foreword
Background tip: Hackers brute-force cracked a website management system, successfully obtained management rights, and downloaded important files.
Questions:(1) What username did the hacker finally get
(2) What password did the hacker finally get
(3) What file did the hacker modify
(4) The complete connection address of the hacker using the kitchen knife
(5) Hackers use the connection password of the kitchen knife
(6) What is the first file directory viewed by the hacker?
Download address: https://pan.baidu.com/s/1_hRbABEYq2Yake5vU2yJ9w
Analysis process
1. Open the first data traffic packet with wireshark, and use "http contains login" to filter out the login information. As can be seen from the login message, the logged-in IP is 219.239.105.18.
2. Filter out the post package through http && http.request.method==POST, and check the HTMLFORM in the latest package to find the correct username and password
Username: root
Password: 123456
3. Analyze the next packet. Filter ip by http and ip.addr == 219.239.105.18. From the filtered information, it is found that one of the requests has an edit_file operation on the index.html file. So the hacker made changes to the index.html file.
4. The operation of filtering ip is also performed on the subsequent data packets. In one of the packages, it was found that the keyword chopper for Chinese kitchen knives was in the post package, and there was a word Trojan horse behind it. Therefore, the connection path of the hacker using the kitchen knife is 172.16.61.210/index.php?m=search, and the connection password of the kitchen knife is z0.
5. A base encrypted string z1=L3Zhci93d3cvaHRtbC8= was found in one of the post packages. The decompressed path is: /var/www/html/, indicating that the first directory viewed by the hacker is the encrypted /var /www/html/.
Answer:
1. Username: root
2. Password: 123456
3. Modify the file: index.html
4. The link address of the kitchen knife: 172.16.61.210/index.php?m=search
5. The connection password of the kitchen knife: z0
6. A file directory: /var/www/html/