Openfire
As a cybersecurity analyst, you are tasked with investigating a data breach targeting your organization’s Openfire messaging server. Attackers have exploited a vulnerability in the server, compromising sensitive communications and potentially exposing critical data. Your task is to analyze the provided network capture files using Wireshark. Identify evidence of the exploitation, trace the attacker’s actions, and uncover indicators of compromise.
What is the CSRF token value for the first login request?
To identify the CSRF token used during authentication, the network traffic was analyzed in Wireshark. HTTP requests containing the keyword “login” were filtered, and the first POST request sent to /login.jsp was examined. The submitted form parameters revealed the CSRF token value associated with the initial login attempt.
http contains "login"
So the answer is : TmJU6J9uym8oIOD
— — — — — — — — — — — — —
What is the password of the first user who logged in?
From the last pic .. By analyzing the first HTTP POST login request, the credentials of the first authenticated user were identified, revealing that the user admin logged in using the password Admin@Passw0rd#@.
So the answer is : Admin@Passw0rd#@#
— — — — — — — — — — — — — -
What is the 1st username that was created by the attacker?
http contains "username"
By examining the user-create.jsp requests and reviewing the submitted URL parameters, the first user account created by the attacker was identified as 3536rr.
So the answer is : 3536rr
— — — — — — — — — — — — —
What is the username that the attacker used to login to the admin panel?
From last question By examining the account creation requests to user-create.jsp and correlating them with the subsequent login requests, it was determined that the attacker used the username a7zo41 to authenticate to the admin panel.
So the answer is : a7zo41
— — — — — — — — — — — —
What is the name of the plugin that the attacker uploaded?
http.request.method == "POST"
By analyzing the HTTP POST request sent to plugin-admin.jsp, the uploaded plugin file was identified from the multipart form-data content. The attacker uploaded the plugin named openfire-plugin.jar.
Get ahmed alaa’s stories in your inbox
Join Medium for free to get updates from this writer.
So the answer is : openfire-plugin.jar
— — — — — — — — — — — —
What is the first command that the user executed?
Within the last POST filter ..
By examining the HTTP POST requests sent to /plugins/openfire-plugin/cmd.jsp?action=command, the first command executed through the uploaded plugin was identified. The attacker initially used the whoami command to determine the current user context of the compromised system.
So the answer is : whoami
— — — — — — — — — — — -
Which tool did the attacker use to get a reverse shell?
By examining the command execution requests sent to /plugins/openfire-plugin/cmd.jsp, it was observed that the attacker used Netcat (nc) to establish a reverse shell connection from the compromised server to the attacker's machine.
So the answer is : netcat
— — — — — — — — — — -
Which command did the attacker execute on the server to check for network interfaces?
tcp.port == 8888By following the TCP stream associated with the reverse shell connection on TCP port 8888, the commands executed by the attacker were reviewed. During the post-exploitation phase, the attacker performed network enumeration to identify the available network interfaces and obtain the system’s network configuration. The command used for this purpose was ifconfig.
So the answer is : ifconfig
— — — — — — — — — -
What is the CVE of the vulnerability exploited?
By reviewing the attack sequence, the attacker accessed the Openfire setup environment using a path traversal authentication bypass vulnerability. This allowed the creation of administrative users, authentication to the admin console, and the upload of a malicious plugin that was later used to execute commands and obtain a reverse shell. These actions are characteristic of CVE-2023–32315, an Openfire Administration Console Authentication Bypass vulnerability.
So the answer is : CVE-2023–32315
Conclusion
The investigation revealed that the attacker exploited CVE-2023–32315 to bypass authentication, create administrative accounts, and gain unauthorized access to the Openfire administration console. The attacker then uploaded a malicious plugin, executed system commands, and established a reverse shell using Netcat to maintain remote access. This incident demonstrates the critical impact of unpatched vulnerabilities and highlights the importance of timely updates, access control, and continuous monitoring to detect and prevent unauthorized activity.
Reference
lab link:
https://cyberdefenders.org/blueteam-ctf-challenges/openfire/
