GoAnywhere MFT: Cl0p Deserialization Exploit (CVE-2023-0669)
A GoAnywhere MFT admin console left reachable from the internet was compromised through a pre-authentication Java deserialization vulnerability. An attacker dropped a persistent Java agent, provisioned a rogue admin account, enumerated hundreds of managed file transfers, and exfiltrated a bulk archive of partner-client data. Reconstruct the full chain from the GoAnywhere web logs and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the exposed management surface
10Something on the MFT server accepted inbound connections from external addresses well before anything obviously malicious occurred. Establish what administrative interface was reachable from the internet and on which port.
Identify the exploit delivery source
15The reconnaissance probes and the actual exploit delivery came from different addresses within the same attacker range. Distinguish the address that sent the weaponized deserialization payloads from the one that only looked around.
Name the persistence mechanism
20Following the exploit, something new appeared inside the running application. Determine what file was dropped to establish persistence inside the GoAnywhere installation.
Track the rogue account operator
15Once the agent provisioned an admin account, a different external address used it to log in and carry out hands-on operations. Identify that operator address.
Measure the data that left the building
15At the end of the attack chain the MFT server sent a very large payload outbound to an attacker-controlled host. Determine the name of the archive file that was staged and exfiltrated.
Map the exfiltration technique
10The final stage used a specific MITRE ATT&CK technique to move data off the network. Identify the technique ID that describes exfiltrating data over an encrypted web service.
Classify the persistence technique
15The dropped Java agent is an example of a server-side persistence component placed inside a running web application. Map it to the correct ATT&CK sub-technique.
7 tasks · 100 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allCitrix Bleed: Session Token Hijack (CVE-2023-4966)
A Citrix NetScaler ADC/Gateway running a vulnerable firmware version leaked an authenticated VPN session token through a heap memory disclosure flaw. An attacker captured the token from the HTTP response, replayed it to bypass MFA, and landed inside the network as a legitimate user. Reconstruct the exploit, the stolen credential, the lateral RDP move, and the post-exploitation activity from the NetScaler logs, firewall traffic, and XDR endpoint telemetry.
Ivanti Connect Secure: Auth Bypass to Webshell
An internet-facing Ivanti Connect Secure VPN appliance has been exploited through a pair of chained zero-days: an authentication bypass and a command injection. A webshell is now resident on the appliance, credentials have been stolen from the system configuration, and the attacker has pivoted inward. Work from the SIEM access logs, the Linux host audit trail, and the XDR process tree to reconstruct the chain from the first bypass request to the internal pivot.
Cleo Harmony MFT: Cl0p Data Theft at Vantex Logistics
A Cleo Harmony managed file transfer server in the Vantex Logistics DMZ started reaching external systems it does not normally contact and running processes the change record does not explain. Reconstruct what happened from the Cleo web logs, the Windows event logs, the resolver and the perimeter firewall.