JetBrains

Introduction

The JetBrains lab presents a compelling scenario that simulates a real-world network breach, where an attacker exploits a vulnerability in a JetBrains TeamCity web server. By successfully uploading a malicious webshell, the attacker gains unauthorized control of the server, utilizing it as a platform for launching further malicious activities, including credential tampering and container-escape attempts. This hands-on investigation challenges participants to analyze the provided network capture (PCAP) to unravel the attack timeline, identify the initial entry point, understand the tools and techniques used, and assess the scope of the compromise. Using tools like Wireshark, NetworkMiner, and Brim, participants explore tactics including initial access, command and control, and execution while honing their skills in network forensics and incident response.

Q1 Identifying the attacker's IP address helps trace the source and stop further attacks. What is the attacker's IP address?

To identify the attacker's IP address, examine the HTTP traffic in the PCAP. Web-server vulnerabilities are the typical initial access vector in this scenario, so the first suspicious behavior we expect to see is an unauthenticated POST that carries a payload.

Approach A — hunt for suspicious POSTs (recommended). Apply the filter http.request.method == POST in Wireshark and scroll the request URIs. A POST to /hax.jsp/app/rest/plugins.jsp (a plugin-upload endpoint on the TeamCity server) is the anomalous request — plugin uploads should never come from an untrusted external IP. The source IP of that POST is the attacker.

Approach B — endpoints view. Apply the http display filter, then Statistics → Endpoints → IPv4 and sort by packets. The external IP with the largest HTTP footprint is the same attacker IP.

Both approaches converge on the same source IP: 23.158.56.196.

Following the HTTP conversation from this IP confirms it interacts with t…