19. HVV / Red-vs-Blue Practical Topics

19.1 HVV Initial Access Methodology

Target Selection Priority: edge devices (VPN/firewall/mail gateway) > OA systems (Weaver/Yonyou/Seeyon) > middleware (WebLogic/Tomcat/Struts2) > CMS systems > edge assets (test sites / abandoned systems)

Fast Breakthrough Chain:

Reconnaissance (subdomains/ports/CMS fingerprinting) → quick CVE verification → weak-password brute force (admin panels/databases/SSH)
→ code audit (source code leaks / backup files) → framework vulnerabilities (Struts2/WebLogic/Spring) → GetShell
→ internal network penetration (domain / non-domain) → persistence → objective achieved

Common HVV Initial Access Entry Points: | Entry | CVE/Technique | |------|---------| | Weaver OA | e-cology RCE / e-mobile OGNL injection | | Yonyou OA | Yonyou NC/GRP / U8Cloud / vulnerability chains | | Seeyon OA | A8/A6 series historical vulnerabilities | | Landray OA | EKP vulnerabilities | | WebLogic | T3/IIOP deserialization / Console RCE | | Confluence | CVE-2023-22527 (template injection) / OGNL injection | | Nacos | Unauthorized access / Derby SQL injection RCE | | Apache Shiro | Deserialization (CBC/GCM) | | Spring | Spring4Shell (CVE-2022-22965) / Spring Cloud Gateway RCE |

19.2 HVV Defender-Side Detection

Traffic Detection: Suricata/Snort rules / full-traffic analysis (PCAP) / JA3/JA3S TLS fingerprinting Endpoint Detection: EDR alert analysis / Sysmon logs / Windows event logs (4624/4688/4672) Behavior Analysis: anomalous logins (time/location/IP) / lateral movement indicators (445/WMI/RPC) / credential usage patterns Honeypot: HFish / honeypot clusters (decoy assets / decoy credentials / decoy files)

---