Table of contents
Decompress the log file:
$ gunzip webserver.log.gz
Let’s begin with the classic commands :
$ ls -lah webserver.log
-rwxrwx--- 1 root vboxsf 6.0M Apr 4 17:33 webserver.log*
$ wc -l webserver.log
25470 webserver.log
$ head -n 3 webserver.log
May 6 17:06:50 front web-server mywebsite:80 127.0.0.1 - - [06/May/2025:17:06:50 +0000] "GET / HTTP/1.0" 200 2272 "https://jurisdefense.intra-support.info/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"
May 6 17:19:48 front web-server mywebsite:80 127.0.0.1 - - [06/May/2025:17:19:48 +0000] "GET / HTTP/1.0" 403 379 "https://13.39.83.80/ab2g" "Mozilla/5.0 zgrab/0.x"
May 6 17:19:48 front web-server mywebsite:80 127.0.0.1 - - [06/May/2025:17:19:48 +0000] "GET / HTTP/1.0" 403 379 "https://13.39.83.80/ab2h" "Mozilla/5.0 zgrab/0.x"
Well, we have a classic web server log file, with a lot of lines.
I took an exploratory approach to the log file, with a few greps.
I finally adopted a filtering approach, to remove all the noise and focus on the interesting lines.
For this, grep have a very useful option: -v, which allows to invert the match and remove the lines matching a pattern.
404 and 403 status codes are not interesting, as they indicate failed requests.
$ grep -v -E "404 | 403 " webserver.log | wc -l
1833
We removed more than 90% of the lines, which is a good start !
2272 is the size of the homepage, so we can filter it out to focus on other requests.
Then finishing by removing some other recurrent paths that are not interesting for us : /user*, /avocat*, /styles.css and /logo.jpeg.
That gives us the following command :
$ grep -v -E "404 | 403 | 2272 |/user|/avocat|/styles.css|/logo.jpeg" webserver.log | less
Which gives us only 28 lines, which we can humanly read and analyze.
May 7 00:39:37 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:39:37 +0000] "GET /server-status HTTP/1.0" 200 3084 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 7 00:39:58 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:39:58 +0000] "GET /ghost/#/dashboard HTTP/1.0" 400 408 "-" "-"
May 7 00:40:00 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:00 +0000] "GET /template?code={% raw" 400 408 "-" "-"
May 7 00:40:00 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:00 +0000] "GET /tpl?body={% print(7*7)" 400 408 "-" "-"
May 7 00:40:00 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:00 +0000] "GET /api/data?Authorization=Bearer null" 400 408 "-" "-"
May 7 00:40:01 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:01 +0000] "GET /headers/add?Authorization=Bearer injected_token" 400 408 "-" "-"
May 7 00:40:01 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:01 +0000] "GET /ws-admin/command?run=DELETE /admin" 400 408 "-" "-"
May 7 00:40:11 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:11 +0000] "GET /tpl?body={% print('whoami')" 400 408 "-" "-"
May 7 00:40:11 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:11 +0000] "GET /template?code={{ self" 400 408 "-" "-"
May 7 00:40:21 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:21 +0000] "GET /?asset=../../../../home/webserver/.ssh/id_rsa HTTP/1.0" 200 2500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 7 00:40:22 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:22 +0000] "GET /?asset=../../../../home/webserver/.ssh/known_hosts HTTP/1.0" 200 2750 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 8 00:06:52 front web-server mywebsite:80 127.0.0.1 - - [08/May/2025:00:06:52 +0000] "GET /server-status HTTP/1.0" 200 3005 "-" "Go-http-client/1.1"
May 9 21:28:06 front web-server mywebsite:80 127.0.0.1 - - [09/May/2025:21:28:06 +0000] "GET /server-status HTTP/1.0" 200 3169 "-" "Go-http-client/1.1"
May 11 14:08:25 front web-server mywebsite:80 127.0.0.1 - - [11/May/2025:14:08:25 +0000] "HEAD / HTTP/1.0" 200 302 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
May 11 14:08:26 front web-server mywebsite:80 127.0.0.1 - - [11/May/2025:14:08:26 +0000] "HEAD / HTTP/1.0" 200 302 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
May 11 21:19:34 front web-server mywebsite:80 127.0.0.1 - - [11/May/2025:21:19:34 +0000] "GET /server-status HTTP/1.0" 200 3158 "-" "Go-http-client/1.1"
May 12 08:33:14 front web-server mywebsite:80 127.0.0.1 - - [12/May/2025:08:33:14 +0000] "OPTIONS / HTTP/1.0" 200 181 "-" "-"
May 12 20:58:35 front web-server mywebsite:80 127.0.0.1 - - [12/May/2025:20:58:35 +0000] "GET /server-status HTTP/1.0" 200 3175 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 13 21:12:27 front web-server mywebsite:80 127.0.0.1 - - [13/May/2025:21:12:27 +0000] "GET /server-status HTTP/1.0" 200 3149 "-" "Go-http-client/1.1"
May 14 16:35:24 front web-server mywebsite:80 127.0.0.1 - - [14/May/2025:16:35:24 +0000] "GET /server-status HTTP/1.0" 200 3138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 15 11:04:55 front web-server mywebsite:80 127.0.0.1 - - [15/May/2025:11:04:55 +0000] "GET /server-status HTTP/1.0" 200 3196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 15 21:11:58 front web-server mywebsite:80 127.0.0.1 - - [15/May/2025:21:11:58 +0000] "GET /server-status HTTP/1.0" 200 3323 "-" "Go-http-client/1.1"
May 16 04:34:08 front web-server mywebsite:80 127.0.0.1 - - [16/May/2025:04:34:08 +0000] "HEAD / HTTP/1.0" 200 302 "-" "curl/7.54.0"
May 17 05:23:16 front web-server mywebsite:80 127.0.0.1 - - [17/May/2025:05:23:16 +0000] "HEAD / HTTP/1.0" 200 302 "-" "curl/7.81.0"
May 17 20:15:22 front web-server mywebsite:80 127.0.0.1 - - [17/May/2025:20:15:22 +0000] "GET /server-status HTTP/1.0" 200 3497 "-" "Go-http-client/1.1"
May 19 08:30:07 front web-server mywebsite:80 127.0.0.1 - - [19/May/2025:08:30:07 +0000] "OPTIONS / HTTP/1.0" 200 181 "-" "-"
May 19 20:58:48 front web-server mywebsite:80 127.0.0.1 - - [19/May/2025:20:58:48 +0000] "GET /server-status HTTP/1.0" 200 3345 "-" "Go-http-client/1.1"
May 21 21:09:24 front web-server mywebsite:80 127.0.0.1 - - [21/May/2025:21:09:24 +0000] "GET /server-status HTTP/1.0" 200 3218 "-" "Go-http-client/1.1"
Two lines immediately catch the eye:
May 7 00:40:11 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:11 +0000] "GET /template?code={{ self" 400 408 "-" "-"
May 7 00:40:21 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:21 +0000] "GET /?asset=../../../../home/webserver/.ssh/id_rsa HTTP/1.0" 200 2500 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
May 7 00:40:22 front web-server mywebsite:80 127.0.0.1 - - [07/May/2025:00:40:22 +0000] "GET /?asset=../../../../home/webserver/.ssh/known_hosts HTTP/1.0" 200 2750 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
After a quick research, the vulnerability here is CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). Hence the following flag.
Flag
FCSC{CWE-22-05/07-/?asset=../../../../home/webserver/.ssh/id_rsa-/?asset=../../../../home/webserver/.ssh/known_hosts}