Unit 1: Requests and responses · Lesson 5 of 5 · 26 min
Case file: the exposed file transfer server
Review an internet-facing file transfer app the way responders did in 2023: exposure, version, tampering, downloads and retention.
case file
MOVEit Transfer mass exploitation
Progress Software (MOVEit Transfer) and its customers · 2023
From late May 2023 the CL0P extortion group exploited a SQL injection zero-day (CVE-2023-34362) in internet-facing MOVEit Transfer servers and stole stored files at scale. A web shell planted on the servers could list and download files and create administrator accounts.
What went wrong
An unauthenticated flaw in an internet-exposed file transfer application that held large volumes of sensitive data, with nothing in front of it.
What would have stopped it
- Keep file transfer web interfaces off the open internet, behind a VPN or authenticated gateway.
- Patch known-exploited flaws on internet-facing systems immediately, and have a playbook to block access when a zero-day is announced.
- Limit how long files are kept, so a breach cannot take years of data.
What defenders could have seen
- New or unexpected .aspx files in the web root.
- Administrator accounts nobody created.
- Large or unusual download volumes from the transfer server.
sourcescisa.govbleepingcomputer.com
mission
- You are
- The analyst on call the morning a file transfer advisory drops.
- Situation
- The shop runs FileDrop, a file transfer app modelled on MOVEit, for sending payroll and contract files to partners. The vendor has just published an advisory saying a flaw is being exploited in the wild.
- Goal
- Decide whether the shop is exposed, look for the signs the advisory lists and measure what may have left.
- Hand in
- A short incident note: exposure, version, signs found, files taken, and what to change.
A file transfer server as a parcel depot
Is it on the internet?
Start from the external attack surface list, the inventory of everything the internet can reach.
cat cases/transfer/exposure.txt host port service auth version shop.example.com 443 shop none 1.4 files.shop.example.com 443 FileDrop password 4.2.1 vpn.shop.example.com 443 vpn mfa 22.3 status.example.com 443 status none 2.0 mail.shop.example.com 443 webmail mfa 9.1 awk 'NR>1 && $4=="password"' cases/transfer/exposure.txt files.shop.example.com 443 FileDrop password 4.2.1
you should see FileDrop is the only internet-facing service that relies on a password alone, and it runs version 4.2.1.
Is that version affected?
grep -E '^(Affected|Fixed in|Exploited)' cases/transfer/advisory.txt
Affected: FileDrop web interface, all versions before 4.2.3
Fixed in: 4.2.3
Exploited in the wild: yes
you should see Everything before 4.2.3 is affected and the flaw is already being exploited. The shop's 4.2.1 is in range.
defender tip When an advisory says exploited in the wild, the first action is to cut internet access, before anyone schedules a patch window.
Look for a planted page
The advisory says to look for unexpected .aspx files. The web root listing came from the server's file system.
grep '\.aspx' cases/transfer/webroot-listing.txt
-rw-r--r-- 1 filedrop filedrop 4120 2025-11-03 10:12 default.aspx
-rw-r--r-- 1 filedrop filedrop 2988 2025-11-03 10:12 login.aspx
-rw-r--r-- 1 filedrop filedrop 6411 2025-11-03 10:12 upload.aspx
-rw-r--r-- 1 filedrop filedrop 3307 2025-11-03 10:12 download.aspx
-rw-r--r-- 1 filedrop filedrop 1874 2026-05-29 02:11 status2.aspx
you should see Four pages share the install date. One, status2.aspx, appeared on 2026-05-29 at 02:11.
Look for an admin nobody created
grep ',admin,' cases/transfer/users.csv
2,ben.o,Ben Ortiz,admin,2023-09-01
6,svc-health,Health Check Service,admin,2026-05-29
you should see Two administrators. svc-health, named Health Check Service, was created on the same day as the new page.
Measure what left
grep -o 'user=[a-z.-]*' cases/transfer/downloads.log | sort | uniq -c | sort -rn 41 user=svc-health 4 user=dana.r 4 user=chen.l 4 user=amara.k 3 user=payroll-sync 3 user=eli.m grep 'user=svc-health' cases/transfer/downloads.log | head -n 3 2026-05-29T02:14:00Z user=svc-health ip=198.51.100.23 file=/payroll/2024-01-01-000.csv 2026-05-29T02:14:13Z user=svc-health ip=198.51.100.23 file=/contracts/2025-08-06-001.csv 2026-05-29T02:14:26Z user=svc-health ip=198.51.100.23 file=/invoices/2026-03-11-002.csv
you should see Staff download a handful of files each. svc-health downloaded 41 in a burst from 198.51.100.23 in the early hours.
Why so much was there to take
The shop's policy keeps transfer files for 90 days. Count what is older than 2026-07-16, 90 days before the advisory review.
awk -F, 'NR>1' cases/transfer/files.csv | wc -l 60 awk -F, 'NR>1 && $2 < "2026-07-16"' cases/transfer/files.csv | wc -l 50
you should see 50 of 60 files should already have been deleted. Retention is a security control: data that does not exist cannot be stolen.
FileDrop before and after the review
internet: open on 443 auth: password only version: 4.2.1 retention: none, files since 2024
One flaw reached everything ever stored.
internet: behind the VPN auth: SSO with MFA version: 4.2.3, patched day one retention: 90 days, enforced daily
Smaller target, less to lose.
What a defender takes away
- 1Know what the internet can reach before an advisory forces you to find out.
- 2Exploited in the wild means block access first, then patch.
- 3New web pages and new admins are the signs to hunt for after a web app compromise.
- 4Retention limits decide how bad a breach can be.
Questions
0 of 4 solved
Answer each one from what you find on your lab machine.