Portal Drop - subdomain, grep, EDR, Access Log Analysis (TryHackMe)
Link to the challenge on TryHackMe: Portal Drop
You are on the day shift in the ProbablyFine when the monitoring dashboard flashes red. A new alert appears in the WAF summary, reporting a web scan on
crm.trypatchme.thmfollowed by a suspicious file upload anomaly. The affected website is TryPatchMe's public-facing CRM portal, a valued customer who provides software patching consulting services.That should be an easy case, since you have access to both the web access logs and the EDR console. Combined, they should give you a clear answer: either it's a False Positive, or the portal has been breached and TryPatchMe needs to patch the CRM now!
Answer the questions below
What is the IP address that initiated the brute force on the CRM web portal?
34.67.91.83 - - [06/Nov/2025:14:27:32 +0000] "POST /CRM/portal/upload.php HTTP/1.1" 200 826 "https://crm.trypatchme.thm" "python-requests/2.31.0"
How many successful and failed logins are seen in the logs?
Answer Example: 42, 56
grep "login.php" access-combined-crm-1767978582478-1768841821765.log | grep -c '" 200 '
18
grep "login.php" access-combined-crm-1767978582478-1768841821765.log | grep -c '" 401 '
35
Following the brute force, which user-agent was used for the file upload?
34.67.91.83 - - [06/Nov/2025:14:27:32 +0000] "POST /CRM/portal/upload.php HTTP/1.1" 200 826 "https://crm.trypatchme.thm" "python-requests/2.31.0"
What was the name of the suspicious file uploaded by the attacker?
34.67.91.83 - - [06/Nov/2025:14:27:34 +0000] "POST /CRM/portal/uploads/invoice.php?q=ZDJodllXMXA&auth=31337 HTTP/1.1" 200 29 "https://crm.trypatchme.thm" "python-requests/2.31.0"
At what time did the attacker first invoke the uploaded script?
Answer Example: 2025-10-24 15:35:50 2025-11-06 14:27:34
What is the first decoded command the attacker ran on the CRM? whoami
Based on the attacker’s activity on the CRM, which MITRE ATT&CK Persistence sub-technique ID is most applicable?
You don't need to search by "CRM" or "upload" — think about what the attacker achieved with
invoice.php.
The attacker placed a PHP script on the server to maintain access and execute commands remotely. That maps directly to:
T1505.003 — Server Software Component: Web Shell
▎ Adversaries may backdoor web servers with web shells to establish persistent access. A web
▎ shell is a web script placed on an openly accessible web server to allow an adversary to
▎ use the web server as a gateway into a network.
---
Why this fits perfectly:
┌─────────────────────────────────────────────────┬──────────────────────────────┐
│ Evidence in log │ MITRE mapping │
├─────────────────────────────────────────────────┼──────────────────────────────┤
│ uploads/invoice.php — PHP file placed on server │ Web shell planted │
├─────────────────────────────────────────────────┼──────────────────────────────┤
│ ?q=ZDJodllXMXA — encoded command execution │ Remote command via shell │
├─────────────────────────────────────────────────┼──────────────────────────────┤
│ &auth=31337 — gated access │ Exclusive backdoor │
├─────────────────────────────────────────────────┼──────────────────────────────┤
│ python-requests — scripted interaction │ Automated C2 via web shell │
├─────────────────────────────────────────────────┼──────────────────────────────┤
│ HTTP 200 response │ Shell is live and persistent │
└─────────────────────────────────────────────────┴──────────────────────────────┘
Answer: T1505.003
Parent technique is T1505 (Server Software Component), under the Persistence tactic —
exactly what the question asks for.
Which process image executes attacker commands received from the web?
What command allowed the attacker to open a bash reverse shell?
Which Linux user executes the entered malicious commands?
What sensitive CRM configuration file did the attacker access?
Which domain was used to exfiltrate the CRM portal database?
After responding to all detections, what flag do you obtain?
