OpenWire — Investigating an Apache ActiveMQ RCE (CVE-2023-46604)
Abstract A network forensics walkthrough of the CyberDefenders OpenWire challenge. Starting from a single PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I trace an Apache ActiveMQ compromise via CVE-2023-46604: from the initial remote code execution on the OpenWire port, through a malicious Spring XML payload that abuses java.lang.ProcessBuilder, down to a dropped reverse shell talking to two separate C2 servers. Scenario During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about a public-facing server. The server has been flagged for outbound connections to multiple suspicious IPs. Following the incident response process, the host is isolated from the network and a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess for signs of malicious activity. ...