Infinity Shell Write-Up
| Field | Details |
|---|---|
| Platform | TryHackMe thm |
| Challenge | Infinity Shell |
| Category | Forensics |
| Difficulty | Easy |
| Tools | Linux CLI |
| Date | 2026-06-24 |
Scenario
Investigate and analyse the traces of an attack from an implanted webshell.
Cipher’s legion of bots has exploited a known vulnerability in our web application, leaving behind a dangerous web shell implant. Investigate the breach and trace the attacker’s footsteps!
Investigation
Since I know off the bat that I’m investigating a web app for a web shell, I’ll head straight for the Apache logs.
cd /var/log/apache2/
ls
Looks like the 2 main log files are:
error.log.1other_vhosts_access.log.1- The others are blank
First, I’ll search the access logs, since web shells often work by first being uploaded to web server, then receiving commands to it’s URI. This will either be percent encoded commands, or may be further encoded, such as base64. To start I’ll grep shell in the logs, for easy pickings.
cat other_vhosts_access.log.1 | grep shell
- Nothing returned
Next I’ll grep for php, since Apache2 often uses php scripts, and so a web shell may have taken advantage of this.
cat other_vhosts_access.log.1 | grep php
- The log isn’t very long, so I’ll just scroll through to see if anything sticks out
I found a suspicious request sending a query string with base64 encoded content to an images.php file.
I’ll refine my search to just this file:
cat other_vhosts_access.log.1 | grep images.php
Now I’ll decode all the query strings in order with CyberChef.
whoamilsecho 'THM{sup3r_34sy_w3bsh3ll}'ifconfigcat /etc/passwdid
There’s the flag. This one was indeed pretty easy, assuming you have a but of knowledge of web shells, web logs, and know what to look for.
Prevention Recommendations
Provide an explanation on how to prevent this attack from happening again.
Lessons Learned
- This was a good introductory CTF into linux web logs and web shells
- Good practice
- Useful as a building block for more complex investigations