Abstract
A network forensics walkthrough of the CyberDefenders OpenWire challenge. Starting from a
single PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I
trace an Apache ActiveMQ compromise via CVE-2023-46604: from the initial remote code
execution on the OpenWire port, through a malicious Spring XML payload that abuses
java.lang.ProcessBuilder, down to a dropped reverse shell talking to two separate C2 servers.
Scenario
During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about a public-facing server. The server has been flagged for outbound connections to multiple suspicious IPs. Following the incident response process, the host is isolated from the network and a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess for signs of malicious activity.
Tool used: Wireshark.
Investigation
Q1. What is the IP of the C2 server that communicated with our server?
Opening the PCAP, the OpenWire protocol immediately stands out, with traffic involving
146.190.21.92. Following its TCP stream out of curiosity:
The stream shows a Spring ClassPathXmlApplicationContext being used to pull an invoice.xml
from that same IP. That makes it the C2 server.
Answer: 146.190.21.92
Q2. What is the port number of the exploited service?
Inspecting the OpenWire frames, the recurring port is 61616, the ActiveMQ OpenWire default.
Answer: 61616
Q3. What is the name of the vulnerable service?
Looking up what runs on port 61616 confirms it is Apache ActiveMQ.
Answer: Apache ActiveMQ
Q4. What is the IP of the second C2 server?
Going to Statistics > Endpoints to list every host in the capture:
The victim (public server) is 134.209.197.3 and the first C2 is 146.190.21.92. That leaves two
unknown addresses to check. Following their TCP streams and reading the content of the malicious
payload reveals the second C2:
Answer: 128.199.52.72
Q5. What is the name of the reverse shell executable dropped on the server?
The reverse shell surfaced in the previous step: the dropped binary is named docker (masquerading
as the legitimate Docker binary).
Answer: docker
Q6. What Java class was invoked by the XML file to run the exploit?
Reading the XML payload that was served, the bean definition at the top invokes
java.lang.ProcessBuilder to execute commands on the host.
Answer: java.lang.ProcessBuilder
Q7. What CVE identifier is associated with this vulnerability?
Searching the behaviour (ActiveMQ OpenWire, remote class instantiation, RCE) points to a single, exact match.
Answer: CVE-2023-46604
Q8. In which Java class and method was the validation step added by the vendor?
The vendor fixed the flaw by adding a validation step
so that only valid Throwable classes can be instantiated. Per the vendor patch and TrendMicro’s
analysis, the check was added in:
Answer: BaseDataStreamMarshaller.createThrowable
Indicators of compromise (IOC)
| Type | Value |
|---|---|
| C2 server #1 | 146.190.21.92 |
| C2 server #2 | 128.199.52.72 |
| Exploited service / port | Apache ActiveMQ / 61616 (OpenWire) |
| Malicious payload | invoice.xml (remote Spring XML) |
| Dropped reverse shell | docker (masqueraded binary) |
| Vulnerability | CVE-2023-46604 |
MITRE ATT&CK mapping
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 |
| Execution | Command and Scripting Interpreter | T1059 |
| Defense Evasion | Masquerading (binary named docker) | T1036 |
| Command and Control | Application Layer Protocol | T1071 |
| Command and Control | Ingress Tool Transfer | T1105 |
References
- CyberDefenders — OpenWire challenge
- NVD — CVE-2023-46604
- Apache ActiveMQ security advisory and patch (
BaseDataStreamMarshaller.createThrowable) - TrendMicro — analysis of CVE-2023-46604 exploitation