IronShade Walkthrough

IronShade - TryHackMe Walkthrough#

Challenge Information#

Scenario#

Based on threat intelligence reports, an APT group known as IronShade has been actively targeting Linux servers across the region.

To better understand the attack methodology used by this threat actor, a vulnerable Linux honeypot was intentionally exposed to the internet with weak SSH configurations.

The server was eventually compromised, and our objective is to perform a full compromise assessment and identify:

• Backdoor accounts
• Persistence mechanisms
• Suspicious services
• Malicious processes
• SSH activity
• Installed malware
• Indicators of compromise

Question 1#

What is the Machine ID of the machine being investigated?#

Using:

hostnamectl

Output:

Machine ID: dc7c8ac5c09a4bbfaf3d09d399f10d96

Answer#

dc7c8ac5c09a4bbfaf3d09d399f10d96

Question 2#

What backdoor user account was created on the server?#

While reviewing user directories inside:

/home

a suspicious account was discovered:

mircoservice

The username closely resembles the legitimate word:

microservice

which is a common attacker technique known as typosquatting.

Answer#

mircoservice

Question 3#

What cronjob was configured for persistence?#

Reviewing root’s cron jobs:

sudo crontab -l

reveals:

@reboot /home/mircoservice/printer_app

This ensures execution whenever the system reboots.

Answer#

@reboot /home/mircoservice/printer_app

Analysis#

This is a classic persistence mechanism.

The attacker configured a malicious binary to execute automatically every time the server starts.

Question 4#

What suspicious hidden process was running from the backdoor account directory?#

Checking running processes:

ps aux | grep -i mirco

Output:

/home/mircoservice/.tmp/.strokes

Answer#

.strokes

Analysis#

The process is hidden inside a hidden directory and disguised with a hidden filename.

Such naming conventions are frequently used by malware to avoid detection.

Question 5#

How many processes were found running from the backdoor account directory?#

Process review reveals:

/home/mircoservice/.tmp/.strokes
/home/mircoservice/printer_app

Total:

2

Answer#

2

Question 6#

What is the name of the hidden file found in the root directory?#

Listing hidden files:

ls -lah /

reveals:

.systmd

Answer#

.systmd

Analysis#

The filename closely resembles:

systemd

which is likely intended to blend in with legitimate Linux system files.

Question 7#

What suspicious services were installed on the server?#

Investigating system services:

ls /etc/systemd/system

reveals suspicious entries:

backup.service
strokes.service

Sorting alphabetically as required:

Answer#

backup.service, strokes.service

Analysis#

Both services appear attacker-created and are unrelated to normal Ubuntu installations.

Question 8#

When was the backdoor account created?#

Reviewing authentication logs:

cat /var/log/auth.log

reveals account creation activity.

Timestamp:

Aug 5 22:05:33

Answer#

Aug 5 22:05:33

Question 9#

From which IP address were multiple SSH connections observed?#

Searching SSH logs:

strings /var/log/auth.log | grep -i ssh

reveals:

Invalid user microservice from 10.11.75.247

Answer#

10.11.75.247

Analysis#

This IP repeatedly appears throughout authentication activity and is associated with the attacker.

Question 10#

How many failed SSH login attempts were observed on the backdoor account?#

Using:

lastb | grep -i mirco

Output shows:

8

failed login attempts.

Answer#

8

Question 11#

Which malicious package was installed?#

Reviewing package installation logs:

grep " install " /var/log/dpkg.log

reveals:

install pscanner:amd64 1.5

Answer#

pscanner

Analysis#

This package was installed shortly after compromise and stands out from normal operating system packages.

Question 12#

What secret code was found within the package metadata?#

Checking package information:

dpkg -l | grep pscanner

Output:

pscanner 1.5 amd64 Secret_code{_tRy_Hack_ME_}

Answer#

Secret_code{_tRy_Hack_ME_}

Indicators of Compromise (IOCs)#

Malicious User#

mircoservice

Suspicious Processes#

/home/mircoservice/.tmp/.strokes
/home/mircoservice/printer_app

Suspicious Files#

.systmd

Persistence#

@reboot /home/mircoservice/printer_app

Malicious Services#

backup.service
strokes.service

Attacker IP#

10.11.75.247

Malicious Package#

pscanner

Timeline of Attack#

Attacker Gains Access
          │
          ▼
Backdoor Account Created
(mircoservice)
          │
          ▼
Persistence Established
(cronjob)
          │
          ▼
Malicious Services Installed
          │
          ▼
Hidden Malware Executed
(.strokes)
          │
          ▼
Additional Binary Deployed
(printer_app)
          │
          ▼
pscanner Installed
          │
          ▼
Repeated SSH Activity
from 10.11.75.247

Final Answers#

Key Takeaways#

• Attackers frequently create look-alike user accounts to blend into production environments.
• Hidden files and hidden directories remain common persistence locations on Linux systems.
• Cron jobs are frequently abused for long-term persistence.
• Systemd services should always be reviewed during compromise assessments.
• Authentication logs provide valuable evidence regarding attacker activity.
• Package installation logs can reveal malware deployment timelines.
• Typosquatting account names remain an effective evasion technique used by threat actors.

Challenge completed successfully.

Adapted from naval0505/TryHackMe—Writeups under MIT.