Spring4Shell: Class-Loader RCE to Webshell (CVE-2022-22965)
An internet-facing Java Spring MVC application is compromised through CVE-2022-22965 (Spring4Shell), a class-loader manipulation flaw that turns Tomcat's own logging system into a webshell writer. Working from the Tomcat access logs and the perimeter firewall, trace the exploit request, identify what landed on disk, follow the operator's command sessions, and catch the pivot to an internal backend service.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the exploit source
20Multiple external addresses touched the Spring application. One of them sent a POST request whose parameters manipulated internal framework properties in a way no legitimate API client would. Identify the source address behind that exploitation request.
Identify the dropped webshell
20The class-loader exploit did not execute code directly; it abused the Tomcat logging system to write a file to disk. Identify the filename of the JSP that was written to the web application root.
Name the service account behind the commands
15The webshell runs commands on the operating system, but it does not choose who those commands run as. The OS account is whatever account the Tomcat process itself uses. Identify the service account that executed the shell commands.
Determine the operator source address
20The IP that planted the webshell and the IP that drove commands through it are distinct. Identify the address that acted as the hands-on operator after the webshell was established.
Spot the lateral probe
25Shortly after gaining command execution, the attacker pivoted from the compromised application server to probe a backend service that is only reachable from inside the network. Identify the internal destination IP the compromised host connected to.
Classify the persistence technique
20The attacker gained durable access to the compromised server not by adding a system service or a crontab entry but by planting a file inside the web application itself. Identify the MITRE ATT&CK technique that describes using a server-side web file for persistent access.
6 tasks · 120 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.