Analyze network traffic using Wireshark to identify web server exploitation, extract attacker IOCs and persistence mechanisms, and map attack techniques to MITRE ATT&CK.
During a recent security incident, an attacker successfully exploited a vulnerability in our web server, allowing them to upload webshells and gain full control over the system. The attacker utilized the compromised web server as a launch point for further malicious activities, including data manipulation.
As part of the investigation, You are provided with a packet capture (PCAP) of the network traffic during the attack to piece together the attack timeline and identify the methods used by the attacker. The goal is to determine the initial entry point, the attacker's tools and techniques, and the compromise's extent.
Easy - Network Forensics | Completion Achievement
- Identifying the attacker's IP address helps trace the source and stop further attacks. What is the attacker's IP address?
Since the lab description mentioned that the attacker managed to upload a webshell to a web server, we should try checking POST requests inside the pcap file using the http and http.request.method==POST display filter. After some scrolling, we will some packets showing evidence of a jsp webshell running commands in the system.
- To identify potential vulnerability exploitation, what version of our web server service is running?
Let's look deeper into the logs related to the webshell interaction with Follow > HTTP Stream. There should be some information about the web server on the response headers:
- After identifying the version of our web server service, what CVE number corresponds to the vulnerability the attacker exploited?
Since it seems we are running a service called TeamCity with version 2023.11.3, we should look up RCE vulnerabilities for that version of our web service: TeamCity 2023.11.3 RCE. I found this cisa.gov course talking about this vulnerability:
- The attacker exploited the vulnerability to create a user account. What credentials did he set up?
Using the ip.src==23.158.56.196 and http display filter to look at the attacker's interaction more clearly and looking for the user string on the rest of the packets will return a packet showing credentials belonging to the user account the attacker created:
- The attacker uploaded a webshell to ensure his access to the system. What is the name of the file that the attacker uploaded?
The name of the uploaded webshell should be located in the HTTP POST packets right before the webshell activity. Opening packet 24826 on tcp.stream eq 365 will show the original name of the uploaded file:
- When did the attacker execute their first command via the web shell?
Looking at all packets containing the URI containing the webshell (http.request.uri=="/plugins/NSt8bHTg/NSt8bHTg.jsp") and inspecting the very first packet will display when the first webshell command was executed.
- The attacker tampered with a text file that contained the credentials of the admin user of the webserver. What new username and password did the attacker write in the file?
Looking at all webshell data again with the display filter used above, we can find that the attacker modified the /tmp/Creds.txt file with their own creds:
- What is the MITRE Technique ID for the attacker's action in the previous question (Q7) when tampering with the text file?
We can do some research on Google to find our answer. Knowing that the attacker has manipulated stored data, this seems to be the most appropriate MITRE ATT&CK ID for our case:
- The attacker tried to escape from the container but he didn’t succeed, What is the command that he used for that?
We can use the previous display filter and look for any instances of docker being mentioned by the attacker:
