CyberDefenders - Tomcat Takeover Lab

Network Traffic Analysis Lab Analyze network traffic using Wireshark's custom columns, filters, and statistics to identify suspicious web server administration access and potential compromise.

lets start..

Q1 : Given the suspicious activity detected on the web server, the PCAP file reveals a series of requests across various ports, indicating potential scanning behavior. Can you identify the source IP address responsible for initiating these requests on our server?

Answer : Simply go to the Statistics -> ipv4 statistics -> All Addresses to see all addresses

14.0.0.120

14.0.0.120

Q2:

Based on the identified IP address associated with the attacker, can you identify the country from which the attacker's activities originated?

Answer : I went to external website to search for the geo location for the ip ( website name was iplocation.io )

China

China

Q3:

From the PCAP file, multiple open ports were detected as a result of the attacker's active scan. Which of these ports provides access to the web server admin panel?

Answer : use this filter

ip.src==14.0.0.120 && http

ip.src==14.0.0.120 && http

And analyse the filtered traffic we will see the port

Analyse the traffic as you will see the Get request to the admin panel

8080

8080

Q4 :

Following the discovery of open ports on our server, it appears that the attacker attempted to enumerate and uncover directories and files on our web server. Which tools can you identify from the analysis that assisted the attacker in this enumeration process?

Answer : We can see many requests which does not make any sense on the same filter as previous so just open one request an look at the user-agent

gobuster

gobuster

Q5:

After enumerating directories on our web server, the attacker made numerous requests to identify administrative interfaces. Which directory related to the admin panel did the attacker uncover? (Provide the path including the leading slash, e.g. /path)

Answer : Use the filter

http

http

and we will look for any connecting request for the webpage

We found the directory with code 302 found..

/manager

/manager

Q6 :

After accessing the admin panel, the attacker brute-forced the login. What credentials did the attacker successfully use? (Provide them in username:password format)

Answer : Filter to use is

http.authbasic || http.www_authenticate

http.authbasic || http.www_authenticate

and look for /manager request with no error 401 from the server which means its a successfull login ( Right Credentials )

admin:tomcat

admin:tomcat

Q7 :

Once inside the admin panel, the attacker attempted to upload a file with the intent of establishing a reverse shell. Can you identify the name of this malicious file from the captured data?

Answer : Filter to use

ip.src == 14.0.0.120 && http.request.method == "POST"

ip.src == 14.0.0.120 && http.request.method == "POST"

then follow the http

we can see the filename in the user POST request

JXQOZY.war

JXQOZY.war

Q8 :

After the attacker established a reverse shell on our server, the payload connects back to the attacker's machine. From the analysis, what is the callback destination in IP:port format?

Answer :

Simple

14.0.0.120:443

14.0.0.120:443

The End..