HackTheBox — Brutus Log Analysis

In this write-up I will share how I solved the Brutus log analysis lab, where the goal is to investigate an SSH brute-force attack using Linux authentication logs.

This lab focuses on analyzing artifacts such as:

• auth.log
• wtmp
• SSH session logs

All analysis in this article was performed using Ubuntu Linux environtment.

Note : This is just one possible approach. There are many other ways to solve this challange depending on the tools and workflow you prefer.

Scenario

In this lab we are given a compressed archive that contains system log artifacts from a Linux server. Our task is to investigate the logs and identify attacker activities such as:

• brute force attempts
• successful login
• session tracking
• persistence mechanisms

The most important artifact in this challenge is:

auth.log

This log records authentication activities such as SSH login attempts.

Step 1 — Extract the Evidence Files

First we need to extract the provided archive.

In this challenge, the archive cannot be extracted properly using unzip, so we use 7z instead.

7z x brutus.zip

Explanation :

• x → extract files while

Password for file is :

hacktheblue

Step 2 — investigating auth.log

The next step is analyzing the authentication log.

auth.log

This log records :

• SSH login attempts
• authentication failures
• sudo usage
• session creation

We start by viewing the log.

cat auth.log

or for easier navigation :

less auth.log

Task 1 — Identify the Attacker IP

The first task asks us to determine which IP address performed the brute force attack

To identify this, we search for failed SSH login attempts.

Example command :

grep Failed password" auth.log

This reveals repeated login attempts from a single IP address.

After reviewing the logs we can clearly see that the attacker repeatedly attempted to access the SSH service

Attacker IP :

62.2.161.68

This IP appears many times attempting to authenticate with different credentials.

Task 2 — Identify the Compromised Username

After several brute force attempts, the attacker eventually successfully loggedin.

To find the username that was compromised we search for successful authentication events.

grep "Accepted password" auth.log

This command shows when SSH authentication was successfull.

From the output we can determine which account the attacker successfully accessed.

Task 3 — Identify the Terminal Login Time

The challenge asks us to determine the exact UTC timestamp when the attacker established a terminal session on the server.

It is important to understand that:

• Authentication time (found in auth.log) only shows when login credentials were accepted.
• Terminal session start time is recorded in the **wtmp artifact**, which logs user login sessions.

To analyze the wtmp file more clearly, we can use the utmpdump utility.

utmpdump wtmp | grep root

This command converts the binary wtmp file into a readable format.

After inspecting the output, we can find the entry corresponding to the attacker’s login session.

From this record we can identify the extract moment the attacker started an interactive terminal session.

Attacker terminal login time (UTC):

2024-03-06 06:32:45

This timestamp represents when the attacker successfully established a terminal session after the brute-force attack succeeded.

Task 4 — Identify the SSH Session ID

Each SSH login session is assigned a session number.

This can be found inside auth.log.

To locate it we search for the session creation entry.

Example :

grep "session opened" auth.log

From this entry we can determine the session ID assigned to the attacker’s login session.

Task 5 — Detect Persistence Activity

After gaining access, attackers often establish persistence so they can return later. In this lab the attacker created a new user account with higher privileges. We can detect this by searching for user creation comands in the logs.

Example :

grep "useradd" auth.log

This reveals the name of the newly created backdoor account.

Task 6 — Identify the MITRE ATT&CK Technique

Creating a new account for persistence maps to the MITRE ATT&CK framework.

Specifically :

T1136 – Create Account

More precisely :

T1136.001 – Create Local Account

This technique is commonly used by attackers to maintain access to compromised systems.

Task 7 — Determine When the First SSH Session Ended

Next we need to determine when the attacker’s first session ended.

From the auth.log analysis we can identify the logout time.

The timestamp recorded is :

2024-03-06 06:37:24

This indicates the moment when the SSH session was closed.

Task 8 — Identify the Sudo Command Executed

Finally, the attacker logged into their backdoor account and used elevated privileges to download a script.

To find this we search for sudo activity.

Example :

grep "sudo" auth.log

And yaaa, see you again in the next investigation.

Let’s connect on Linkedin : Dimas Adrian