Tomcat Manager Abuse: Weak Credentials to Webshell
An Apache Tomcat server at a retail company has its Manager web application exposed with default credentials. An attacker authenticates, deploys a malicious WAR webshell, runs OS commands through it, and drops a cryptocurrency miner. Walk the Tomcat access logs from the first 401 to the mining pool connection.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: default keys on the front door
0A monitoring alert flagged unusual HTTP traffic on HRG-APP-03. Before you trace the attack chain, get a clear picture of how attackers exploit exposed management interfaces.
Find the first successful Manager login
10Before deploying anything, the attacker had to authenticate. Review the Manager authentication trail and identify the external IP that succeeded after several failed attempts.
Identify the deployed WAR filename
10Immediately after logging in, the attacker uploaded a file to make a webshell live. Identify the WAR archive they deployed through the Manager.
Trace the webshell command that fetched the miner
15Once the webshell was live, the attacker ran OS commands through it. One of those commands downloaded the miner payload. Identify the binary that was fetched.
Identify the mining pool domain
15The miner connected outbound to a pool relay after launch. Find the domain the miner was configured to use as its pool destination.
Map the initial access to MITRE ATT&CK
10Close the investigation by classifying how the attacker first authenticated to Tomcat Manager. The entry was made possible by credentials that were never changed from their factory values.
6 tasks · 60 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.