Not Caught — Not a Honey Badger — avitoctf

Description

At dawn the hive server's bee-accounting database disappeared. Honey badgers were blamed, but were asleep. The med-team preserved access.log. Analyze ordinary traffic, reconstruct the real intruder's actions, recover the stolen database, and identify the secret in corporate accounting.

The supplied Apache access log contains ordinary browsing, monitoring, and scanner noise. The objective is to reconstruct the real compromise, recover the exfiltrated accounting data, and locate its secret.

Analysis

Finding the anomalous requests

The log has SHA-256 fb09545f74edb3605aed3854f5cc1104911b7b14b4f18bf4d0e4479850ae3af0. All 56,873 lines parse as Apache Combined Log Format records, and their timestamps are UTC.

Instead of following the numerous scanner-like paths, I grouped requests by method, status, path, source, user-agent, and query key. Only 22 requests had query strings. Four stood out:

Log line	Source	Path	Status
26016	185.193.88.77	/aspnet_client/system_web/healthcheck.aspx?cmd=...	200
26118	185.193.88.77	/aspnet_client/system_web/healthcheck.aspx?cmd=...	200
26262	185.193.88.77	/aspnet_client/system_web/healthcheck.aspx?cmd=...	200
26313	185.193.88.77	/aspnet_client/system_web/healthcheck.aspx?cmd=...	200

These were also the only four requests using the legacy user-agent Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0). Their successful responses and Base64-looking cmd values made them much stronger evidence than the bulk scanning traffic.

The following script reproduces the parsing and command extraction:

#!/usr/bin/env python3
import base64
import collections
import re
from pathlib import Path
from urllib.parse import parse_qs, urlsplit

log_path = Path("honeyleak_access.log")
pattern = re.compile(
    r'^(\S+) \S+ \S+ \[([^]]+)] "(\S+) (.*?) (HTTP/[^\"]+)" '
    r'(\d{3}) (\S+) "([^\"]*)" "([^\"]*)"$'
)

...