Reconstruct the Intrusion: From Access Log to Webshell

HardDigital Forensics & Incident Response45-60 min

The brief

The web team found a PHP file in the uploads directory that nobody wrote. The box hasn't been rebuilt and the full nginx access log (/var/log/nginx/access.log) is intact — thousands of lines of normal traffic with the whole intrusion buried inside it.

Reconstruct what happened, in order, and record it in two files under /root/case:

/root/case/attacker_ip.txt — just the attacker's IP address (one address; a copy of log lines is not an answer).
/root/case/findings.txt — your own notes (free text, up to 60 lines): the exploited entry-point path, the webshell's full path on disk (not just its URL), and the commands they ran through it.

1. Separate signal from noise — find the one client that stopped scanning and started succeeding.

2. Find the entry point — the request that WORKED (a 200/302) where everything else 404'd.

3. Find the webshell they dropped, on disk.

4. Recover what they ran, from the ?cmd= query strings in the log.

5. Remove the webshell — without breaking the legitimate site next to it.

The log is big on purpose; grep, awk, sort, uniq -c, and cut are how you make it small.

What you'll do

Identify the attacker's IP (the client that pivoted from scanning to succeeding) and record it to /root/case/attacker_ip.txt
Identify the exploited entry-point endpoint and record it to /root/case/findings.txt
Locate the dropped webshell on disk and record its path to /root/case/findings.txt
Recover what the attacker ran through the webshell (from the ?cmd= query strings) and record it
Remove the webshell without deleting the legitimate site
Leave the legitimate site (index.php) intact

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.