Table of Contents

1. Challenge

   Getting Started in the Lab Environment

   Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

2. Challenge

   Emulation

   In this challenge, you will be provided with an environment containing a web application vulnerable to CVE-2022-22965. You will walk through the steps required to identify Spring4Shell and build out a proof of concept to exploit the vulnerability in order to create and interface with a web shell.

   The learner will conceptually understand the root cause of Spring4Shell, as well as how to exploit the vulnerability and gain remote code execution on a vulnerable remote system via a web shell.

3. Challenge

   Detection

   In this challenge, you will access and analyze the log files of the reverse proxy web application serving the Tomcat application vulnerable to CVE-2022-22965 Spring4Shell. Due to the (known) exploitation requirements of the vulnerability, Spring4Shell abuse requires the use of specific strings and inputs, which can be used to identify attempted and successful exploitation - and thereafter analyze the activities the attacker performed.

   You will understand how to identify Spring4Shell exploitation in log files, and understand how to analyze the actions the attacker performed via the web server.

4. Challenge

   Protection

   In this challenge, you will examine and implement mechanisms to protect against CVE-2022-22965. The formal and correct solution of upgrading the vulnerable software will be discussed, and an alternative method of using a web application firewall at the ingress edge will be demonstrated (which has defense in depth merits, for example in a large organization where patching is difficult, assets are unknown, 3rd party applications are in use, or an immediate response to a new vulnerability is required).

   You will understand how to implement a web application firewall with a custom ruleset to identify and protect against new, or unknown vulnerabilities (in this specific case, CVE-2022-22965).

5. Challenge

   The Last Challenge

   Welcome to the final challenge! This is your last chance to experiment in the environment. Clicking Finish Lab will end this little world that flittered into existence just for you.