-up
Brains Post-Exploitation Forensics.
Examine a compromised server in Splunk and identify the evidence an attacker left behind after successful exploitation: a backdoor account, a suspicious package, and a malicious TeamCity plugin.
- DFIR
- Splunk
- Linux Logs
- TeamCity
- Persistence
01 Lab Setup
I deployed the compromised server provided by TryHackMe and accessed the Splunk instance on port 8000.
| Item | Value |
|---|---|
| Target server IP | 10.67.186.78 |
| AttackBox IP | 10.67.103.81 |
| Splunk port | 8000 |
| Username | splunk |
| Password | analyst123 |
After logging in, I opened Search & Reporting and began investigating the logs for signs of persistence, suspicious software installation, and modifications to the TeamCity application.
02 Investigation: Backdoor User
The first objective was to identify a backdoor user created after exploitation. I searched the available logs for references to eviluser:
index=* "eviluser"The results included an attempted account-creation event, timestamped July 4, 2024, at 10:32:56 PM:
attempt to add "eviluser" failedBecause this event explicitly indicated failure, I treated it as evidence of an attempted action rather than proof that the account had been created successfully. The investigation identified eviluser as the backdoor username associated with this question.
Answer: eviluser
Attackers may create additional user accounts to maintain access after exploiting a system. Account-creation events should be correlated with authentication logs and other system activity to determine whether an account was successfully created and subsequently used.
03 Investigation: Suspicious Package
The second objective was to identify a malicious-looking package installed on the compromised server. I reviewed package-management events and searched for the package identified by the investigation:
index=* "datacollector"The suspicious package was identified as datacollector.
Other installation events appeared in the logs, including cloud-install and development libraries such as libpcap-dev and libpcap0.8-dev. I did not treat these other packages as malicious solely because they appeared in the installation history.
Answer: datacollector
Package installation records can reveal tools introduced during post-exploitation. Unexpected packages should be investigated by examining their installation timestamps, source repositories, installed files, running processes, and associated network connections. A package name alone is not sufficient to establish malicious intent.
04 Investigation: TeamCity Plugin
The third objective was to identify the plugin installed after exploitation. I examined TeamCity application activity and located an audit event containing the following information:
INFO - s.buildServer.ACTIVITIES.AUDIT -
plugin_uploaded: Plugin "AyzzbuXY" was updated by
"user with id=11" with comment
"Plugin was uploaded to /home/ubuntu/.BuildServer/plugins/AyzzbuXY.zip"This event provided direct evidence that the plugin archive was uploaded to the TeamCity plugin directory. The filename was AyzzbuXY.zip.
Answer: AyzzbuXY.zip
Unauthorized plugin installation can provide an attacker with a way to execute code within an application or maintain access. The audit event identifies the uploaded archive and its destination, giving an investigator a specific file to preserve and examine.
05 Findings
| Investigation objective | Finding |
|---|---|
| Backdoor user | eviluser |
| Suspicious package | datacollector |
| TeamCity plugin archive | AyzzbuXY.zip |
The investigation identified evidence associated with three common post-exploitation behaviors: account persistence, suspicious software installation, and modification of the TeamCity application through a plugin upload.
06 Lessons Learned
This exercise demonstrated how Splunk can be used to correlate evidence from different sources on a compromised Linux server.
Search broadly first
Search across multiple indexes and sourcetypes when the exact log location is initially unknown.
Correlate with timestamps
Use timestamps to correlate account activity, package installations, and application events.
Failed is not successful
Distinguish failed attempts from successful actions.
Don't assume malicious
Investigate suspicious package names instead of assuming every newly installed package is malicious.
Use application audit logs
They can identify uploaded files, responsible account IDs, and destination paths.
Preserve before changing
Preserve relevant logs and suspicious files for further analysis before making changes to the compromised system.
// Conclusion
The Brains forensics exercise focused on identifying the attacker's footprints after exploitation rather than performing the initial compromise. Using Splunk, I identified the backdoor username eviluser, the suspicious package datacollector, and the TeamCity plugin archive AyzzbuXY.zip.
These findings illustrate the importance of centralized logging and cross-source event correlation during incident response. Together, they provide useful leads for investigating persistence mechanisms and unauthorized changes made to a compromised server.
The investigation identified the artifacts associated with the room's questions. The available evidence summarized here does not independently establish the full execution behavior of the package or plugin, nor does the failed account-creation event by itself prove successful account creation.