> For the complete documentation index, see [llms.txt](https://szczygielka.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://szczygielka.gitbook.io/writeups/ctfs-writeups/0xl4ugh-ctf-2024/wordpress-2-forensics.md).
# Wordpress - 2 - Forensics
## Task
Q1. During enumeration, the attacker tried to identify users on the site. List all the users that the attacker enumerated. (seperate them with :),(sort them by alphapitical order)
Q2. After enumeration, a brute force attack was launched against all users. The attacker successfully gained access to one of the accounts. What are the username and password for that account, and what is the name of the page used for the brute force attack?
Flag Format: **0xL4ugh{A1\_A2}**
Example: 0xL4ugh{username1:username2\_username:password\_pageName.ext}
## Solution
From the content of `WordPress - 1` task we know that the WordPress website had a security breach. In the `WordPress 1` task, I determined the IP address of the victim, i.e. `192.168.204.128` and the IP addresses of both attackers: `192.168.204.132` and `192.168.204.1`. This knowledge will be useful to us in solving this task.
We will filter the results to receive all `POST` HTTP requests sent to the IP address `192.168.204.128`. We can see that at least several login attempts were made from the IP address `192.168.204.132` belonging to one of the attackers. The attacker tried to log in as:
1. user `not7amoksha`:
2. user `a1l4m`:
3. user `demomorgan`:
After filtering for HTTP traffic we can see that the attacker enumerated the values of the `author` variable:
Let's examine the HTTP stream for the selected package number `88288`. By following the HTTP stream to get queries about the author with a given number, we can see that for queries with index 1 and 2, the response `301 Moved Pernamently` is returned. Additionally, `GET` `/wordpress/author/` queries for users `a1l4m` and `not7amoksha` returned responses `200 OK`, which proves that such authors exist:
In the same HTTP stream, we can notice that a request for an author with index 3 returns a response `200 OK`. In the content of the response, we can see information proving that the third user is `demomorgan`:
Sorted 3 users alphabetically:
```
a1l4m demomorgan not7amoksha
```
Now let's look for more information about the brute force attack carried out. After filtering the results for the HTTP `POST` method, we can see that almost all queries were sent to `/wordpress/xmlrpc.php`:
The time between individual HTTP requests is small, which also indicates the brute force attack. So the webpage used to brute force attack is:
```
xmlrpc.php
```
If the attacker was searching for users on the website, he certainly wanted to use usernames to conduct a brute force attack. So let's search in packet details strings containing names of users.
Let's check the contents of the example `POST` request along with the response for the query that might contain an attempt to force a password for the user `a1l4m`:
Based on the response received this looks like a failed login attempt. The remaining responses to failed login attempts are as follows:
Based on responses for invalid login attempts let's try to exclude all responses that have a length 674. After excluding we get 6 packets:
In the last package, we found information that may indicate that the login was successful, i.e. the value of the `isAdmin` variable is set to `0`:
Let's follow the stream for this packet. In the `POST` request we can find credentials:
The login details from the `POST` request are as follows:
```
demomorgan:demomorgan
```
We've gathered all the information you need to get your flag.
Flag:
```
0xL4ugh{a1l4m:demomorgan:not7amoksha_demomorgan:demomorgan_xmlrpc.php}
```
