Скачать или смотреть TryHackMe Portal Drop - First Shift CTF - Full Walkthrough 2026

🐯 The first SOC shift won't be that challenging, right?

🧭 Room link: https://tryhackme.com/room/first-shif...

🐯 Task 5: Portal Drop 🐯

You are on the day shift in the ProbablyFine when the monitoring dashboard flashes red. A new alert appears in the WAF summary, reporting a web scan on crm[.]trypatchme[.]thm followed by a suspicious file upload anomaly. The affected website is TryPatchMe's public-facing CRM portal, a valued customer who provides software patching consulting services.

That should be an easy case, since you have access to both the web access logs and the EDR console. Combined, they should give you a clear answer: either it's a False Positive, or the portal has been breached and TryPatchMe needs to patch the CRM now!

🐯 EDR and Web Logs 🐯

For this challenge, you need to download the web access logs by clicking the "Download Task Files" button above, and for some questions, you will need the EDR console

🐯 Task Questions: 🐯

🍐What is the IP address that initiated the brute force on the CRM web portal?
🍐How many successful and failed logins are seen in the logs?
🍐Following the brute force, which user-agent was used for the file upload?
🍐What was the name of the suspicious file uploaded by the attacker?
🍐At what time did the attacker first invoke the uploaded script?
🍐What is the first decoded command the attacker ran on the CRM?
🍐Based on the attacker’s activity on the CRM, which MITRE ATT&CK Persistence sub-technique ID is most applicable?
🍐Which process image executes attacker commands received from the web?
🍐What command allowed the attacker to open a bash reverse shell?
🍐Which Linux user executes the entered malicious commands?
🍐What sensitive CRM configuration file did the attacker access?
🍐Which domain was used to exfiltrate the CRM portal database?
What flag do you get after completing all 12 EDR response actions?


⚠️ Educational Purpose Only
This content is for educational and authorized penetration testing purposes only. Always ensure you have permission before testing on any systems.

Don't forget to 👍 LIKE and 🔔 SUBSCRIBE for more cybersecurity tutorials!

#tryhackme