Ivanti CSA Exploit Chain: Auth Bypass + SQLi/Command Injection to Webshell
A suspected nation-state operator chained four Ivanti Cloud Services Appliance zero-days against an internet-facing appliance: an unauthenticated path-traversal auth bypass, command injection in the date/time and reporting handlers for root-level execution, PHP webshells for persistence, theft of the appliance administrator password and root SSH key, and a SQL-injection pivot to a backend SQL Server via xp_cmdshell. Reconstruct the full chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the unauthenticated entry point
35The whole intrusion hinges on one flaw that let an outsider reach pages they should never have reached. Identify how the operator first bypassed authentication on the appliance.
Recover the planted webshell
35Once the operator had code execution they left a way back in that does not depend on the original bugs. Identify the webshell written into the appliance webroot.
Classify how the attacker code first ran
30The webshell and the credential theft both came from one execution primitive on the appliance. Classify the technique the operator used to run commands.
Recover the compromised appliance credential
35The operator read secrets straight off the appliance. Identify the appliance administrator account whose password they harvested.
Isolate the command-and-control egress
35The alert that surfaced this incident was one outbound connection. Identify the external host the appliance beaconed to.
Trace the pivot to the database host
35From the appliance the operator reached deeper into the network. Identify the CVE that gave them code execution on the backend SQL Server.
Recover the rootkit indicator
30The operator hid their tooling at the kernel level. Provide the SHA-256 of the rootkit module loaded on the appliance.
8 tasks · 235 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allFortiJump: FortiManager Zero-Day Config Heist
A FortiManager appliance is breached through an FGFM authentication bypass (the FortiJump zero-day): an attacker-controlled FortiManager registers itself as a trusted device, stages every managed FortiGate's configuration into a single hidden archive on the appliance, and exfiltrates it over HTTPS, stealing the fleet inventory and FortiOS256-hashed administrator passwords. Weeks later the operator re-registers and exfiltrates again to fresh infrastructure. With no malware on any firewall and no endpoint to inspect, reconstruct the entire heist from the appliance event log and perimeter firewall alone.
Shai-Hulud: Self-Replicating npm Post-Install Worm Harvesting CI/CD Secrets
A routine dependency bump on a shared Linux CI runner pulls a trojanized npm package whose postinstall hook runs a bundled worm. The worm harvests GitHub, npm, and cloud credentials from the filesystem and the Instance Metadata Service, verifies them with TruffleHog, exfiltrates the loot to a free webhook dropbox, then reuses the stolen tokens to flip private repositories public as '-migration' clones, create a public Shai-Hulud loot repository, and republish itself into the organization's own packages. Reconstruct the self-replicating supply chain compromise from endpoint XDR and egress firewall telemetry, and classify the key ATT&CK techniques.
Akira Ransomware: Full Kill Chain IR
The intrusion began with a search engine advertisement and ended with the deployment of Akira ransomware. This scenario covers the full 2025 threat landscape, emphasizing identity-based compromise, MFA bypass via AiTM kits, and rapid lateral movement toward Active Directory. Analysts must navigate a complex environment of Windows workstations, Domain Controllers, and Cisco VPN infrastructure to reconstruct the timeline from initial access to data exfiltration and final encryption.