WordPress Plugin RCE: Webshell on a Vulnerable Site
A media company's WordPress server is compromised after an attacker exploits an unpatched file-upload plugin to drop a PHP webshell into the public uploads directory. Work through the Apache access logs and IDS alerts step by step, tracing the probe, the upload bypass, and the command execution that followed.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: the site that served itself
0Your SIEM fired a cluster of alerts on the Ridgeline Media web server this morning. Before you dig into the logs, get oriented on how this kind of compromise works.
Identify the scanner
10Before the attacker exploited anything, an automated tool probed the WordPress install looking for a vulnerable plugin version. Identify the IP address that performed that reconnaissance.
Locate the upload handler that was exploited
15The attacker switched IPs and sent the malicious file to a specific plugin endpoint. Identify the path of the upload handler.
Name the webshell file
15The upload handler wrote the PHP file to disk. Identify the filename it was given.
Confirm the source IP executing commands
15The webshell was accessed from an IP that did not make the upload. Identify that IP.
Name the first OS command the attacker ran
15The attacker's first webshell request confirmed they had code execution. Identify the command they ran.
Classify the initial access technique
10Wrap up by labeling how the attacker got in. They did not phish a user or brute-force a password: they exploited a vulnerability in a web-facing service.
7 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allTomcat Manager Abuse: Weak Credentials to Webshell
An Apache Tomcat server at a retail company has its Manager web application exposed with default credentials. An attacker authenticates, deploys a malicious WAR webshell, runs OS commands through it, and drops a cryptocurrency miner. Walk the Tomcat access logs from the first 401 to the mining pool connection.
Apache Path Traversal: CVE-2021-41773 to RCE
An Apache 2.4.49 web server at Kestrel Analytics is targeted via CVE-2021-41773. An attacker uses percent-encoded path traversal to read /etc/passwd, confirms mod_cgi is enabled, and escalates to remote code execution. Walk the access logs and firewall traffic step by step to trace the traversal, the RCE, and the webshell that was left behind.
Remcos RAT: Malicious Invoice Attachment
An accounts-payable employee at Harwell Logistics opens what looks like an overdue supplier invoice, and minutes later her workstation is holding a persistent outbound session to an address outside the company on a port nothing else uses. Walk the mail gateway records, the endpoint file artifacts and the process tree in order, pulling one indicator out of each surface until the delivery, the loader, the execution chain and the implant are all named, then close the case with an ATT&CK label.