Skip to content
attack.paths
Connexion
← RegistryDossier · 6 steps · 5 edges

Ivanti Pulse Connect Secure → pre-auth RCE → corporate VPN takeover

Two-stage chain (auth bypass + command injection) lands root on the Pulse appliance. Exfil VPN configs, pivot through the tunnel into the corporate network.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses Ivanti Connect Secure unpatched for the 2024 chain (CVE-2023-46805 + CVE-2024-21887). Appliance reachable from internet.

§ Steps

  1. 01
    Identify vulnerable Pulse Connect SecureReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  2. 02
    Pivot through VPN into corporate networkLateral Movement
    N-CHISEL— chisel / ligolo / sshuttle Tunnel
  3. 03
    Command injection → root shellInitial Access
    VPN-IVANTI-PULSE— Ivanti Pulse / Connect Secure RCE
  4. 04
    Auth bypass on /api/v1/...Initial Access
    VPN-IVANTI-PULSE— Ivanti Pulse / Connect Secure RCE
  5. 05
    Plant appliance implant for persistencePersistence
    VPN-APPLIANCE-IMPLANT— VPN Appliance Implant
  6. 06
    Exfil VPN configs (RADIUS, LDAP binds)Collection
    VPN-CONFIG-EXFIL— VPN Configuration Exfil

§ Frequently asked

What is the "Ivanti Pulse Connect Secure → pre-auth RCE → corporate VPN takeover" attack path?
Two-stage chain (auth bypass + command injection) lands root on the Pulse appliance. Exfil VPN configs, pivot through the tunnel into the corporate network. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Identify vulnerable Pulse Connect Secure (W-RECON-FINGERPRINT) — a reconnaissance primitive. Assumed environment: target uses Ivanti Connect Secure unpatched for the 2024 chain (CVE-2023-46805 + CVE-2024-21887).
What is the final impact of this kill-chain?
The final step lands on Exfil VPN configs (RADIUS, LDAP binds) (VPN-CONFIG-EXFIL), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers