CyberDefenders — OpenWire Lab Writeup

First thing you should think of is going to Statistics ➔ Conversations to get a summary of all IPs and see what actually happened.

When you look at the IPv4 conversations, you will notice only 1 IP has a huge amount of data transferred (~5 MB). That is our C2 server communicating with our server (high data transfer usually means an exploit payload, staging files, or exfiltration).

Alternative Method:

Right when you open the PCAP, you'll immediately notice the OpenWire protocol in the packet list. Looks sus at first glance!

Right-click any of those packets ➔ Follow ➔ TCP Stream:

Boom🔥 you found the target attacker IP: 146.190.21.91

That's easy Now that we know the attacker's IP from Q1, we just filter for it in Wireshark:

Look at the destination port on our server:

Easy 🤙;-;🤙 The destination port being hit is 61616.

We need details about what service is running on that port. How do we find it? Look at the response packet mentioned in the first question:

1. Click on the packet and expand OpenWire (WireFormatInfo) in the packet details pane.
2. Under the properties/entries, look at ProviderName:

The answer is Apache ActiveMQ.

(Or you can just search the attacker's IP on VirusTotal to see community reports referencing ActiveMQ!)

Go back to Statistics ➔ Conversations ➔ IPv4. There aren't many IPs that talked to our server:

• Our Server: 134.209.197.3
• First Attacker C2: 146.190.21.91

That leaves only two other external IPs. Based on the question format, it points to 128.199.52.72.

But we need to learn, so let's verify:

Filter for the suspicious IP to see what traffic occurred between it and our server:

Following the stream reveals HTTP traffic downloading a malicious payload (docker binary):

lol we literally just found this in the previous question while following the HTTP stream from the second C2!

The downloaded file is disguised as docker

💡 The Approach:

Easy one! Inspect the HTTP response that requested invoice.xml / poc.xml:

Follow the HTTP stream to inspect the raw XML payload:

Inside the XML bean definition, the class invoked to execute the command is java.lang.ProcessBuilder

Check VirusTotal or Google the combination of Apache ActiveMQ + OpenWire RCE + 61616.

In VirusTotal: press Ctrl + F and search for CVE:

It points directly to CVE-2023-46604

You might ask: How do you get source code from only a PCAP file????

Let me tell you :0
You already have the two most important clues:

1. Software: Apache ActiveMQ
2. Vulnerability: CVE-2023-46604

Where do all project files and commits get pushed? Yep, GitHub!

Searching the ActiveMQ GitHub repository commits for CVE-2023-46604 (or googling the patch details if you're lazy like me 0-0):

The patch added the validation step inside:
BaseDataStreamMarshaller.createThrowable