Correct the description of VIEWSTATE in ToolShell flow

Author: mehaase

corpus/ToolShell Vulnerability in Sharepoint.afb

@@ -124,7 +124,6 @@
                 "6fcf3b73-782f-45fd-ba41-926da5a9a302",
                 "128eb846-60c7-475f-bae9-a7a063b7467b",
                 "931413ef-c0e4-4438-af57-d96ab837044c",
-                "f2186090-5635-4dbd-b93d-39f5c8ad2931",
                 "1fe28db9-9a63-4020-82b4-352de6285ef4",
                 "424d5ce0-c529-42b7-9d66-5da730b538c6",
                 "9b753680-802f-4ca5-b4d2-557a3354a21c",
@@ -158,7 +157,6 @@
                 "0b2518af-d570-43f3-b1c6-90988a96ace8",
                 "9f90fa81-aa0e-4caa-b754-e33d491b56c1",
                 "3e5ecd65-6165-4dfb-9642-2b49ce2e80a1",
-                "0c78df89-9fce-49e8-8379-bfc923a2dece",
                 "5ecca340-5fd5-45f9-acb5-136cbe15dac8",
                 "d1ac682d-4af2-4f22-9816-35516654dccb",
                 "88ec52f4-e6a8-4566-a5ea-2148e438e4cf",
@@ -671,27 +669,6 @@
             "id": "generic_handle",
             "instance": "2b7f0b7d-f5a0-42bd-8530-4938f3d4ca73"
         },
-        {
-            "id": "dynamic_line",
-            "instance": "f2186090-5635-4dbd-b93d-39f5c8ad2931",
-            "source": "f7ceda2c-49ea-471e-9295-58d1d6988cb1",
-            "target": "1b66c66d-2431-4907-bbc1-83e75dc0d48d",
-            "handles": [
-                "4f7c9e52-e720-45af-ba04-fb691d322806"
-            ]
-        },
-        {
-            "id": "generic_latch",
-            "instance": "f7ceda2c-49ea-471e-9295-58d1d6988cb1"
-        },
-        {
-            "id": "generic_latch",
-            "instance": "1b66c66d-2431-4907-bbc1-83e75dc0d48d"
-        },
-        {
-            "id": "generic_handle",
-            "instance": "4f7c9e52-e720-45af-ba04-fb691d322806"
-        },
         {
             "id": "dynamic_line",
             "instance": "1fe28db9-9a63-4020-82b4-352de6285ef4",
@@ -3400,24 +3377,24 @@
             "properties": [
                 [
                     "name",
-                    "Web Cookies"
+                    null
                 ],
                 [
                     "ttp",
                     [
                         [
                             "tactic",
-                            "TA0006"
+                            "TA0003"
                         ],
                         [
                             "technique",
-                            "T1606.001"
+                            null
                         ]
                     ]
                 ],
                 [
                     "description",
-                    "The attacker uses the stolen MachineKey to forge a ViewState cookie."
+                    "The attacker uses the stolen MachineKey to forge the ASP.NET VIEWSTATE, which allows code execution even after the CVEs are patched and the web shells are removed."
                 ],
                 [
                     "confidence",
@@ -3503,9 +3480,7 @@
         {
             "id": "vertical_anchor",
             "instance": "f56b0a65-ed25-495e-a558-3361139be04b",
-            "latches": [
-                "f7ceda2c-49ea-471e-9295-58d1d6988cb1"
-            ]
+            "latches": []
         },
         {
             "id": "vertical_anchor",
@@ -3517,121 +3492,6 @@
             "instance": "0e9e0a50-4def-4b85-a856-d691d88698f2",
             "latches": []
         },
-        {
-            "id": "action",
-            "instance": "0c78df89-9fce-49e8-8379-bfc923a2dece",
-            "properties": [
-                [
-                    "name",
-                    "Forged ViewState Cookie"
-                ],
-                [
-                    "ttp",
-                    [
-                        [
-                            "tactic",
-                            "TA0003"
-                        ],
-                        [
-                            "technique",
-                            null
-                        ]
-                    ]
-                ],
-                [
-                    "description",
-                    "The attacker uses the forged cookie for persistence even after the CVEs are patched and the web shells are removed."
-                ],
-                [
-                    "confidence",
-                    null
-                ],
-                [
-                    "execution_start",
-                    null
-                ],
-                [
-                    "execution_end",
-                    null
-                ]
-            ],
-            "anchors": {
-                "0": "8178746e-fdfe-4683-9c30-b416800352e9",
-                "30": "b0d23cfa-72f7-4d6a-b606-255d515513ca",
-                "60": "83eb6272-9729-4946-a05f-bf442dc793f4",
-                "90": "104e3744-9b51-45a8-8a1f-8d1df308938b",
-                "120": "33554de9-9a83-43c8-adb3-bbf9749dafe9",
-                "150": "15bbbb02-884c-4554-939c-3a40b0d387be",
-                "180": "c16c7dec-9f45-4244-a15c-9dbd9f0d5a1b",
-                "210": "d1d3b457-6ac2-42e6-a933-484dfddaf178",
-                "240": "7072ea79-41c5-4d45-8c2b-88bd41f18dd9",
-                "270": "22817cb4-8329-4db5-b9da-090b17ce0b0c",
-                "300": "11e89f38-8f9a-48d2-b837-6300384c2b84",
-                "330": "bc061c27-8081-4b14-b160-7099fc6c3de2"
-            }
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "8178746e-fdfe-4683-9c30-b416800352e9",
-            "latches": []
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "b0d23cfa-72f7-4d6a-b606-255d515513ca",
-            "latches": []
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "83eb6272-9729-4946-a05f-bf442dc793f4",
-            "latches": []
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "104e3744-9b51-45a8-8a1f-8d1df308938b",
-            "latches": [
-                "1b66c66d-2431-4907-bbc1-83e75dc0d48d"
-            ]
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "33554de9-9a83-43c8-adb3-bbf9749dafe9",
-            "latches": []
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "15bbbb02-884c-4554-939c-3a40b0d387be",
-            "latches": []
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "c16c7dec-9f45-4244-a15c-9dbd9f0d5a1b",
-            "latches": []
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "d1d3b457-6ac2-42e6-a933-484dfddaf178",
-            "latches": []
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "7072ea79-41c5-4d45-8c2b-88bd41f18dd9",
-            "latches": []
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "22817cb4-8329-4db5-b9da-090b17ce0b0c",
-            "latches": []
-        },
-        {
-            "id": "vertical_anchor",
-            "instance": "11e89f38-8f9a-48d2-b837-6300384c2b84",
-            "latches": []
-        },
-        {
-            "id": "horizontal_anchor",
-            "instance": "bc061c27-8081-4b14-b160-7099fc6c3de2",
-            "latches": []
-        },
         {
             "id": "file",
             "instance": "5ecca340-5fd5-45f9-acb5-136cbe15dac8",
@@ -4416,13 +4276,9 @@
             1145
         ],
         "3e5ecd65-6165-4dfb-9642-2b49ce2e80a1": [
-            80,
+            85,
             2600
         ],
-        "0c78df89-9fce-49e8-8379-bfc923a2dece": [
-            80,
-            2940
-        ],
         "5ecca340-5fd5-45f9-acb5-136cbe15dac8": [
             1465,
             1610
@@ -4465,8 +4321,8 @@
         ]
     },
     "camera": {
-        "x": 70,
-        "y": 1271,
-        "k": 0.6350589842718954
+        "x": 169,
+        "y": 2847,
+        "k": 0.9220791504409355
     }
 }