---
description: RDB Brute Force Attack logs Analysis
---

# Bruteforce BTLO

1- First Question Talking about the number of the login Failure simply I use find and count the events use 'Administrator' word because the attacker was trying to brute force to achieve the account Password&#x20;



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FZ3euQTxtIJn0hyzdUrt2%2FScreenshot%202024-10-13%20192357.png?alt=media&#x26;token=39c93a52-2010-483a-a0e0-acca5b264486" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fpkve7A6fhBURRcwYyiM6%2Fimage.png?alt=media&#x26;token=68b5cc7d-0b19-4987-ba35-11233637b3a2" alt=""><figcaption></figcaption></figure>

2-Here simply is asking for the username and it\`s easy the same word we use for the find by the way&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F8fAGOdbH3vFHnpJQikXc%2Fimage.png?alt=media&#x26;token=04b36f55-5fc7-41c4-878f-d4fed0353bba" alt=""><figcaption></figcaption></figure>

3- Here he was asking for the reason and after check the event file it\`s the wrong password or administrator not defined but i think its a good trick from the active directory editor its Must be a found a administrator account but if the reason was only bad password the attacker is now sure that he skip the half way and start password spraying not bruteforce&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FIlMGTlb9mQ1pgXHBB0SL%2Fimage.png?alt=media&#x26;token=8973f8bd-2447-4755-8e5a-396d1286a87a" alt=""><figcaption></figcaption></figure>

4-Here he was asking for the event id and it\`s also in the event file&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FCXzp7rDkn3QAGfVsRUYD%2FScreenshot%202024-10-13%20193327.png?alt=media&#x26;token=0aa6b51f-c4a6-428b-9972-a78bcd149a23" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FyYDVQVi9zR2jrudWja2h%2Fimage.png?alt=media&#x26;token=1cdb58c4-d019-45a8-898d-a2d2a51aebdb" alt=""><figcaption></figcaption></figure>

5- Simply the source ip can easily detected from the file&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fyf6silh1nkn6D4YdNmT4%2FScreenshot%202024-10-13%20193437.png?alt=media&#x26;token=5f949dbc-f649-42ef-8645-9359cc9672da" alt=""><figcaption></figcaption></figure>

6- I use abuse dp to detect the country for the attacker&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FRQFo0R7inJ5vPoVbqDAv%2Fimage.png?alt=media&#x26;token=d7d61c34-d349-47f3-bdcb-73b25c3a3f5d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fd8O1749fyo0J82F5GRtK%2Fimage.png?alt=media&#x26;token=44e7a439-944d-42e7-bcad-7b1a8658366e" alt=""><figcaption></figcaption></figure>

7- For detect the smallest and the largest port i made a small Script to easy determine the numbers  Let's extract the relevant source port numbers from the document and find the smallest and largest values.

<pre class="language-python"><code class="lang-python"><strong>
</strong>import re

file_path = '/mnt/data/BTLO_Bruteforce_Challenge.txt'

with open(file_path, 'r') as file:
    content = file.read()

source_ports = re.findall(r'Source Port:\s+(\d+)', content)

source_ports = [int(port) for port in source_ports]

min_port = min(source_ports)
max_port = max(source_ports)

min_port, max_port

</code></pre>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fa6V1IqxEWvAIrTlPDPN4%2Fimage.png?alt=media&#x26;token=b19e912c-4ae4-4537-b6b7-133e5ca1d135" alt=""><figcaption></figcaption></figure>

Thanks for Reading&#x20;
