I recently decided to tackle a different aspect of the cybersecurity roadmap - a blue team role. The idea is to follow a free program, accessible to anyone, to see what tools I can try, what aspects can I learn and how I can improve overall.

For this project, I decided to try <cyberdefenders.org> - recently, I acquired a CEH course to better understand the penetration tester role. I went with O`REILLY - Certified Ethical Hacker (CEH) Complete Video Course, 3rd Edition, in which Omar Santos talked about this platform. I know how TryHackMe works and have previosly tried some rooms on HackTheBox too, so I think I can make a fair comparison.

So, let’s take this room step by step.

Description#

During a recent security incident, an attacker successfully exploited a vulnerability in our web server, allowing them to upload webshells and gain full control over the system. The attacker utilized the compromised web server as a launch point for further malicious activities, including data manipulation.

As part of the investigation, You are provided with a packet capture (PCAP) of the network traffic during the attack to piece together the attack timeline and identify the methods used by the attacker. The goal is to determine the initial entry point, the attacker’s tools and techniques, and the compromise’s extent.

Question 1: Identifying the attacker’s IP address helps trace the source and stop further attacks. What is the attacker’s IP address?#

My idea was to look for POST requests - the attacker should’ve uploaded something (a webshell) to the server. From the logs we can see traffic coming in from different addresses - one of them being 23.158.56.196. Because it has multiple to the /loginSubmit.html endpoints, I’m guessing the attacker tried to brute force a password. The other IPs I ruled out because of their lack of suspicious actions.

Question 2: To identify potential vulnerability exploitation, what version of our web server service is running?#

At first I thought of the Prototype AJAX version, which is 1.7.3. However, this isn’t the answer.

Next stop was the java version, which I found as name="java.vm.version" value="17.0.7+7-LTS".

In another request to GET /app/rest/ui/server?fields=startTime,buildNumber HTTP/1.1\r\n, I found the build number for the server as buildNumber="147512". This wasn’t the right answer neither.

I had to use a hint for this one - you have to follow the HTTP stream from a GET request from the attacker to a resource like /hax?jsp=/app/rest/server;.jsp. Then, you’ll see the version in a XML document listed as 2023.11.3 (build 147512).

Question 3: After identifying the version of our web server service, what CVE number corresponds to the vulnerability the attacker exploited?#

Use search engine parameters like "cve" or "2023.11.3" team city to find it. This Splunk article also details how this vulnerability works - further helping in a better understanding of the problem at hand. The higher severity CVE CVE-2024-27198 is the correct answer.

Question 4: The attacker exploited the vulnerability to create a user account. What credentials did he set up?#

After reading a bit about the exploit and looking at a PoC available on GitHub, I wrote the following filter:

ip.src == 23.158.56.196 && http.request.method == POST && http.file_data contains "SYSTEM_ADMIN"

Which revealed two entries, but with the same username+password combo:

{
    "username": "c91oyemw",
    "password": "CL5vzdwLuK",
    "email": "[email protected]",
    "roles": {
        "role": [
            {
                "roleId": "SYSTEM_ADMIN",
                "scope": "g"
            }
        ]
    }
}

Question 5: The attacker uploaded a webshell to ensure his access to the system. What is the name of the file that the attacker uploaded?#

I tried to find what POST requests contains a multipart/form-data type using this search filter:

ip.src == 23.158.56.196 && http.request.method == POST && http.content_type contains "multipart/form-data"

Found a ZIP archive with the name form-data;name="file:fileToUpload";filename="NSt8bHTg.zip"

Question 6: When did the attacker execute their first command via the web shell?#

Because TeamCity is an application that supports plugins, you can search for NSt8bHtg.jsp in the URI and find it. However, I tried a different approach - I searched based on the frame number:

ip.src == 23.158.56.196 && http.request.method == POST && frame.number > 24826

You’ll see a bunch of irrelevant requests, but you’ll also see this:

25572	1122.563990	23.158.56.196	172.31.25.119	HTTP	78	POST /plugins/NSt8bHTg/NSt8bHTg.jsp HTTP/1.1  (application/x-www-form-urlencoded)

And in the body you’ll find the ls command, executed at 2024-06-30 08:03.

Question 7: The attacker tampered with a text file that contained the credentials of the admin user of the webserver. What new username and password did the attacker write in the file?#

Using the logic from before, let’s search for all commands that the attacker ran using this filter:

ip.src == 23.158.56.196 && ip.dst == 172.31.25.119 && http.request.method == POST && frame.number > 24826 && http.request.uri contains "/plugins/NSt8bHTg/NSt8bHTg.jsp"

Notice that I’ve also included the destination IP just to remove duplicates (I’m not sure, but I think the other IP may be a gateway / router).

So, the full command history looks like this:

$ ls
$ whoami
$ pwd
$ ls /opt/teamcity
$ ls /home
$ ls ~/
$ cd /root
$ pwd
$ ls /tmp
$ cat /tmp/Creds.txt
$ bash -c 'echo "username:a1l4m,password:youarecompromised" > /tmp/Creds.txt'
$ cat /tmp/Creds.txt
$ docker run --rm -it --privileged ubuntu
$ docker run --rm -it -v /:/host ubuntu chroot /host
$ docker run -v /var/run/docker.sock:/var/run/docker.sock -it ubuntu
$ ls
$ whoami

Question 8: What is the MITRE Technique ID for the attacker’s action in the previous question (Q7) when tampering with the text file?#

The expected answer is T1565.001, which falls under Data Manipulation: Stored Data Manipulation

My honest opinion - this is fundamentally wrong. Maybe when the room was first designed it was a different description (although MITRE doesn’t reuse IDs, so I’m having a hard time believing this), but this approach falls under Account Manipulation: Additional Cloud Credentials or Create Account: Cloud Account - even Valid Accounts: Cloud Accounts is a more appropriate category (even if this assumes the credentials were stolen).

Question 9: The attacker tried to escape from the container but he didn’t succeed, What is the command that he used for that?#

Using the command history detailed earlier, we can see the command:

docker run --rm -it -v /:/host ubuntu chroot /host

Post lab thoughts#

Solid room for beginners, highly focused on Wireshark & HTTP basics.

What I’d recommend is you check out different walkthroughs (including the official one!) to see different approaches to the same problem. If you have any feedback, let me know! 👋

SOC Incident response - Jetbrains