An external contractor accessed the internal Forela forum using the Guest Wi-Fi. They appear to have stolen administrative credentials, escalated their privileges, and downloaded sensitive database information. This investigation looks at the forum logs and the SQLite3 database dump (bumblebee.zip) to find out what happened, who was responsible, and how to prevent it from happening again.

Evidence Provided:

• bumblebee.zip (83 KB) – forum logs "access.log" and SQLite3 database dump "phpbb.sqlite3"

---

Scope

This investigation focuses on:

• Identifying the contractor.
• Tracking their activity in the forum.
• Finding any stolen credentials or malicious posts.
• Checking if they accessed administrator privileges or downloaded sensitive data.
• Reconstructing a timeline of their actions.

It does not cover:

• Physical security of Wi-Fi.
• Actions outside the forum system.
• Users unrelated to the contractor or the admin account.

---

Investigation Goals

The investigation aims to answer these questions:

1. What was the contractor’s username?
2. What IP address did they use to create their account?
3. What is the post_id of the malicious post?
4. What is the full URI where stolen credentials were sent?
5. When did the contractor log in as the administrator (UTC)?
6. What is the LDAP password stored in the forum database?
7. What is the administrator’s user agent?
8. When did the contractor add themselves to the Administrator group (UTC)?
9. When did they download the database backup (UTC)?
10. What was the database backup size in bytes as shown in the logs?

---

How We Investigated

Log Analysis

• Looked at forum logs for suspicious IP addresses, account creation, login events, and file downloads.
• Matched timestamps and actions to see what the contractor did.

Database Analysis

• Checked the SQLite3 database for user accounts, posts, and group changes.
• Looked for malicious scripts and any plaintext credentials.

Cross-Checking Data

• Compared logs with database records to make sure the timeline is accurate.
• Verified IP addresses, user agents, and timestamps matched across sources.

Timeline Creation

• Made a step-by-step timeline of the contractor’s activity, including posts, privilege changes, and downloads.

---

5. Key Findings

• Contractor Account: The username of the external contractor is apoole1.
• Contractor IP Address: The contractor created their account using IP 10.10.0.78.
• Malicious Post: The post ID of the malicious post made by the contractor is 9.
• Credential Exfiltration URI: The data stolen by the contractor was sent to http://10.10.0.78/update.php.
• Administrator Login: The contractor logged into the forum as the administrator on 2023-04-26 10:53:12 UTC.
• LDAP Password: The plaintext password for the LDAP connection found in the forum is Passw0rd1.
• Administrator User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
• Privilege Escalation: The contractor added themselves to the Administrator group on 2023-04-26 10:53:51 UTC.
• Database Backup Download: The contractor downloaded the database backup on 2023-04-26 11:01:38 UTC.
• Database Backup Size: The size of the database backup as recorded in access.log is 34,707 bytes.

---

Impact

• Unauthorized access to admin accounts and sensitive data.
• Potential compromise of authentication systems.
• Exposure of internal infrastructure information.
• High risk of further attacks if stolen data is used.

This is a serious security incident.

---

Recommendations

Improve Access Control

• Limit Guest Wi-Fi access to prevent internal system access.
• Use multi-factor authentication for all admin accounts.

Better Monitoring

• Track unusual login activity and privilege changes.
• Set up alerts for database downloads or access to sensitive data.

Secure Credentials

• Store LDAP and other credentials encrypted, not in plaintext.
• Change admin and service passwords regularly.

Incident Response

• Review this incident and update security procedures.
• Keep logs comprehensive for faster investigations in the future.

---

Conclusion

By analyzing the forum logs and database, we can see exactly what the contractor did: they stole credentials, escalated privileges, and downloaded sensitive data. Immediate action is needed to fix security gaps and prevent similar incidents in the future.

---

This write-up "Investigation Report" is by @achnouri