Chinese language menace actors are concentrating on ThinkPHP purposes susceptible to CVE-2018-20062 and CVE-2019-9082 to put in a persistent internet shell named Dama.
The online shell allows additional exploitation of the breached endpoints, reminiscent of enlisting them as a part of the attackers’ infrastructure to evade detection in subsequent operations.
The primary indicators of this exercise date again to October 2023, however based on Akamai analysts monitoring it, the malicious exercise has lately expanded and intensified.
Focusing on previous vulnerabilities
ThinkPHP is an open-source internet utility improvement framework that’s notably fashionable in China.
CVE-2018-20062, mounted in December 2018, is a matter found in NoneCMS 1.3, permitting distant attackers to execute arbitrary PHP code through crafted use of the filter parameter.
CVE-2019-9082 impacts ThinkPHP 3.2.4 and older, utilized in Open Supply BMS 1.1.1., is a distant command execution downside addressed in February 2019.
The 2 flaws are leveraged on this marketing campaign to allow the attackers to carry out distant code execution, impacting the underlying content material administration techniques (CMS) on the goal endpoints.
Particularly, the attackers exploit the bugs to obtain a textual content file named “public.txt,” which, in actuality, is the obfuscated Dama internet shell saved as “roeter.php.”
The payload is downloaded from compromised servers positioned in Hong Kong and offers the attackers with distant server management following a easy authentication step utilizing the password “admin.”
Akamai says the servers delivering the payloads are contaminated themselves with the identical internet shell, so it seems that compromised techniques are became nodes within the attacker’s infrastructure.
The Dama internet shell
Dama has superior capabilities enabling the menace actors to navigate the file system on the compromised server, add recordsdata, and collect system information, basically aiding in privilege escalation.
It will possibly additionally carry out community port scanning, entry databases, and bypass disabled PHP capabilities for shell command execution.
Supply: Akamai
A notable omission from Dama’s capabilities is the shortage of a command-line interface, which might permit menace actors a extra hands-on method to executing instructions.
Akamai notes that this lacking performance is notable given Dama’s in any other case intensive performance.
Mitigation
Exploiting 6-year-old flaws serves as one other reminder of the persistent downside of poor vulnerability administration, as attackers, on this case, leverage security vulnerabilities patched a very long time in the past.
The really helpful motion for doubtlessly impacted organizations is to maneuver to the newest ThinkPHP, model 8.0, which is protected towards identified distant code execution bugs.
Akamai additionally notes that the concentrating on scope of this marketing campaign is broad, even impacting techniques not utilizing ThinkPHP, which suggests opportunistic motives.
