27.2.14 Lab – Isolate Compromised Host Using 5-Tuple Answers

Last Updated on February 27, 2021 by Admin

27.2.14 Lab – Isolate Compromised Host Using 5-Tuple Answers

Lab – Isolate Compromised Host Using 5-Tuple (Answers Version)

Answers Note: Red font color or gray highlights indicate text that appears in the Answers copy only.


In this lab, you will review logs that were gathered during the exploitation of a documented vulnerability to determine the compromised hosts and file.

Part 1: Review Alerts in Sguil

Part 2: Pivot to Wireshark

Part 3: Pivot to Kibana

Background / Scenario

The 5-tuple is used by IT administrators to identify requirements for creating an operational and secure network environment. The components of the 5-tuple include a source IP address and port number, destination IP address and port number, and the protocol in use in the data payload. This is the protocol field of the IP packet header.

In this lab, you will also review the logs to identify the compromised hosts and the content of the compromised file.

Required Resources

  • Security Onion virtual machine


After the attack, the users no longer have access to the file named confidential.txt. Now you will review the logs to determine how the file was compromised.

Note: If this was a production network, it is recommended that analyst and root users change their passwords and comply with the current security policy.

Part 1:  Review Aerts in Sguil

  1. Launch the Security Onion VM and log in. Log in with the user analyst and password cyberops
  2. Open Sguil and log in. Click Select All to select the interfaces and then Start SGUIL.
  3. Review the events listed in the Event Message column. One of these messages is GPL ATTACK_RESPONSE id check returned root. This message indicates that root access may have been gained during an attack. The host at returned root access to The alert ID 5.1 is used as an example in this lab.

Screenshot of sguil with the GPL ATTACK_RESPONSE id check returned root alert highlighted

  1. Select the Show Packet Data and Show Rule checkboxes to view each alert in more detail.

screenshot of show packet data and show rule selected

  1. Right-click the alert ID 5.1 and select Transcript.

screenshot shows the location of transcript

  1. Review the transcripts for the alert. The transcript displays the transactions between the threat actor source (SRC) and the target (DST) during the attack. The threat actor is executing Linux commands on the target.

screenshot of transcript for the alert screenshot of transcript for the alert


What kind of transactions occurred between the client and the server in this attack?

Type your answers here.

The attacker from gained root access to The attacker proceeds to browse the file system, copy the shadow file and edited /etc/shadow and /etc/passwd.

Part 2:  Pivot to Wireshark

  1. Select the alert that provided you with the transcript from the previous step. Right-click the alert ID 5.1 and select Wireshark. The Wireshark main window displays three views of a packet.

screenshot of wireshark associated for the alert

  1. To view all packets that are assembled in a TCP conversation, right-click any packet and select Follow > TCP Stream.

screeshot of tcp stream output


What did you observe? What do the text colors red and blue indicate?

Type your answers here.

The TCP stream shows the transaction between threat actor displayed in red text and the target in blue text. The information from the TCP stream is the same as in the transcript. The hostname of the target is metasploitable and its IP address is

The attacker issues the whoami command on the target. What does this show about the attacker role on the target computer?

Type your answers here.

The attacker has full root privileges on the target computer.

Scroll through the TCP stream. What kind of data has the threat actor been reading?

Type your answers here.

user account information

  1. Exit the TCP stream window. Close Wireshark when you are done reviewing the information provided.

Part 3:  Pivot to Kibana

  1. Return to Sguil. Right-click either the source or destination IP for the alert ID 5.1 and select Kibana IP Lookup > SrcIP. Enter username analyst and password cyberops if prompted by Kibana.

screenshot shows the location of kibana ip lookup > srcIP

Note: If you received the message “Your connection is not private”, click ADVANCED > Proceed to localhost (unsafe) to continue.

  1. If the time range is the last 24 hours, change it to June 2020 so June 11 is included in the time range. Use the Absolute tab to change the time range.
  2. In the displayed results, there is a list of different data types. You were told that the file confidential.txt is no longer accessible. In the Sensors – Sensors and Services (Pie Chart), ftp and ftp-data are present in the list, as shown in the figure. We will determine if FTP was used to steal the file.

screenshot of kibana dashboard filtered for

  1. Let’s filter for bro_ftp. Hover over the empty space next to the count of bro_ftp data types. Select + to filter for only FTP related traffic as shown in the figure.

screenshot of the location to filter for bro_ftp logs

  1. Scroll down to the All Logs section. There are two entries listed.


What are the source and destination IP addresses and port numbers for the FTP traffic?

Type your answers here.

The source IP address and port number The destination IP address and port number is

  1. Expand and review both log entries. In one of these entries, the ftp_argument has an entry of Also review the message in the log entry to learn more about this event.
  2. Within the same log entry, scroll up back to the alert _id field and click the link.

screenshot of log entry with alert _id link highlighted

  1. Review the transcript for the transactions between the attacker and the target. If desired, you can download the pcap and review the traffic using Wireshark.


What are the user credentials to access the FTP site?

Type your answers here.

Username analyst and password cyberops

  1. Now that you have verified that the attacker has used FTP to copy the content of the file confidential.txt and then deleted it from the target. So what is the content of the file? Remember one of the services listed in the pie chart is ftp_data.
  2. Navigate to the top of the dashboard. Select Files under the Zeek Hunting heading in the left panel, as shown in the figure. This will allow you to review the types of the files that were logged.

Screenshot of the files log and files is highlighted under zeek hunting


What are the different types of files? Look at the MIME Type section of the screen.

Type your answers here.

The file types are text and different types of image files in this example.

Scroll to the Files – Source heading. What are the file sources listed?

Type your answers here.


  1. Filter for FTP_DATA by hovering over the empty space next to the Count for FTP_DATA and click +.

screenshot of ftp_data filter highlighted

  1. Scroll down to review the filtered results.


What is the MIME type, source and destination IP address associated with the transfer of the FTP data? When did this transfer occur?

Type your answers here.

The file is a plain text file that were transfer from to The file was transferred on June 11, 2020 at 3:53.

  1. In the File logs, expand the entry associated with FTP data. Click the link associated with alert _id.


What is the text content of the file that was transferred using FTP?

Type your answers here.



This document contains information about the last security breach.

With all the information has gathered so far, what is your recommendation for stopping further unauthorized access?

Type your answers here.

At a minimum, the password for the username analyst should be changed throughout the network ( and

0 0 votes
Article Rating
Notify of
Inline Feedbacks
View all comments