Exploit Public-Facing Application

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.¹²³⁴⁵ On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.⁶⁷ Depending on the flaw being exploited, this may also involve Exploitation for Stealth or Exploitation for Client Execution. If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the Cloud Instance Metadata API), exploit container host access via Escape to Host, or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.⁸⁹ For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.¹⁰¹¹

1. NVD CVE-2016-6662
2. CIS Multiple SMB Vulnerabilities
3. US-CERT TA18-106A Network Infrastructure Devices 2018
4. Cisco Blog Legacy Device Attacks
5. NVD CVE-2014-7169
6. Recorded Future ESXiArgs Ransomware 2023
7. Ars Technica VMWare Code Execution Vulnerability 2021
8. Mandiant Fortinet Zero Day
9. Wired Russia Cyberwar
10. OWASP Top 10
11. CWE top 25

Groups using this technique

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.