Packet Puzzle

Scenario

This is a Sherlock machine designed for investigation, challenging you to uncover the story behind a cyberattack. Your mission is to analyze the provided PCAP file to identify and interpret suspicious network activity. The attacker leveraged CVE-2024-4577, exploiting known vulnerabilities to gain an initial foothold on the target system, followed by an attempt to perform privilege escalation.

Executive Summary

An attacker on the local network port-scanned a Windows workstation and found a web server running PHP in CGI mode. They exploited a PHP-CGI argument injection with a single crafted POST that turned the request body into PHP code, and used it to launch a PowerShell reverse shell. Through that shell they confirmed the victim account, downloaded a public Potato-family privilege escalation binary and ran it in memory with a command that was meant to call back to the attacker. The exploit failed with a process-creation error, so the attacker never got past the low-privileged user. The whole chain is visible in one packet capture.

Artifacts

• NetworkTraffic.pcap: NetworkTraffic.pcap → tshark or Wireshark. About 108 MB, one attacker host and one victim host dominate the traffic

Timestamp note: The capture records local time at +1100. The timestamp question wants UTC, so subtract eleven hours from what tshark prints by default.

Discovery

Start with the IP conversation table to see who talks to whom. One internal host exchanges a huge number of short flows with a single other host, which is the signature of a scan, and the same host later sends the HTTP exploit requests. The other side of that pair is the victim.

tshark -r NetworkTraffic.pcap -q -z conv,ip

A SYN scan leaves the answer in the replies. An open port answers a SYN with a SYN-ACK, a closed one with a RST. Filter for SYN-ACKs from the victim back to the attacker (tcp.flags.syn==1 && tcp.flags.ack==1) and list the distinct source ports. The set is a typical Windows workstation: SSH, SMB, RDP, RPC, NetBIOS, HTTP, HTTPS and the WSD port.

tshark -r NetworkTraffic.pcap -Y 'ip.src==192.168.170.130 && ip.dst==192.168.170.128 && tcp.flags.syn==1 && tcp.flags.ack==1' -T fields -e tcp.srcport | sort -n | uniq

Same filter as Q2, but keep the frame order instead of deduplicating. The first SYN-ACK in the capture (frame 9045) marks the first open port to answer the scanner. It is not the lowest-numbered port you might expect from a sorted list, so read it from the frame order, not from the sorted set.

tshark -r NetworkTraffic.pcap -Y 'ip.src==192.168.170.130 && tcp.flags.syn==1 && tcp.flags.ack==1' -T fields -e frame.number -e tcp.srcport | head -1

Initial Access

Pull the HTTP requests sent from the attacker. The exploit POSTs use a request URI beginning with /?%ADd+allow_url_include... and set auto_prepend_file=php://input. The %AD is a soft hyphen that Windows best-fit character mapping converts into - when PHP-CGI builds its command line, which smuggles in PHP options. That is the argument injection in PHP-CGI on Windows, and the scenario already names the CVE it belongs to.

tshark -r NetworkTraffic.pcap -Y 'ip.src==192.168.170.128 && http.request' -T fields -e frame.number -e http.request.method -e http.request.uri

The server’s own response headers give the version. Read the Server header on the replies to the exploit requests: Apache with OpenSSL and PHP on a Win64 build. The answer is the PHP component, which is where the vulnerability lives, not Apache.

tshark -r NetworkTraffic.pcap -Y 'http.response' -T fields -e http.server | sort | uniq -c

Tip: The format mask shows a three-letter name and a three-part version, so the product is PHP, not Apache.

Exploiting a flaw in an internet-facing web application to run code is Exploit Public-Facing Application. This is reference knowledge rather than something read from the capture; the evidence for it is the Q4 exploit request.

Execution

From Q4 the exploit body is PHP read from php://input. Dump the POST bodies and find the one whose payload starts a PowerShell reverse shell. That request is frame 12133, and its time is the moment of the foothold. The HTTP bodies are readable because the traffic is plain HTTP.

tshark -r NetworkTraffic.pcap -Y 'http.request.method==POST' -T fields -e frame.number -e frame.time -e frame.time_epoch -e http.file_data

Gotcha: tshark prints the capture’s local time (+1100), and that value is rejected. The accepted answer is the same instant in UTC, eleven hours earlier.

The reverse shell connects back to the attacker on port 4545. Follow that TCP stream and read the first commands the attacker types. The output of whoami prints the machine name and the account the web server runs as, in HOST\user form.

tshark -r NetworkTraffic.pcap -q -z follow,tcp,ascii,0 -Y 'tcp.port==4545'

Privilege Escalation

Later in the same reverse shell stream, the attacker runs iwr (Invoke-WebRequest) against GitHub to fetch a Potato-family exploit. The file name in that URL is the answer. It is a .NET 4 build of GodPotato, which abuses the impersonation privilege that service accounts like a web server’s usually hold.

tshark -r NetworkTraffic.pcap -q -z follow,tcp,ascii,0 -Y 'tcp.port==4545'

Right after the download, the same stream shows the attacker running a renamed copy of the binary with -cmd, so GodPotato would run a second command as SYSTEM. That command is a netcat-style tool, renamed to look like a Windows component, connecting back to the attacker on port 5555 to hand over a SYSTEM shell. Copy the line exactly as typed, including the leading ./.

tshark -r NetworkTraffic.pcap -q -z follow,tcp,ascii,0 -Y 'tcp.port==4545'

The tool’s output follows the command in the same stream. GodPotato reports a failure to create the process, with Win32 error 2 (file not found), and no SYSTEM callback follows. Copy the message exactly, including the Win32Error:2 suffix.

tshark -r NetworkTraffic.pcap -q -z follow,tcp,ascii,0 -Y 'tcp.port==4545'

Attack Summary

Phase	Action
Discovery	SYN scan of the victim from 192.168.170.128; eight open ports found, SSH answers first
Initial Access	CVE-2024-4577 exploit POSTs against PHP 8.1.25 behind Apache on Windows
Execution	PowerShell reverse shell launched from the exploit body, calling back on port 4545
Discovery	whoami confirms the web server runs as cristo
Privilege Escalation	GodPotato-NET4.exe downloaded from GitHub with iwr
Privilege Escalation	Renamed copy run with -cmd to start a SYSTEM reverse shell on port 5555
Privilege Escalation	Exploit fails with Cannot create process Win32Error:2; attacker stays unprivileged

IOCs

Type	Value
IP (attacker)	192.168.170[.]128
IP (victim)	192.168.170[.]130
Port (reverse shell)	4545
Port (intended SYSTEM shell)	5555
File	GodPotato-NET4.exe
File (renamed tooling)	TimeProvider.exe, time.exe
Vulnerability	CVE-2024-4577

MITRE ATT&CK

Technique	ID	Description
Network Service Discovery	T1046	SYN scan of the victim’s TCP ports
Exploit Public-Facing Application	T1190	CVE-2024-4577 request against PHP-CGI
Command and Scripting Interpreter: PowerShell	T1059.001	Reverse shell launched from the exploit body
Ingress Tool Transfer	T1105	GodPotato fetched from GitHub with iwr
Exploitation for Privilege Escalation	T1068	GodPotato attempted to reach SYSTEM; failed

Defender Takeaways

Patch or retire PHP-CGI on Windows. CVE-2024-4577 is fixed in current PHP releases, and the exposed server here ran an affected build behind Apache. Move to PHP-FPM or mod_php where possible, and block requests whose query string carries encoded soft hyphens (%AD) at the WAF.

Plain HTTP made the whole intrusion readable. Exploit bodies, the reverse shell and its output all crossed the wire unencrypted, which is the only reason one capture tells the full story. Network sensors with HTTP body inspection can flag php://input and allow_url_include in a request without any host telemetry.

Alert on a web server process spawning a shell. The exploit makes the PHP or Apache process start PowerShell, then reach out to the attacker on an unusual port. A parent-child rule for web server to powershell.exe, plus egress filtering for ports like 4545 and 5555, would catch the shell and its fallback.

The failed privilege escalation was luck, not control. The service account held the impersonation privilege that Potato exploits need, and the attempt only failed because the chained command could not be found. Run web services under a restricted virtual account, strip SeImpersonatePrivilege where it isn’t needed, and alert on downloads from GitHub raw or release URLs by server processes.

Conclusion

The attacker went from a port scan to a remote shell with one crafted request, then tried a public Potato exploit and was stopped only by a path error in their own command. The detection value was in the web server spawning PowerShell and calling out, not in the exploit itself.