Hunt the web shell
The web server's access.log covers the same morning as the SSH attack. Separate the scanner from the real visitors and trace the web shell the attacker planted and used.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
404s come from guessed paths — tally their source IPs.
The web shell is a .php file under /uploads/ requested with ?cmd=...
Solution explanation
The access log told the same story from the web tier: the same IP, 203.0.113.66, scanned the site into a wall of 404s, then uploaded and drove a web shell at /uploads/avatar_8842.php. Reading status codes and request paths is how you turn a million-line access log into a short list of what mattered.
Show solution
cd /home/student
awk '$9==404{print $1}' /srv/soc-data/web/access.log | sort | uniq -c | sort -rn
grep -oE '/uploads/[^? ]+\.php' /srv/soc-data/web/access.log | sort -u
grep 'cmd=' /srv/soc-data/web/access.log
echo /uploads/avatar_8842.php > /home/student/web-findings.txt