HTB Sherlock Bumblebee Writeup: phpBB Logs and Database Investigation
A Hack The Box Sherlock Bumblebee walkthrough covering phpBB database analysis, malicious forum post investigation, administrator account abuse, and database backup download evidence.
Bumblebee is a Hack The Box Sherlock based on phpBB logs, a database dump, and web access evidence. The original task flow is useful because each answer builds toward a timeline: identify the contractor, find the malicious forum post, trace administrator abuse, and confirm the database backup download.
Preparing the Evidence
The archive contained logs and a compressed incident package. I started by identifying the archive type, extracting it, and opening the phpBB SQLite database for direct table review.
file bumblebee.zip
unzip bumblebee.zip
tar -xvf incident.tgz
Task 1: External Contractor Username
The contractor account was stored in phpbb_users. Querying user records and looking for the external contractor pattern revealed the account used during the incident.
Answer: apoole1
SELECT * FROM phpbb_users WHERE substr(username, -1) = '1';
Task 2: Contractor IP Address
The same user record and related log entries showed the IP address used by the contractor from the guest Wi-Fi network.
Answer: 10.10.0.78
Task 3: Malicious Forum Post ID
Reviewing forum post content exposed the post that carried the credential stealing payload. The malicious post was identified by its post ID.
Answer: 9
Task 4: Credential Stealer URI
The malicious post content contained the callback URI used by the credential stealer. This endpoint is the link between the forum post and credential theft.
Answer: http://10.10.0.78/update.php
Task 5: Administrator Login Time
The phpBB log table showed activity from the contractor IP. After converting the stored timestamps, the administrator login time was visible in UTC.
Answer: 26/04/2023 10:53:12 UTC
SELECT * FROM phpbb_log WHERE log_ip = "10.10.0.78";
Task 6: LDAP Password
The forum configuration table contained LDAP configuration values. That is a sensitive-data exposure issue because operational credentials should not be recoverable from an application database in plaintext.
Answer: Passw0rd1
SELECT * FROM phpbb_config WHERE config_name LIKE "%ldap%";
Task 7: Administrator User Agent
The recovered forum and access evidence included the administrator browser user agent used during the malicious session.
Answer: Mozilla/5.0
Task 8: Administrator Group Add Time
After the administrator login, the contractor account was added to the Administrator group. The log timestamp places that privilege escalation shortly after the credential theft.
Answer: 26/04/2023 10:53:51 UTC
Task 9: Database Backup Download Time
The web access logs confirmed when the database backup was downloaded. This completes the timeline from forum compromise to data access.
Answer: 26/04/2023 11:01:38 UTC
Task 10: Downloaded Backup Size
The same access log entry included the response size for the downloaded backup.
Answer: 34707
Key Takeaways
- Forum databases can reconstruct identity, registration IPs, privilege changes, and application-level activity.
- Application configuration tables often become high-value evidence during incident response.
- Combining database logs with web access logs creates a stronger, defensible timeline.