Heartbreaker-Denouement
Description
Files
└─$ 7z x HeartBreakerDenouement.zip -p'hacktheblue'
└─$ find . -maxdepth 2
.
./AWS
./AWS/ap-northeast-1
./AWS/ap-northeast-2
./AWS/ap-south-1
./AWS/ap-southeast-1
./AWS/ap-southeast-2
./AWS/ca-central-1
./AWS/eu-central-1
./AWS/eu-north-1
./AWS/eu-west-1
./AWS/eu-west-2
./AWS/eu-west-3
./AWS/me-south-1
./AWS/sa-east-1
./AWS/us-east-1
./AWS/us-east-2
./AWS/us-west-1
./AWS/us-west-2
./uac-uswebapp00-linux-20240313145552.tar.gz
└─$ find . -empty -delete
└─$ mkdir uac-uswebapp00 && tar -xvzf uac-uswebapp00-linux-20240313145552.tar.gz -C uac-uswebapp00
└─$ find ./uac-uswebapp00 -maxdepth 2
./uac-uswebapp00
./uac-uswebapp00/bodyfile
./uac-uswebapp00/bodyfile/bodyfile.txt
./uac-uswebapp00/bodyfile/bodyfile.txt.stderr
./uac-uswebapp00/chkrootkit
./uac-uswebapp00/chkrootkit/chkrootkit_-n_-r.txt.stderr
./uac-uswebapp00/chkrootkit/chkrootkit_-n_-r_-x.txt.stderr
./uac-uswebapp00/hash_executables
./uac-uswebapp00/hash_executables/hash_executables.md5
./uac-uswebapp00/hash_executables/hash_executables.sha1
./uac-uswebapp00/hash_executables/list_of_executable_files.txt
./uac-uswebapp00/live_response
./uac-uswebapp00/live_response/containers
./uac-uswebapp00/live_response/hardware
./uac-uswebapp00/live_response/network
./uac-uswebapp00/live_response/packages
./uac-uswebapp00/live_response/process
./uac-uswebapp00/live_response/storage
./uac-uswebapp00/live_response/system
./uac-uswebapp00/live_response/vms
./uac-uswebapp00/uac.log
./uac-uswebapp00/uac.log.stderr
./uac-uswebapp00/[root]
./uac-uswebapp00/[root]/etc
./uac-uswebapp00/[root]/home
./uac-uswebapp00/[root]/lib
./uac-uswebapp00/[root]/root
./uac-uswebapp00/[root]/run
./uac-uswebapp00/[root]/tmp
./uac-uswebapp00/[root]/varTasks
Task 1. What type of scanning technique was used to discover the web path of the victim's web server? Specify the name of the corresponding MITRE sub-technique.
Task 2. It seems a web request possibly could have been rerouted, potentially revealing the web server's web path to the Threat Actor. What specific HTML status code might have provided this information?
Task 3. What was the initial payload submitted by the threat actor to exploit weakness of the web server?
Task 4. What is the name of the vulnerability exploited by the Threat Actor?
Task 5. At what time (UTC) did the Threat Actor first realize they could access the cloud metadata of the web server instance?
Task 6. For a clearer insight into the Database content that could have been exposed, could you provide the name of at least one of its possible tables?
Task 7. Which AWS API call functions similarly to the 'whoami' command in Windows or Linux?
Task 8. It seems that the reported compromised AWS IAM credential has been exploited by the Threat Actor. Can you identify the regions where these credentials were used successfully? Separate regions by comma and in ascending order.
Task 9. Discovering that the compromised IAM account was used prior to the web server attack, this suggests the threat actor might have obtained the public IP addresses of running instances. Could you specify the API call the could have exposed this information?
Task 10. Looks like the Threat Actor didn’t only use a single IP address. What is the total number of unsuccessful requests made by the Threat Actor?
Task 11. Can you identify the Amazon Resource Names (ARNs) associated with successful API calls that might have revealed details about the victim's cloud infrastructure? Separate ARNs by comma and in ascending order.
Task 12. Evidence suggests another database was targeted. Identify all snapshot names created. Separate names by comma and in ascending order.
Task 13. The Threat Actor successfully exfiltrated the data to their account. Could you specify the account ID that was used?
Task 14. Which MITRE Technique ID corresponds to the activity described in Question 13?
Last updated