Incident Analysis - Remote Code Execution (RCE)

Date: Sep 19, 2026
Tags: SOC Digital Forensics Endpoint Security Web Application Security Threat Hunting Log Correlation MITRE ATTACK SIEM Wazuh Linux Auditd Apache

Pasted image 20260924224029.png

I. Executive Summary

In previous lab entries, I utilized Wazuh to aggregate network, endpoint, and application telemetry. I tested the Linux detection mechanisms implemented by performing a simulated, multi-stage Remote Code Execution (RCE) incident on a public-facing web server that led to the leakage of sensitive company data.

I correlated the events in Wazuh to track the adversary's post-exploitation activities. The alerts guided me in identifying the pattern and nature of the attack, while alert filtering allowed me to investigate more closely and map the full attack chain. Starting from a single crafted HTTP POST request to the deletion of the entire database.

Pasted image 20260924223845.png

II Attack Chain Overview (MITRE ATT&CK)
Tactics Technique Implementation Summary
Initial Access Exploit Public-Facing Application (T1190) Exploited a web application bug to gain access to the web server.
Stealth File Deletion (T1070.004) Removed the database dump, enumeration script, and its result.
Persistence Web Shell (T1505.003) Attacker did not remove the p0wny.php during artifact cleanup, keeping it available for later access.
Credential Access Credentials In Files (T1552.001) Accessed the contents of an .env file stored in /var/www/html/.
Discovery File and Directory Discovery(T1083) Scanned for credentials, configs, and other sensitive files across the system using find.
Collection Automated Collection (T1119) Automated collection of sensitive informations was performed by running linpeas.sh script.
Command and Control Web Protocols (T1071.001) Interacted with the uploaded .php shell web requests as the command channel.
Exfiltration Exfiltration Over Webhook (T1567.004) Exfiltrated the data using webhook via curl.
Impact Data Destruction (T1485) Deleted the entire database using DROP DATABASE.
External Defacement (T1491.002) Modified index.php to redirect web browsers to an extortion web page.
III. Incident Analysis and Alert Correlation
3.1 Triage

The SIEM generated over 10,000 alerts from the lab-lin-ubuntu_s1 within few minutes. After analyzing the fields, I noticed the alerts pointed to the web server user (uid: 33) and the last was execve syscall: 59 more importantly, it used the exe:/usr/bin/dash which indicates there is an ongoing remote code execution. After filtering the commands, I found out that the threat actor used find, grep, ls, gawk, cut, along with other commands used for scanning system files. The observed RCE activity would warrant host isolation and escalation for deeper investigation.

3.2 Attack Timeline

  1. Phase 1 - Web Server Initial Access

    • Exploited the vulnerability on a publicly visible IT Requisition form of the organization.
    • Uploaded a web shell p0wny.php via a crafted HTTP POST request.

  2. Phase 2 - Enumeration and Report Exfiltration

    • Performed automated credential enumeration using linpeas.sh and stored the results on a txt file.
    • Exfiltrated the results to analyze collected credentials

  3. Phase 3 - Database Access and Exfiltration

    • Used the credentials collected by linpeas.sh to access and create a data dump of CorpNet's corp_vault MySQL database.
    • Exfiltrated the data dump via HTTP POST to the threat actor's webhook.

  4. Phase 4 - Impact

    • Deleted CorpNet's database and the data dump with DROP DATABASE and rm.
    • Wrote an extortion page note.html demanding payment from CorpNet.
IV. Findings
  • The adversary uploaded a malicious .php shell file through an unvalidated upload form which enabled remote command execution as server's www-data user.
  • Attacker performed an enumeration scan on the web server using linpeas to look for misconfigurations, credentials, and other sensitive files including the .env file containing database credentials.
  • Exfiltrated the linpeas.sh scan result recon_report.txt the created database dump corp_vault_dump.sql to the attacker via webhook.
  • Database corp_vault and attack artifacts were deleted, compromising the confidentiality and availability of the data. Then created a database dump using mysqldump.
  • Defaced the homepage by redirecting it to a page note.html that demands payment for the data.

V. Lessons Learned

  • Commands that use redirection such as > to control output were not captured by auditd decoders which made it harder to query for them. Still, the entire command is available on the full_log's proctitle but is encoded in hexadecimal.
  • Auditd convert unsafe strings (with space, quotation marks, and other special characters/bytes) into hexadecimal to prevent log injection attacks toward log parsers. This breaks the decoders that expects key="Value" but not key=HEX.
  • Because this web shell use /bin/bash -c $cmd to execute commands on the server, a new bash process is created for every command. As a result, relying on PPID/PID correlations is impractical.
  • Apache access logs provided useful metadata about the requests, but the configured logging did not capture the HTTP request body. As a result, commands supplied through POST parameters were not directly visible in the access logs.
  • Passwords and other sensitive information should not be passed as command line arguments. These information are included on process telemetry and auditd logs and will pose a threat to the confidentiality of the data.
  • This reinforced the the importance of separating web-facing services from sensitive data and internal networks. (While lab uses a flat network due to hardware limitations).
References