Analyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes.
An automated alert has detected unusual XML data being processed by the server, which suggests a potential XXE (XML External Entity) Injection attack. This raises concerns about the integrity of the company's customer data and internal systems, prompting an immediate investigation. Analyze the provided PCAP file using the network analysis tools available to you. Your goal is to identify how the attacker gained access and what actions they took.
Easy - Network Forensics | Completion Achievement
- Identifying the open ports discovered by an attacker helps us understand which services are exposed and potentially vulnerable. Can you identify the highest-numbered port that is open on the victim's web server?
Upon opening the pcap file for the first time, we can find clear signs that the attacker IP (210.106.114.183) is doing web enumeration based on constant TCP SYN conversations being started by this IP:
If there's an open port, the attacker would continue interacting with that port. Otherwise, the amount of packets sent to that port shouldn't exceed 2. Let's keep the ip.src == 210.106.114.183 filter, look at the Statistics > Conversations > TCP tab and sort based on Port B to find which ports were still contacted by the attacker IP:
All the other ports appears only once.
- By identifying the vulnerable PHP script, security teams can directly address and mitigate the vulnerability. What's the complete URI of the PHP script vulnerable to XXE Injection?
Let's navigate through the HTTP traffic coming from the 210.106.114.183 address:
We can see that the attacker used gobuster for directory enumeration. Let's filter out these requests by using http.user_agent != gobuster/3.6 and find any interesting files:
Let's remember that XXE stands for "XML external entity". Since this URI received a request through a HTTP/XML protocol, this is a suspect for being our vulnerable PHP script. Additionally, we can see signs of command injection right after the URI was abused.
- To construct the attack timeline and determine the initial point of compromise. What's the name of the first malicious XML file uploaded by the attacker?
Looking at the used protocol, we can right click the HTTP/XML row in the Protocol column > Apply as Filter > Selected and see which was the first XML file uploaded by the attacker.
Let's follow the HTTP stream by right clicking packet 88306 > Follow > HTTP Stream.
This is the first XML file the attacker uploaded to attempt to exploit XXE.
- Understanding which sensitive files were accessed helps evaluate the breach's potential impact. What's the name of the web app configuration file the attacker read?
By continuing to read the XML payloads using the _ws.col.protocol == "HTTP/XML" display filter, we will eventually find a sensitive configuration file read by the attacker:
- To assess the scope of the breach, what is the password for the compromised database user?
The password is visible in plaintext in the HTTP response.
- Following the database user compromise. What is the timestamp of the attacker's initial connection to the MySQL server using the compromised credentials after the exposure?
The XXE exploitation was successful after packet 88306, so we should look for data happening after that packet. Using the mysql display filter will display MySQL communications from the attacker, we can see that the first packet sent from the attacker contains our timestamp.
- To eliminate the threat and prevent further unauthorized access, can you identify the name of the web shell that the attacker uploaded for remote code execution and persistence?
We found this web shell earlier when analyzing HTTP traffic coming from the attacker IP address.
