thm_osint1.md
Walkthrough by WASP1337 aka CyberWasp
“Hexline, we need your help investigating the phishing attack from 3 months ago. We believe the threat actor managed to hijack our domain virelia-water.it.com and used it to host some of their infrastructure at the time. Use your OSINT skills to find information about the infrastructure they used during their campaign.”
185.199.108.153 185.199.109.153 185.199.110.153 185.199.111.153
**Subdomains**
Search:
ID Subdomain IP
0 stage0.virelia-water.it.com 185.199.110.153
Showing 1 to 1 of 1 entry
In the body of the html file there are some interesting lines:
<body>
<div class="header">**ICS Operator Console v3.1**</div>
<div class="warning">[SESSION INVALID] Remote operator access denied. Session token expired or not recognized.</div>
<div class="panel">
<div class="field">
<label for="opid">Operator ID</label>
<input type="text" id="opid" value="**readonly_user_14**" disabled />
</div>
<div class="field">
<label for="zone">Control Zone</label>
<input type="text" id="zone" value="**WTR-GATE-03-A**" disabled />
</div>
<div class="field">
<label for="status">Node Uplink</label>
<input type="text" id="status" value="Pending / fallback enabled" disabled />
</div>
</div>
** <script src="https://raw.githubusercontent.com/SanTzu/uplink-config/refs/heads/main/init.js"></script>**
</body>
The only valuable information is the link to the JavaScript file.
The uplink-fallback is a dead link. First I thought the Token JBSWY3DPEBLW64TMMQQQ== is important, using Cyberchef and form Base32 you get Hello World! But it is only there for obfuscation.
If you can't find more subdomains, one way to get this information is to check if there are some old certificates:
https://crt.sh/?q=%25.virelia-water.it.com
You notice one subdomain, which is a HEX string - put it into Cyberchef and get the FLAG.