Challenge Name: SSH Compromised

Category: Incident Handling Challenge
Points: 500

Approach

Unzip the file:
```
gunzip rawlog.tar.gz
```
Extract the tar file:
```
tar -xvf rawlog.tar
```
Analyze the auth.log file:
```
cat auth.log
```

Observe repeated log messages from different IPs and ports:

Jul 27 05:02:32 vmprod-uat-01 sshd[153942]: Failed password for root from 149.102.244.68 port 8352 ssh
Jul 27 05:02:33 vmprod-uat-01 sshd[153942]: Connection closed by authenticating user root 149.102.244.68 port 8352 [preauth]

Check for successful login attempts: If the intruder gained access, there should be logs for accepted passwords.

Search for “Accepted password” in auth.log:

cat auth.log | grep "Accepted password"

Jul 27 05:02:26 vmprod-uat-01 sshd[153863]: Accepted password for sysadmin from 149.102.244.68 port 7153 ssh

Get the flag

flag : ihack24{149.102.244.68_sysadmin}