Unit 7: The network from the host · Lesson 6 of 7 · 26 min
Case file: checking the box at the edge
VPN gateways are Linux machines on the internet. Check one against its vendor manifest and catch a log gap with an off-box copy.
mission
- You are
- You are investigating gw01, the remote access gateway.
- Situation
- The vendor warned about an exploited flaw in this release. Files and logs from gw01 are in /srv/cases/gw01, with a copy of the logs the gateway forwarded to the SIEM.
- Goal
- Prove whether files changed, find any log gap, and list what happened in it.
- Hand in
- Changed files, the gap, and the events inside it.
case file
Ivanti Connect Secure Zero-Days
Ivanti Connect Secure / Policy Secure customers · 2024
Two chained zero-days (CVE-2023-46805 and CVE-2024-21887) in Ivanti Connect Secure VPN appliances allowed unauthenticated remote code execution; Volexity found activity dating to at least December 3, 2023, attributed to a suspected Chinese state actor (UTA0178). Attackers wiped appliance logs, harvested credentials and moved into internal networks. CISA's Emergency Directive 24-01 ordered agencies to disconnect, factory-reset and rebuild the appliances and reset associated credentials.
What went wrong
Internet-facing VPN appliances with critical authentication-bypass and command-injection flaws, where on-box logs could be wiped and integrity tools could be evaded.
What would have stopped it
- Forward appliance logs to an external syslog/SIEM so they cannot be erased on the device.
- Apply vendor mitigations and updates within 48 hours for edge devices, and factory-reset/rebuild suspected appliances rather than just patching.
- Treat credentials and secrets stored on or used through the appliance as compromised and rotate them.
- Restrict what the VPN appliance itself can reach internally (no direct RDP/SMB/SSH to arbitrary hosts).
What defenders could have seen
- Integrity checker events reporting new or mismatched files (for example SYS32039/SYS32040).
- Gaps in appliance logs or logging being disabled.
- Outbound connections or internal RDP/SMB/SSH originating from the appliance's own IP.
sourcescisa.govvolexity.com
Read the note and version
cat NOTE.txt firmware/VERSION
Files and logs copied from gw01, the remote access gateway, on 2026-10-21.
Vendor patch 22.7R2.3 was applied on 2026-10-10 at 11:00 UTC.
The vendor manifest came from the vendor's download portal, not from the device.
gw-os 22.7R2.3
you should see The manifest came from the vendor's portal, not from the device itself.
Check every file against the manifest
sha256sum -c ../firmware/MANIFEST.sha256
bin/auth: OK
bin/sessiond: OK
etc/gw.conf: OK
portal/help.cgi: FAILED
portal/index.cgi: OK
portal/login.cgi: OK
portal/logout.cgi: OK
sha256sum: WARNING: 1 computed checksum did NOT match
you should see help.cgi does not match what the vendor shipped.
Find files the vendor never shipped
A hash check only covers listed files. comm -13 prints names that exist only on the box.
find portal bin etc -type f | sort > /tmp/on-box.txt awk '{print $2}' ../firmware/MANIFEST.sha256 | sort > /tmp/vendor.txt comm -13 /tmp/vendor.txt /tmp/on-box.txt portal/compcheck.cgi
you should see compcheck.cgi, in the web portal.
Look for a gap in the on-box log
grep -c . root/var/log/events.log siem/gw01-forwarded.log root/var/log/events.log:23 siem/gw01-forwarded.log:46 grep -v 'auth:' root/var/log/events.log 2026-10-06T05:40:00Z gw01 system: logging started
you should see The device kept 23 lines, the SIEM 46, and logging restarted at 05:40.
Read what the SIEM still has
grep -v 'auth:' siem/gw01-forwarded.log
2026-10-06T02:14:09Z gw01 web: POST /portal/compcheck.cgi from 45.77.12.9 status=200
2026-10-06T02:31:40Z gw01 admin: configuration exported by session 7f3a from 45.77.12.9
2026-10-06T03:02:55Z gw01 web: POST /portal/compcheck.cgi from 45.77.12.9 status=200
2026-10-06T05:38:12Z gw01 system: event log cleared by local administrator
you should see Calls to the unknown file, a configuration export and the log being cleared, all from one address.
defender tip Treat everything the gateway stored as stolen: rotate its certificates, service passwords and any credentials that passed through it, then rebuild it.
Two places to look
events.log: 02:03 ... 05:40 system: logging started
Whoever owns the box controls this story
02:14 POST /portal/compcheck.cgi 02:31 configuration exported 05:38 event log cleared
The truth, kept somewhere they could not reach
What a defender takes away
- 1Check appliances against a manifest you got from the vendor, not the device.
- 2Forward logs off the box in real time.
- 3After a compromise: rebuild, then rotate every secret it held.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.