Cisco IOS XE Web UI: Implant and Rogue Admin (CVE-2023-20198)
The Cisco IOS XE Web UI management interface on AXFORD-RTR-01 was inadvertently exposed to the internet. An attacker exploited CVE-2023-20198 to create an unauthenticated privilege-15 local account, then chained CVE-2023-20273 to drop a Lua implant on the device flash filesystem. The implant hooked the HTTP server and beaconed to an external C2 address. Reconstruct the full compromise chain from the router syslog and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish the exposure vector
15The edge router management interface was reachable from the public internet. Before examining the exploit chain, establish the exact TCP port that was exposed.
Find the initial access source
20Two external addresses from the same subnet probed the router before anything was written to the device. One performed reconnaissance only; the other triggered account creation. Identify the exploit source.
Name the rogue account
25The first exploit stage created a privileged local account on the device without any legitimate administrator action. Identify the account name from the device logs.
Identify the implant
20After account creation, the attacker used a second exploit to write a persistent file to the router filesystem. Name the implant file from the device logs.
Map the persistence technique
20The implant embedded in the router HTTP server provides the attacker with durable access that survives configuration restarts. Map the persistence mechanism to its MITRE ATT&CK technique identifier.
Trace the implant callback
25Once installed, the implant initiated outbound contact to confirm persistence and receive tasking. Identify the external C2 IP address it contacted.
6 tasks · 125 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.