Phase 11 — Reverse Engineering and Vulnerability Discovery

Operation Cedar Lattice | Phase 11

Narrative

Cedar Lattice Phase 11. The engagement against Meridian Freight International has progressed past initial access. The threat actor FIN-LATTICE is known to use custom-packed loaders and to embed vulnerabilities in logistics management software. Phase 11 trains you to triage captured binaries, identify packing, score vulnerabilities with CVSS, and scan source code for common weakness patterns — all skills necessary to understand what the adversary built and what Meridian's own software exposes.

Safety Statement: This phase teaches detection and analysis. Every offensive concept ends in its detection method. Labs analyze synthetic metadata only. No working exploits, shellcode, or weaponized payloads are produced or required.

Why Reverse Engineering is a Red Team Skill

Red teamers encounter reverse engineering at multiple points in an engagement:

1. Triage found tooling — You captured a binary on the target. Is it packed? What does it import? What strings does it contain? This tells you what the adversary left behind.
2. Analyze target software — Meridian's logistics app may contain exploitable vulnerabilities. Source code review and binary analysis surface these before or after decompilation.
3. Understand evasion — FIN-LATTICE uses packers (UPX, Themida) to hide code from AV. Understanding entropy and packing helps you recognize and classify the technique.
4. Build PoC to prove impact — A finding without a PoC is a recommendation, not a proof. RE informs PoC construction by revealing what the code actually does.

Learning Objectives

1. Compute Shannon entropy on binary section data and interpret values as packing signals.
2. Identify common packer signatures (UPX, Themida, VMProtect) from import tables and section names.
3. Apply the x86-64 System V AMD64 ABI calling convention to function analysis.
4. Map vulnerability classes (CWE-78, CWE-89, CWE-22, CWE-120, CWE-502) to code patterns.
5. Score a vulnerability using CVSS v3.1 base metrics.
6. Perform static source code review using pattern matching methodology.
7. Apply responsible disclosure principles to findings documentation.

Cedar Lattice Artifact

TLP:WHITE — Sanitized for Training

Artifact: mfi_updater_v3.exe — Captured from Meridian Freight International update server. Initial triage: PE32+ binary, sections .text (entropy 7.9), .rsrc (entropy 5.1). Import table: LoadLibraryA, GetProcAddress only. Strings: http://198.51.100.45/update, cmd.exe /c whoami. Assessment: UPX-packed loader. C2 channel present. Recon string present. This artifact drives the scenarios in Phase 11 labs.

Labs

How to Run

# Lab 01 — run stubs (expect NotImplementedError)
cd lab-01-binary-triage-engine
pytest -q

# Lab 01 — run solution
LAB_MODULE=solution pytest -q

# Lab 02 — run stubs
cd ../lab-02-source-vuln-scanner
pytest -q

# Lab 02 — run solution
LAB_MODULE=solution pytest -q

Navigation

• Previous: Phase 10
• Next: Phase 12