---
description: Network Forensics Lab
---

# OpenWire Blue Team Lab

## 1-To Identify the IP i usually used Statistics tab in wire shark and here we go&#x20;



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FuIroi7W7omMFfdGjTV3v%2FScreenshot%202024-08-31%20123500.png?alt=media&#x26;token=a18d2d63-030d-4a03-a979-8a35534f07f4" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fnqd93em3EE2VZh2uvh2g%2Fimage.png?alt=media&#x26;token=f1bbaa20-e21b-4818-b8bf-ac697012709b" alt=""><figcaption></figcaption></figure>

\


## 2- To identify The port of the infection i see in the traffic Open-wire from The malicious IP so can easily get it&#x20;



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FwuySG2csTva8sQl5bs8i%2FScreenshot%202024-08-31%20204216.png?alt=media&#x26;token=0d95ddb4-12a9-4593-84ad-23ae28338ca4" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FrlMjkdw2PgTwcSNa584p%2Fimage.png?alt=media&#x26;token=74df59c7-6621-46af-84f4-2206d5c54e60" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9H5KPRBGXVhMX5JgwA7R%2Fimage.png?alt=media&#x26;token=efbf0b1d-03da-4afc-bcfd-1f53396ce331" alt=""><figcaption></figcaption></figure>

## 3- Following the Prevoius question to detect the name of the service i search about the CVE and Here it is the full name&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FeGS7yFsTWCdYFE8NqoPZ%2Fimage.png?alt=media&#x26;token=5e9f3be7-ef33-4706-bc2f-4341f205bcce" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FMXqvzwmrRG9tOmpgwRaT%2Fimage.png?alt=media&#x26;token=5378bc73-4d29-427f-b556-dbc7b8aa368f" alt=""><figcaption></figcaption></figure>



## 4- Returning again to The statistics and here the second C2 server&#x20;

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FqoPGi658jMSyJv43AZnb%2FScreenshot%202024-08-31%20205219.png?alt=media&#x26;token=53e9765b-6f7c-4b2a-99c3-8c5affb91670" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FIRrNFwkrjKN1sWUEi5Uf%2Fimage.png?alt=media&#x26;token=e91109a2-e515-47df-8ec0-1e9e6848e5ad" alt=""><figcaption></figcaption></figure>



## 5- In the Packets i trace the Docker Traffic which on the IP 128.199.52.72 and in the XML script i get it is also docker BTW

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fn4o6paokxrZnGiFACvYA%2FScreenshot%202024-08-31%20205826.png?alt=media&#x26;token=f19d26d5-1dc1-455c-84e3-c159910e809d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F1K3chrr7hwutU2eALZlk%2Fimage.png?alt=media&#x26;token=8982156d-8b9a-4545-8f25-f540cf205a32" alt=""><figcaption></figcaption></figure>



## 6-Here We will Look a little deeper to the script to detect the java class name and It\`s here being Flexible and in concentrated will shortcut a lot of time for you Homie

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F9WFdl2TbU0uETSmL74US%2FScreenshot%202024-08-31%20210303.png?alt=media&#x26;token=4954ae7b-a925-462a-99f6-5556a37d4e2b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FughDp3qygrpPk7A8RA5s%2Fimage.png?alt=media&#x26;token=68539b92-0f8e-49c6-8a77-0689c65ac67e" alt=""><figcaption></figcaption></figure>

## 7- When I Find The CVE in the prevision question it Help us Now in this question (:

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FChyWEIvlsUejZrqm9NIT%2Fimage.png?alt=media&#x26;token=9a419662-9de3-476f-9076-7b16eb1c2e86" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2FKEs2niYgegGVZZXpRghU%2Fimage.png?alt=media&#x26;token=7cb8dfc8-255d-4cd8-8eea-78a8b7f6f41b" alt=""><figcaption></figcaption></figure>



## 8- To Answer this Question i Read This These  Articles about the CVE and Detect the Valuable Arbitrary code&#x20;

{% embed url="https://activemq.apache.org/news/cve-2023-46604" %}

{% embed url="https://blog.sonicwall.com/en-us/2023/11/apache-activemq-remote-code-execution-cve_2023_46604/" %}

{% embed url="https://www.vicarius.io/vsociety/posts/apache-activemq-rce-cve-2023-46604" %}

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2Fi9tcUsEnDOeOHrBaQjsW%2Fimage.png?alt=media&#x26;token=b7c07531-4461-4089-95ed-dcf4e0c6fa8b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1176031639-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNQ7A82FmDjR05oHeIjks%2Fuploads%2F180b1UsDeJPzVL98h3gn%2Fimage.png?alt=media&#x26;token=27dbcf90-63b2-4c6f-a035-d68b32508779" alt=""><figcaption></figcaption></figure>
