TryHackMe Task 3 Linux Initial Access Pot | Honeynet Collapse CTF

Task 3 Linux Initial Access Pot | Honeynet Collapse CTF

This is the initial task for the latest TryHackMe CTF Honeynet Collapse CTF (https://tryhackme.com/room/honeynet-collapse)

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

Initial Access Pot

We sell hundreds of DeceptiPots to the world every month, but we don’t even use them in our network. Show me the value of our product, test it well, and schedule the demo. Deadline — next Monday!

This is the task Emily Ross received from the company CEO. As a newly hired junior IT personnel at DeceptiTech, Emily didn’t really know what to do but still decided to prepare for the demo: Configure DeceptiPot to replicate a corporate WordPress blog, deploy the machine in the corporate DMZ, expose it to the Internet, and see what it captures over the weekend. Little did she know, threat actors around the globe enjoyed testing the DeceptiPot, too! Can you find out how the attack on DeceptiTech started?

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

Tips and Tools

• The system is running WordPress on port 80.
• Auditd is configured with non-standard audit rules.
• Emily did not properly configure the DeceptiPot.

Accessing the machine / Initial enumeration:

Taking the hint above regarding audit to consideration:

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

ubuntu@deceptipot-demo:~$ sudo su
root@deceptipot-demo:/home/ubuntu# cat /etc/audit/audit.rules
## This file is automatically generated from /etc/audit/rules.d
-D
-b 8192
-f 1
-i
-a never,exclude -F msgtype=EOE
-a never,exclude -F msgtype=AVC
-a never,exclude -F msgtype=SOCKADDR
-a never,exclude -F msgtype=CRED_ACQ
-a never,exclude -F msgtype=CRED_DISP
-a never,exclude -F msgtype=BPRM_FCAPS
-a never,exclude -F msgtype=USER_ACCT
-a never,exclude -F msgtype=USER_START
-a never,exclude -F msgtype=USER_END
-a never,exclude -F msgtype=CRYPTO_KEY_USER
-a always,exit -F arch=b32 -S ptrace -F uid=deceptisvc -F key=ptrace
-a always,exit -F arch=b64 -S ptrace -F uid=deceptisvc -F key=ptrace
-a always,exit -F arch=b32 -S memfd_create -F uid=deceptisvc -F key=memfd
-a always,exit -F arch=b64 -S memfd_create -F uid=deceptisvc -F key=memfd
-a always,exit -F arch=b32 -S execve -S execveat -F uid=deceptisvc -F key=exec
-a always,exit -F arch=b64 -S execve -S execveat -F uid=deceptisvc -F key=exec
-e 1
root@deceptipot-demo:/home/ubuntu#

Explanation:

-a always,exit: audit all syscall exits

-F arch=b64: for 64-bit architecture

-S execve -S execveat: track command executions

-F uid=deceptisvc: only for the user deceptisvc

-F key=exec: label this rule as exec for filtering/searching

We can use this later on to find the root path the attacker took to get priv to root.

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

Brute Forcing WordPress:

By checking the apache logs we can see the attacker brute forcing the login page: (/var/log/apache2/access.log)

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

172.16.8.239 - - [27/Jun/2025:21:19:22 +0000] "POST /wp-cron.php?doing_wp_cron=1751059162.9661519527435302734375 HTTP/1.1" 200 259 "-" "WordPress/6.8.1; http://172.16.8.239"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "GET /wp-login.php HTTP/1.0" 200 4838 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "GET /wp-login.php HTTP/1.0" 200 4838 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "GET /wp-login.php HTTP/1.0" 200 4838 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "GET /wp-login.php HTTP/1.0" 200 4838 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "GET /wp-login.php HTTP/1.0" 200 4838 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "POST /wp-login.php HTTP/1.0" 200 5244 "-" "Mozilla/5.0 (Hydra)"
167.172.41.141 - - [27/Jun/2025:21:20:27 +0000] "POST /wp-login.php HTTP/1.0" 200 5244 "-" "Mozilla/5.0 (Hydra)"
                                                                                                   40,1           9%

Then the next step the attacker start editing 404.php page:

167.172.41.141 - - [27/Jun/2025:21:22:01 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 541 "http://demo-web.deceptitech.thm/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
167.172.41.141 - - [27/Jun/2025:21:22:46 +0000] "GET /wp-admin/theme-editor.php?file=404.php&theme=blocksy HTTP/1.1" 200 58125 "http://demo-web.deceptitech.thm/wp-admin/theme-editor.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
172.16.8.239 - - [27/Jun/2025:21:23:19 +0000] "GET /wp-admin/theme-editor.php?theme=blocksy&file=404.php&wp_scrape_key=6478861325ec61818fce0b282bcb95a4&wp_scrape_nonce=151786912 HTTP/1.1" 200 58520 "-" "WordPress/6.8.1; http://172.16.8.239"

Full YouTube Video Walk Through:

You can check full Youtube video walk through here >> https://youtu.be/_cnPHPTdYCk

🐝 🐧🍯Task 3 Linux Initial Access Pot | Honeynet Collapse CTF | TryHackMe | WordPress Forensic🐝🐧 🍯