# Portal Drop - subdomain, grep, EDR, Access Log Analysis (TryHackMe)

Link to the challenge on TryHackMe: [Portal Drop](https://tryhackme.com/room/portaldrop)

> You are on the day shift in the ProbablyFine when the monitoring dashboard flashes red. A new alert appears in the WAF summary, reporting a web scan on `crm.trypatchme.thm` followed by a suspicious file upload anomaly. The affected website is TryPatchMe's public-facing CRM portal, a valued customer who provides software patching consulting services.
> 
> That should be an easy case, since you have access to both the web access logs and the EDR console. Combined, they should give you a clear answer: either it's a False Positive, or the portal has been breached and TryPatchMe needs to patch the CRM now!

### Answer the questions below

### What is the IP address that initiated the brute force on the CRM web portal?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/f10b4686-0e24-4e74-b13e-b705b2f9cf1a.png align="center")

```markdown
34.67.91.83 - - [06/Nov/2025:14:27:32 +0000] "POST /CRM/portal/upload.php HTTP/1.1" 200 826 "https://crm.trypatchme.thm" "python-requests/2.31.0"
```

How many successful and failed logins are seen in the logs?  
Answer Example: 42, 56

```markdown
grep "login.php" access-combined-crm-1767978582478-1768841821765.log | grep -c '" 200 '
18

grep "login.php" access-combined-crm-1767978582478-1768841821765.log | grep -c '" 401 '
35
```

Following the brute force, which user-agent was used for the file upload?

```markdown
34.67.91.83 - - [06/Nov/2025:14:27:32 +0000] "POST /CRM/portal/upload.php HTTP/1.1" 200 826 "https://crm.trypatchme.thm" "python-requests/2.31.0"
```

What was the name of the suspicious file uploaded by the attacker?

```markdown
34.67.91.83 - - [06/Nov/2025:14:27:34 +0000] "POST /CRM/portal/uploads/invoice.php?q=ZDJodllXMXA&auth=31337 HTTP/1.1" 200 29 "https://crm.trypatchme.thm" "python-requests/2.31.0"
```

At what time did the attacker first invoke the uploaded script?  
Answer Example: 2025-10-24 15:35:50 `2025-11-06 14:27:34`

What is the first decoded command the attacker ran on the CRM? `whoami`

Based on the attacker’s activity on the CRM, which MITRE ATT&CK Persistence sub-technique ID is most applicable?

```markdown
You don't need to search by "CRM" or "upload" — think about what the attacker achieved with
invoice.php.

The attacker placed a PHP script on the server to maintain access and execute commands remotely. That maps directly to:

T1505.003 — Server Software Component: Web Shell

▎ Adversaries may backdoor web servers with web shells to establish persistent access. A web
▎  shell is a web script placed on an openly accessible web server to allow an adversary to
▎ use the web server as a gateway into a network.

---

Why this fits perfectly:

┌─────────────────────────────────────────────────┬──────────────────────────────┐
│                 Evidence in log                 │        MITRE mapping         │

├─────────────────────────────────────────────────┼──────────────────────────────┤

│ uploads/invoice.php — PHP file placed on server │ Web shell planted            │

├─────────────────────────────────────────────────┼──────────────────────────────┤

│ ?q=ZDJodllXMXA — encoded command execution      │ Remote command via shell     │

├─────────────────────────────────────────────────┼──────────────────────────────┤

│ &auth=31337 — gated access                      │ Exclusive backdoor           │

├─────────────────────────────────────────────────┼──────────────────────────────┤

│ python-requests — scripted interaction          │ Automated C2 via web shell   │

├─────────────────────────────────────────────────┼──────────────────────────────┤

│ HTTP 200 response                               │ Shell is live and persistent │
└─────────────────────────────────────────────────┴──────────────────────────────┘

Answer: T1505.003

Parent technique is T1505 (Server Software Component), under the Persistence tactic —

exactly what the question asks for.
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/c8f8258f-2290-4e70-a719-c1fbf734e4e0.png align="center")

Which process image executes attacker commands received from the web?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/1e75720e-c261-411e-ae2a-2ee95fca0a1b.png align="center")

What command allowed the attacker to open a bash reverse shell?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/c18cf765-114e-4257-abec-7f0787d4186e.png align="center")

Which Linux user executes the entered malicious commands?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/5c991d08-e6e0-422c-a1a2-a34ba2ba897d.png align="center")

What sensitive CRM configuration file did the attacker access? 

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4cb26f4f-4f75-4e27-b653-8107c67e5f85.png align="center")

Which domain was used to exfiltrate the CRM portal database?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4bbbabe4-7db2-4f58-aa06-73a039fc70be.png align="center")

After responding to all detections, what flag do you obtain?

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/1591959f-0c2a-43ae-9f2a-f6ee246d3436.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/de169bd6-d185-4a46-872c-8c75bc0453f8.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/fc57ddae-072d-4bd3-9caf-2b5cdd316611.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4c79f4c8-f416-42c3-aed9-892d1dd08087.png align="center")