🛡️ qub-network-security-cve-2023-20198

Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE
📘 Queen’s University Belfast – CSC3064 Network Security Assessment

---

📋 Assessment Overview

This project involves analyzing PCAP files provided by Fox-IT to:

• Identify Indicators of Compromise (IOCs)
• Demonstrate exploitation using custom-crafted packets
• Apply Snort IDS/IPS and iptables-based network security countermeasures

---

📁 Repository Structure

• Slides/ – Presentation slides used in the video submission
• IOC Summary/ – Detailed breakdown of all network-level Indicators of Compromise
• Snort Rules/ – Alert and drop rules implemented in Snort, with visual proof
• Assessment PDF/ – Official CSC3064 assessment instructions from QUB
• Video/ – Demo presentation video (uploaded separately and linked below)

---

Final IOC Summary

---

🔐 Snort Rules Used

📄 See Snort_Rules.txt for all implemented rules.

Rules cover:

• Detection and prevention of execCLI, backdoor account creation, admin login attempts, and privilege escalation.

🖼️ Screenshot:

---

Demonstration Highlights

• Simulated attack traffic with hping3
• Applied Snort IDS rules (alert-only) and IPS rules (packet blocking)
• Configured iptables to allow safe traffic and drop malicious packets
• Validated effectiveness using Wireshark on VM environment (via UTM on macOS)

---

🎥 Video Presentation

📺 Watch the full demo on YouTube
(Unlisted – accessible only via this link)

---

👤 Author

Dominicus Adjie Wicaksono
Student ID: 40352799
📧 [email protected]
🔗 LinkedIn