Unit 8: Logs and the timeline · Lesson 8 of 8 · 22 min
Case file: mass theft from a file transfer server
A file transfer app was emptied through a page that should not exist. Find it in the web logs and size what left.
mission
- You are
- You are the analyst reviewing transfer01 for 31 May 2023.
- Situation
- A file transfer product has an exploited flaw. Its web logs for the day are in /srv/cases/transfer01.
- Goal
- Find requests to pages the application does not have, who made them and how much data they returned.
- Hand in
- Page, source addresses, request count and bytes.
case file
MOVEit Transfer Mass Exploitation
Progress Software (MOVEit Transfer) and its customers · 2023
Starting around May 27, 2023, the CL0P extortion group exploited a SQL injection zero-day (CVE-2023-34362) in internet-facing MOVEit Transfer servers and mass-stole stored files. Attackers installed a web shell (LEMURLOOT, 'human2.aspx') that could list and download files and create administrator accounts. The campaign hit a very large number of organizations and followed earlier CL0P campaigns against other managed file transfer products.
What went wrong
An unauthenticated SQL injection flaw in an internet-exposed file transfer application that held large volumes of sensitive data, with no compensating layer in front of it.
What would have stopped it
- Do not expose file transfer web interfaces directly to the internet where possible; place them behind VPN or authenticated gateways.
- Patch known-exploited vulnerabilities on internet-facing systems immediately, and have a playbook to block HTTP/HTTPS access when a zero-day is announced.
- Apply data retention limits so transfer servers do not accumulate years of sensitive files.
- Keep MOVEit-style servers' outbound access restricted and admin rights least-privileged.
What defenders could have seen
- New or unexpected .aspx files in the web root.
- Unexpected administrator accounts (for example 'Health Check Service') in the application database.
- Large or unusual download volumes from the transfer server.
sourcescisa.govbleepingcomputer.com
Spotting the page that should not exist
- List real pagesFrom the app's documentation
- Count requests per pageawk and uniq -c
- Anything elseA new file in the web root
- Size the damageSum the bytes it returned
Read the note
cat NOTE.txt
Web logs from transfer01, the file transfer server, for 31 May 2023.
The application's own pages end in .aspx and live under /files/, /api/ and /login.aspx.
you should see The application's real pages.
Count requests per page
IIS logs list their fields in the #Fields header. Field 5 is the page.
grep -v '^#' u_ex230531.log | awk '{print $5}' | sort | uniq -c | sort -rn
48 /files/list.aspx
46 /
40 /files/download.aspx
39 /api/v1/folders
37 /login.aspx
10 /human2.aspx
you should see One page is not part of the application.
Who asked for it
grep human2.aspx u_ex230531.log | awk '{print $8}' | sort | uniq -c
3 138.197.152.201
3 209.97.137.33
4 5.252.189.52
you should see Three outside addresses.
How much left
grep -c human2.aspx u_ex230531.log 10 grep human2.aspx u_ex230531.log | awk '{s += $11} END {print s}' 55617413
you should see Ten requests returning about 55 MB.
defender tip Large responses to an unknown page are the signal. Alert on new files in the web root and on outbound volume from servers that store data.
Exposure
anyone -> transfer01:443 all stored files reachable through one flaw
One bug empties the server
partners via VPN or IP allowlist files deleted after 30 days web root change alerts
Less reachable, less stored, faster noticed
What a defender takes away
- 1Know your application's real pages; anything else is a finding.
- 2Alert on new files in the web root.
- 3Store less: data you deleted cannot be stolen.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.