# the card

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2F6H22MljTzvjBO0XhNVK6%2Fimage.png?alt=media&#x26;token=bfce46ce-e4fb-499a-bba4-6e336e6bbf91" alt=""><figcaption></figcaption></figure>

* *Difficulty: Easy*
* Narrative:

> Holmes receives a breadcrumb from Dr. Nicole Vale - fragments from a string of cyber incidents across Cogwork-1. Each lead ends the same way: a digital calling card signed JM.

## tldr;

<table><thead><tr><th width="40" align="center">#</th><th width="317.27276611328125">question</th><th>flag</th><th>tldr</th></tr></thead><tbody><tr><td align="center">1</td><td>Analyze the provided logs and identify what is the first User-Agent used by the attacker against Nicole Vale's honeypot. (string)</td><td><mark style="color:blue;"><strong><code>Lilnunc/4A4D - SpecterEye</code></strong></mark></td><td>First line of <code>access.log</code> - initial recon user-agent</td></tr><tr><td align="center">2</td><td>It appears the threat actor deployed a web shell after bypassing the WAF. What is the file name? (filename.ext)</td><td><mark style="color:blue;"><strong><code>temp_4A4D.php</code></strong></mark></td><td>Found in <code>application.log</code> and <code>waf.log</code> - web shell deployment logs</td></tr><tr><td align="center">3</td><td>The threat actor also managed to exfiltrate some data. What is the name of the database that was exfiltrated? (filename.ext)</td><td><mark style="color:blue;"><strong><code>database_dump_4A4D.sql</code></strong></mark></td><td>Found in <code>waf.log</code> and <code>access.log</code> - large file download with database pattern</td></tr><tr><td align="center">4</td><td>During the attack, a seemingly meaningless string seems to be recurring. Which one is it? (string)</td><td><mark style="color:blue;"><strong><code>4A4D</code></strong></mark></td><td>Appears in user-agents, filenames, beacon IDs - threat actor's signature</td></tr><tr><td align="center">5</td><td>OmniYard-3 (formerly Scotland Yard) has granted you access to its CTI platform. Browse to the first IP:port address and count how many campaigns appear to be linked to the honeypot attack.</td><td><mark style="color:blue;"><strong><code>5</code></strong></mark></td><td>CTI Graph portal - search honeypot indicators, count connected campaign nodes</td></tr><tr><td align="center">6</td><td>How many tools and malware in total are linked to the previously identified campaigns? (number)</td><td><mark style="color:blue;"><strong><code>9</code></strong></mark></td><td>CTI Graph - count tools + malware across all 5 campaigns (2+1+2+2+2)</td></tr><tr><td align="center">7</td><td>It appears that the threat actor has always used the same malware in their campaigns. What is its SHA-256 hash? (sha-256 hash)</td><td><mark style="color:blue;"><strong><code>7477c4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d17477</code></strong></mark></td><td>CTI Graph - most frequent malware hash across campaigns</td></tr><tr><td align="center">8</td><td>Browse to the second IP:port address and use the CogWork Security Platform to look for the hash and locate the IP address to which the malware connects. (Credentials: nvale/CogworkBurning!)</td><td><mark style="color:blue;"><strong><code>74.77.74.77</code></strong></mark></td><td>Security Platform - search hash, check Network section for C2 IP</td></tr><tr><td align="center">9</td><td>What is the full path of the file that the malware created to ensure its persistence on systems? (/path/filename.ext)</td><td><mark style="color:blue;"><strong><code>/opt/lilnunc/implant/4a4d_persistence.sh</code></strong></mark></td><td>Security Platform - same malware page, check persistence details</td></tr><tr><td align="center">10</td><td>Finally, browse to the third IP:port address and use the CogNet Scanner Platform to discover additional details about the TA's infrastructure. How many open ports does the server have?</td><td><mark style="color:blue;"><strong><code>11</code></strong></mark></td><td>CogNet Scanner - search C2 IP, count open services in device card</td></tr><tr><td align="center">11</td><td>Which organization does the previously identified IP belong to? (string)</td><td><mark style="color:blue;"><strong><code>SenseShield MSP</code></strong></mark></td><td>CogNet Scanner - same device page, check WHOIS/ownership info</td></tr><tr><td align="center">12</td><td>One of the exposed services displays a banner containing a cryptic message. What is it? (string)</td><td><mark style="color:blue;"><strong><code>He's a ghost I carry, not to haunt me, but to hold me together - NULLINC REVENGE</code></strong></mark></td><td>CogNet Scanner - check service banners for cryptic message</td></tr></tbody></table>

## what we have?

We were given 3 portals for investigation.

{% hint style="info" %}
Portals
{% endhint %}

{% tabs %}
{% tab title="CogWork-Intel Graph (OmniYard-3)" %}

* **Features:** Graph analysis of threat campaigns, indicators, tools, and malware
* **Used for:** Mapping attack campaigns and counting linked threats (Flags 5-7)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FZKJaaBHjw8l8uQRwHELf%2Fimage.png?alt=media&#x26;token=dfd357fa-ca5e-41e4-9923-cd828fb0dcca" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="CogWork Security Platform" %}

* **Features:** Hash lookup, malware details, C2 infrastructure, persistence mechanisms
* **Used for:** Analyzing malware samples and finding C2 servers (Flags 8-9)
* (Credentials: nvale/CogworkBurning!)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FMyeYKqv0n3ORu8bB8AAG%2Fimage.png?alt=media&#x26;token=8588ce3c-3b3a-4fcd-983e-f8dbe1915722" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="CogNet Scanner Platform" %}

* **Features:** Port scanning, service enumeration, WHOIS lookups, banner grabbing
* **Used for:** Profiling attacker infrastructure and finding hidden messages (Flags 10-12)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FPcPFpZN7eDFP1wud1ook%2Fimage.png?alt=media&#x26;token=9ecbae93-973d-4669-a48b-1090009ea399" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

Okay lets see what we are provided first before reading the questions.

{% hint style="info" %}
Logs
{% endhint %}

<details>

<summary>access.log</summary>

* User-Agent strings (**identifies the client making the request** to the server.)

- GET/POST requests

* File downloads (like `database_dump_4A4D.sql`)

- Response codes and file sizes

* Timestamps and source IPs
* i.e,

{% code overflow="wrap" %}

```
2025-05-01 08:23:12 121.36.37.224 - - [01/May/2025:08:23:12 +0000] "GET /robots.txt HTTP/1.1" 200 847 "-" "Lilnunc/4A4D - SpecterEye"
2025-05-01 08:23:45 121.36.37.224 - - [01/May/2025:08:23:45 +0000] "GET /sitemap.xml HTTP/1.1" 200 2341 "-" "Lilnunc/4A4D - SpecterEye"
...
```

{% endcode %}

</details>

<details>

<summary>waf.log</summary>

**Contains:** Web Application Firewall (WAF) detection and bypass logs

* Web shell deployment detection
* Database download attempts
* Beacon callback activity
* Rule bypasses by the attacker
* i.e,

{% code overflow="wrap" %}

```
2025-05-01 08:23:12 [INFO] webapp.security.scanner - Potential reconnaissance detected from 121.36.37.224 - sequential resource enumeration
2025-05-01 08:24:12 [WARN] webapp.auth.handler - Failed login attempt from 121.36.37.224 - invalid endpoint access
...
```

{% endcode %}

</details>

<details>

<summary>application.log</summary>

**Contains:** Application-level security events and critical alerts

* Web shell deployment commands
* Backdoor creation events
* Cron job installations
* Debug endpoint abuse
* Critical security violations
* i.e,

{% code overflow="wrap" %}

```
2025-05-01 08:23:12 [INFO] waf.scanner - IP 121.36.37.224 - Rule: RECONNAISSANCE_DETECTION - Action: MONITOR - Sequential resource enumeration pattern detected
2025-05-01 08:24:12 [WARN] waf.scanner - IP 121.36.37.224 - Rule: ADMIN_PATH_ACCESS - Action: BLOCK - Attempt to access administrative endpoints
...
```

{% endcode %}

</details>

Now that we know the basics of those log files. Lets go through each question

## solulu

### flag 1

> **Analyze the provided logs and identify what is the first User-Agent used by the attacker against Nicole Vale’s honeypot. (string)**

* If you read the logs definition above hehe. Our focus should be in the `access.log` to find the User-Agent, and we quickly confirmed our answer to be at the first line.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FIyaFQjWLmemKoQxJbfZZ%2Fimage.png?alt=media&#x26;token=53a107e7-ae8d-45c0-8836-379b04305b63" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`Lilnunc/4A4D - SpecterEye`**</mark>

### flag 2

> It appears the threat actor deployed a web shell after bypassing the WAF. What is the file name? (filename.ext)

As mentioned, this time we will be reading the web application firewall log (waf.log) when we need to look for a web shell event. And voila, its indeed detected a web shell has been created. And the file name also has been recorded too (how did our system detects it? — magic idk)

* In the `application.log`

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FvNWQXYqCYOUmZZGbVy4c%2Fimage.png?alt=media&#x26;token=2b92e9c4-3ab7-4c85-abd5-01ca3bdccd5f" alt=""><figcaption></figcaption></figure>

* In the `waf.log`

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FIq2g8ujOGBZRuHS0fZHZ%2Fimage.png?alt=media&#x26;token=3664a736-40e8-49bd-9961-770108bf3bfc" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`temp_4A4D.php`**</mark>

### flag 3

> The threat actor also managed to exfiltrate some data. What is the name of the database that was exfiltrated? (filename.ext)

After staging data through the shell, large downloads follow. The WAF and access logs call out the loot:

* In the `waf.log`

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FpMqrWxzynxuMpY7aBdQd%2Fimage.png?alt=media&#x26;token=9f3b67e2-7480-47e2-b532-91251bfa4157" alt=""><figcaption></figcaption></figure>

* In the `access.log`

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FH4jmHZcTCCRPcBX5MXBP%2Fimage.png?alt=media&#x26;token=9042e127-5789-4715-8e79-a4dbbd944a98" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`database_dump_4A4D.sql`**</mark>

Alternative: a grep command of those logs file of anything related to database.

### flag 4

> **During the attack, a seemingly meaningless string seems to be recurring. Which one is it? (string)**

We see the string 4A4D repeated over and over again from flag 1 - 3. This is what make it interesting, I love the reference in this question, the answer simply is hex --> ascii of JM (yea...him). I absolutely choked when I realized the reference

**Convert each hex pair to decimal**:

* `4A` hex = (4 × 16) + (10) = 64 + 10 = 74 (J)
* `4D` hex = (4 × 16) + (13) = 64 + 13 = 77 (M)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FUgfVaqnJ20eomw27gK2w%2Fimage.png?alt=media&#x26;token=ada0db53-119c-4102-8d5b-02241145ffd8" alt="" width="375"><figcaption></figcaption></figure>

*

Flag: <mark style="color:blue;">**`4A4D`**</mark>

### flag 5

> **OmniYard-3 (formerly Scotland Yard) has granted you access to its CTI platform. Browse to the first IP:port address and count how many campaigns appear to be linked to the honeypot attack.**

Go to the portal that matches CTI Graph (see portals above). In Graph Analysis, search `temp_4A4D.php`, `4A4D` and open the honeypot indicator node.

* Count connected `Campaign` nodes.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2F2HqnbUEkQm3bVJvZTEik%2Fimage.png?alt=media&#x26;token=222f2efb-a0b6-4e1c-b9d7-e079167d771a" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`5`**</mark>

### flag 6

> **How many tools and malware in total are linked to the previously identified campaigns? (number)**

So 5 campaigns right, we have to check what links them. From the campaigns found in Flag 5, enable Types filter for `Tool` and `Malware` and tally them. They have a distinct icon.

* quantum heist: 1 malware (quantumcoin stealer), 1 tool (quantumkeyx)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FmhjZPKY802WOIr49trKv%2Fimage.png?alt=media&#x26;token=3061784e-e840-46b4-9381-cb5736bd7352" alt=""><figcaption></figcaption></figure>

* transport chaos: 1 malware (vehicle chaos engine),

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FwKKzwwVekGnn1UCHC9n2%2Fimage.png?alt=media&#x26;token=2b9de8e1-e3db-49bc-9205-0f383884185d" alt=""><figcaption></figcaption></figure>

* civil disruption: 1 tool (1citymap infiltrator), 1 malware (city wide disruption)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FJrNaOjFHs3lMWIq6nzb1%2Fimage.png?alt=media&#x26;token=db3becdc-6d1a-492b-8faf-dc075cc95922" alt=""><figcaption></figcaption></figure>

* bio breach: 1 tool (medsys probe), 1 malware (biometric falsier)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FoSYzcNYoBhRRutz4wB46%2Fimage.png?alt=media&#x26;token=b2816dc6-cf54-4e36-ba40-99bbc0d7a095" alt=""><figcaption></figcaption></figure>

* operation neutral storm: 1 tool (neuro scan pro), 1 malware (neuro storm implant)

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FmodCMOv0iM0HtrLPmi2B%2Fimage.png?alt=media&#x26;token=e0b789fe-0814-40db-9b0e-26efbe144468" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`9`**</mark>

### flag 7

> **It appears that the threat actor has always used the same malware in their campaigns. What is its SHA-256 hash? (sha-256 hash)**

I wasn't clicking the thing so I simply from the shared malware node across campaigns, export to get the json of all. The appreance of this sha is the most frequent

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FICcMW8oAqTGwp7vaZ7NS%2Fimage.png?alt=media&#x26;token=dd892ce6-222a-43fe-9e84-3323b650f6d0" alt=""><figcaption></figcaption></figure>

* We will use this hash in Flag 8.

Flag: <mark style="color:blue;">**`7477c4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d17477`**</mark>

### Flag 8

> Browse to the second IP:port address and use the CogWork Security Platform to look for the hash and locate the IP address to which the malware connects. (Credentials: nvale/CogworkBurning!) Use the Security Platform to look up the hash and locate the IP to which the malware connects.

* Open the portal that shows the `CogWork Security` (the 2nd one)
* Log in with **`nvale` / `CogworkBurning!`**.
* Paste the hash from flag 7 into search; open the malware page; in Network Communication , note the IP.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FIxKxc4XjLUDX5gJuDD7P%2Fimage.png?alt=media&#x26;token=119e250c-da56-44f2-82a9-0957b299eef0" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`74.77.74.77`**</mark>

### flag 9

> What is the full path of the file that the malware created to ensure its persistence on systems? (/path/filename.ext)

In the same malware page, click to see details.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2Fk6ullQM21oMkGRzSySA6%2Fimage.png?alt=media&#x26;token=f2c8e25a-ad2d-4a30-b000-a943d42e56c0" alt=""><figcaption></figcaption></figure>

We found a section on File Operations, well that is pretty much our flag. I mean have you read the name of the shell script lol.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FbD5Xu74PIMwg1hf7tzgk%2Fimage.png?alt=media&#x26;token=23ba36e0-c0c5-4fe7-8361-5fb94c742fbd" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`/opt/lilnunc/implant/4a4d_persistence.sh`**</mark>

### flag 10

> Finally, browse to the third IP:port address and use the CogNet Scanner Platform to discover additional details about the TA's infrastructure. How many open ports does the server have?

Open the portal `CogNet Scanner` (the 3rd also the last one we were provided). Use the IP from Flag 8 for investigation. Open "Details" to view the "Open Ports", and count them.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2Fvp0W8MfetMUSBeSgYEj4%2Fimage.png?alt=media&#x26;token=c5a3212b-44ff-4153-a65e-83bd7d13190e" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">`11`</mark> (open ports)

### flag 11

> Which organization does the previously identified IP belong to? (string) Which organization does that IP belong to?

In the device detail, read ownership/WHOIS section.

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FclsJJVDtNSApi5H6Sm2x%2Fimage.png?alt=media&#x26;token=ee6ecb6a-1730-4b8b-a292-717fe0db66f9" alt=""><figcaption></figcaption></figure>

Flag: <mark style="color:blue;">**`SenseShield MSP`**</mark>

### flag 12

> One of the exposed services displays a banner containing a cryptic message. What is it? (string) One exposed service shows a banner with a cryptic message; capture it.

In the service list, click each service and read the banner; copy exact text. Make sure you clicked on the Services tab

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FHuzGTcOqCxamof5TKll4%2Fimage.png?alt=media&#x26;token=ba051a6e-f443-4276-adb6-98da0de395ac" alt=""><figcaption></figcaption></figure>

Flag (banner): <mark style="color:blue;">**`He's a ghost I carry, not to haunt me, but to hold me together - NULLINC REVENGE`**</mark>

<figure><img src="https://2268275695-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUrHD5lu5pQjrB9B8IR6W%2Fuploads%2FD0oH61SaZN2u8lIMbNTz%2Fimage.png?alt=media&#x26;token=cffc5772-d93b-405b-8602-e3135532a002" alt="" width="375"><figcaption><p>case closed.</p></figcaption></figure>
