kirkdjohnson/wiresharkDownloaded a packet capture (.pcapng) file from malware-traffic-analysis.net which was an example of an attempted attack against a webserver using the Log4J vulnerability (CVE-2021-44228). I examined teh amount of endpoints communicating with the server and knowing jnidi as a common in the vulnerbilty found it in clear text
Opening up the PCAP, the first thing I like to do is see how many devices are present/communicating (Statistics -> Endpoints)
After noticing an unusual amount of traffic and different IPv4 conversations orginating from different countries I exported endpoints to be shown on a global map using Max Mind's GEOIP database.(Endpoints -> Map -> Open in Browser)
Knowing that I dealing with a Log4J exploit PCAP, the exploit leverages the Java Naming and Directory Interface (jndi) vulnerability, so I thought that would be a good filter to start with (ip contains "jndi")
The filter for "jndi" work well, and I expanded the first packet which was a an HTTP POST request and examined the User-Agent field which showed an ldap request with an IP followed by base-64 encoded text.
Decoding the the end of the intial post request in the attack, shows a wget which a web request to an IP to download lh[.]sh a shell script and the command chmod which changes privileges to add x which is execute privliegs. Lastly, it would start the shell script
I then determined if the host server at 198.71.247.91 made any connections to outside server, specically to the wget IP address in decoded string. I filtered for SYN packets which establish a TCP connection and found the server to have not connected with outside addresses likely meaning that the server was patched and therefore the expliot failed.
With the decoded script I further investigated it using VirusTotal to learn more about the IP the script was calling and found it to be malicious
In the Community section of VirusTotal, there was further evidence that it was a Log4J attack as that IP was known to attempt the exploit in the past.
