WordPress - 1

[Easy]

Our WordPress site has experienced a security breach, and the precise method of compromise remains undetermined at present. We need you help to investigate what actually happened.

Q1. There were two attackers attempting to compromise our environment. What is the IP address of the victim, and what is the IP address of the first attacker? Q2. What are the versions of the Apache and PHP servers deployed in our environment?

Flag Format 0xL4ugh{A1_A2}

Example: 0xL4ugh{IP1_IP2_apache1.2.3_php1.2.3}(no spaces)

---

Solution:

We were given a Wordpress.pcapng file.

Filtering via http.request...we can see a suspicious requests coming from 192.168.204.132

So that is most likely our first attacker.

Now, to answer Q2, let's scroll up a bit.

Following the HTTP stream will give the answer that we need.

Flag: 0xL4ugh{192.168.204.128_192.168.204.132_apache2.4.58_php8.2.12}

Original writeup (https://github.com/pspspsps-ctf/writeups/tree/main/2024/0xL4ugh%20CTF%202024/Forensics/Wordpress/1).