PaloAltoRCE Lab Write-Up | By BnHany

Q5: What was the name of the file one of the threat actors tried to exfiltrate?

The attacker attempted to exfiltrate the running-config.xml file. This file contains critical configuration data for a network device, including network settings, firewall rules, and sensitive credentials.

Q6: What was the full URL the threat actor used to access the exfiltrated content successfully?

Based on the provided information, the attacker copied the running-config.xml file to /var/appweb/sslvpndocs/global-protect/gpvpncfg.css. The full URL would be:

http://<victim_system_ip>/global-protect/gpvpncfg.css

To determine if this was successfully accessed, we can look for HTTP GET requests in the logs from the attacker's IP address (54.162.164.22) to retrieve this file.

Summary

The threat actor attempted to exfiltrate running-config.xml by copying it to a web-accessible location (gpvpncfg.css). The full URL used to access this content would be:

http://<victim_system_ip>/global-protect/gpvpncfg

[Read the full article at InfoSec Write-ups - Medium](https://infosecwriteups.com/paloaltorce-lab-write-up-by-bnhany-03e767059788?source=rss----7b722bfd1b8d---4)

---

**Want to create content about this topic?** [Use Nemati AI tools](https://nemati.ai) to generate articles, social posts, and more.