Apache Path Traversal: CVE-2021-41773 to RCE
An Apache 2.4.49 web server at Kestrel Analytics is targeted via CVE-2021-41773. An attacker uses percent-encoded path traversal to read /etc/passwd, confirms mod_cgi is enabled, and escalates to remote code execution. Walk the access logs and firewall traffic step by step to trace the traversal, the RCE, and the webshell that was left behind.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: a dot that should not be there
0A public web server running Apache started returning sensitive system files in its HTTP responses this morning. Before digging in, orient yourself on how this attack works.
Spot the traversal request
15The attack started with a single HTTP request that walked out of the web root to read a sensitive file. Find that request in the access logs.
Trace who escalated to command execution
15Reading /etc/passwd is serious. Running commands on the server is worse. A different external address arrived and chained the same traversal through the CGI handler to execute shell commands. Identify it.
Find the webshell that was planted
10After confirming code execution, the attacker established persistence by writing a webshell into the cgi-bin directory. Identify the filename that was dropped.
Identify the service account that ran the shell
10The shell commands did not run as root. The CGI handler executed them under the web server service account. Confirm which account that was.
Map the initial access to MITRE ATT&CK
10Step back and label how the attacker first gained access. The vulnerability exploited here is a public-facing web server flaw, not a phish or a stolen credential.
6 tasks · 60 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allWordPress Plugin RCE: Webshell on a Vulnerable Site
A media company's WordPress server is compromised after an attacker exploits an unpatched file-upload plugin to drop a PHP webshell into the public uploads directory. Work through the Apache access logs and IDS alerts step by step, tracing the probe, the upload bypass, and the command execution that followed.
Remcos RAT: Malicious Invoice Attachment
An accounts-payable employee at Harwell Logistics opens what looks like an overdue supplier invoice, and minutes later her workstation is holding a persistent outbound session to an address outside the company on a port nothing else uses. Walk the mail gateway records, the endpoint file artifacts and the process tree in order, pulling one indicator out of each surface until the delivery, the loader, the execution chain and the implant are all named, then close the case with an ATT&CK label.
Malicious npm Package: Postinstall Infostealer
A developer at a software company runs a routine npm install and the terminal returns clean. Less than a minute later the web proxy records a large outbound upload from that workstation. Work the process tree, the file activity and the outbound traffic to reconstruct what the install actually did.