Many of those information accompany deployed purposes and comprise delicate info akin to credentials or entry tokens however shouldn’t be readable by exterior customers. Sadly, such misconfigurations are widespread. For instance, security researchers lately reported that attackers collected .env information from round 110,000 domains, resulting in the publicity of greater than 90,000 distinctive setting variables with 7,000 akin to cloud providers.
Multi-stage malware deployment
After they achieve entry to a system, attackers will try and execute a shell script referred to as rconf to carry out a number of checks, set setting variables, and obtain the principle payload. For instance, it checks whether or not the /tmp listing exists, is writable, and has execution permissions. If it doesn’t it makes an attempt to mount it. It additionally checks whether or not the system’s structure is x86_64, because it is not going to run on ARM or different kinds of CPUs.
The script then downloads a file referred to as avatar.php, saves it to the /tmp listing with the title httpd — a reputation usually utilized by the Apache internet server course of — after which executes it. Apparently, the request to obtain avatar.php from the attackers’ servers must have a particular Consumer-Agent to obtain the malicious payload. In any other case, the server will present a benign php file.
