CyberDefenders XXE Infiltration

Introduction

Hello everyone 👋🏻. In this walkthrough, I will be providing steps, tips, and key points to help you successfully complete the CyberDefenders XXE Infiltration lab 🎉.

Scenario

You are a cybersecurity analyst at PageTurner, a famous online bookstore. An automated alert has detected unusual XML data being processed by the server, indicating a potential XXE (XML External Entity) Injection attack. This raises concerns about the integrity of PageTurner’s customer data and internal systems, prompting an immediate investigation.

As the lead analyst in this case, you must analyze the network traffic to uncover the nature of the suspicious activity. Your objectives include identifying the attack vector, assessing the scope of any potential data breach, and determining if the attacker gained further access to PageTurner’s internal systems.

Questions

Question #1: Can you provide the highest numbered port open on the victim machine?

To solve this question, I suggest running Zui (Brim) first since it allows you to write different queries on your PCAP files. But first things first, we need to identify the attacker and the victim machine, this can be done by identifying the odd traffic between hosts using either Zui (Brim) or Wireshark.

Get Yamen Idriss’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I have decided to use Zui to find such information. After scrolling down enough, we can confidently say that the unusual traffic patterns were observed between two machines, first is the attacker (210.106.114.183) and the second is the compromised web server (50.239.151.185).

Attacker machine IP and compromised web server IP

To figure out the highest open port on the victim web server, we can solve this question backwardly by finding the different open services on the machine and then matching them to their respective port numbers, this can be done by running the following query:

id.orig_h==210.106.114.183 | id.resp_h==50.239.151.185 | count() by service

Finding services

Answer: HTTP is 80 in this case, and MySQL is 3306. Hence the answer is 3306

Question 2: What is the complete URI of the PHP script vulnerable to XXE Injection?

Now it’s time to run Wireshark, the first thing you notice after quickly inspecting the PCAP, is that the attacker was communicating with the web server over HTTP protocol. We can take advantage of this information to narrow down our displayed packets to look for the vulnerable PHP script (through POST requests HOPEFULLY) by executing the following filter:

ip.addr == 210.106.114.183 and http.request.method == POST 

Identifying the complete URI of the PHP script vulnerable to XXE injection

It’s clear to us that /review/upload.php is the answer

Question 3: What’s the name of the first malicious XML file uploaded by the attacker?

It’s time to dig deep into these malicious POST request to find the malicious XML files. By examining the first POST request, we can clearly see the name of the uploaded file:

First malicious uploaded XML file

Filename: TheGreatGatsby.xml

Question 4: What’s the name of the web app configuration file the attacker read?

By correlating the information gathered from the previous questions, we have to start looking in packets after the packet #88306 since the compromise started from there. But first, we have to expand our packet view by executing the following filter command:

(ip.addr == 210.106.114.183 or http.request.method) && !(_ws.col.protocol == "TCP")

After examining the following packets, we can notice that the attacker made a malicious POST request by uploading a file called ToKillaMockingBird.xml to the web server, attempting to read the config.php configuration file:

Uploading a malicious XML file to read “config.php”

Filename: config.php

Question 5: What’s the password of the compromised database user?

It’s common for the database password to be stored in config.php file. Let’s take a look at the response coming from the web server:

Password in cleartext

Password: Winter2024

Question 6: What’s the UTC timestamp of the attacker’s first connection with the MySQL server in attempt to utilize the compromised credentials?

The very next two packets (Server Greeting and Login Request packets) reveal the attacker’s first connection to the MySQL server. The UTC time can be found in the “Frame” section within Wireshark:

UTC time of attacker’s first interaction with the MySQL server

As we can see, the “UTC Arrival” time is: May 31, 2024 12:08:49.165156000

UTC Time: 2024–05–31 12:08:49

Question 7: Can you identify the name of the web shell the attacker uploaded for remote code execution and persistence?

Web shells allow attackers to gain shell access to the web servers. From this shell access, the attacker can execute various commands depending on the granted privilege level.

We have now to deepen our investigations. By scrolling down enough, we will be able to notice that the attacker is executing “information gathering” commands such as whoami , sudo -l , cat /etc/shadow , etc. from a web shell called booking.php:

Web shell

Web shell name: booking.php

Thank you so much 💙!

Thank you so much for taking the time to read my post! I truly appreciate your support and hope you found it helpful. Stay tuned for more upcoming security writeups and guides, as I look forward to sharing more insights with you soon 🔜.

Please feel free to contact me 📇.