Scenario

During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst regarding a public-facing server. This server has been flagged for making outbound connections to multiple suspicious IPs. In response, you initiate the standard incident response protocol, which includes isolating the server from the network to prevent potential lateral movement or data exfiltration and obtaining a packet capture from the NSM utility for analysis. Your task is to analyze the pcap and assess for signs of malicious activity.

https://cyberdefenders.org/blueteam-ctf-challenges/openwire/

1- By identifying the C2 IP, we can block traffic to and from this IP, helping to contain the breach and prevent further data exfiltration or command execution. Can you provide the IP of the C2 server that communicated with our server?

146.190.21.92

By reviewing the traffic, I noticed the use of the OpenWire protocol in packets 4 and 5, which immediately stood out as unusual. I followed the TCP stream for these packets and observed an Exception Response (0x1F) being sent. This response invoked the org.springframework.context.support.ClassPathXmlApplicationContext class, which then attempted to load a bean definition from an external XML file. The XML file was being retrieved from http://146.190.21.92:8000/invoice.xml. Since this IP is hosting the malicious XML used to trigger the exploit // C2 server: 146.190.21.92.

2- Initial entry points are critical to trace the attack vector back. What is the port number of the service the adversary exploited?

61616

From the packet capture, it’s clear that the Exception Response was directed at the service listening on port 61616. This port is commonly used by Apache ActiveMQ, which matches the exploitation activity observed.

3- Following up on the previous question, what is the name of the service found to be vulnerable?

Apache ActiveMQ