Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Microsoft Releases Exchange Emergency Patch to Fix Actively Exploited Vulnerability

Published: 2021-03-03
Last Updated: 2021-03-05 12:29:30 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)

Microsoft today released an emergency patch for Microsoft Exchange Server. The patch fixes seven different vulnerabilities. Four of these vulnerabilities are currently being used in targeted attacks.

Quick Summary / What you need to do:

  1. Verify that you are not already compromised. Microsoft has some indicators here.
  2. Patch. But currently, the patch is only available if you applied recent updates. So you may have to apply them first if you are behind. See the first table below for details.
  3. Review your Exchange Server configuration. Microsoft has tips here.

The attacks gain access via a Server Side Request Forgery (SSRF) vulnerability. Exploiting this vulnerability requires access to port 443. This vulnerability can be used to trick the Exchange server to send requests essentially to itself, bypassing authentication. This will give access to an insecure deserialization vulnerability that can be leveraged to execute arbitrary code as SYSTEM. Finally, two file upload vulnerabilities are used to upload files to the system.

Microsoft observed the attackers uploading web shells for persistent access and exfiltrating credentials and email from affected servers.

Microsoft currently only makes patches available for the exact versions listed below in the "Patch Available For" column. You will first need to apply the respective RU/CU before applying today's patch.

Version Vulnerable Patch Available For
Exchange Server 2010 no 2010 RU 31 for SP 3 (defense-in-depth update)
KB5000978
Exchange Server 2013 yes 2013 CU 23 (KB5000871)
Exchange Server 2016 yes 2016 CU 19 CU 18 (KB5000871)
Exchange Server 2019 yes CU 8 CU 7 (KB5000871)

 

March 2, 2021 Exchange Emergency Patch Summary.

Description
CVE Disclosed Exploited Exploitability (old versions) current version Severity CVSS Base (AVG) CVSS Temporal (AVG)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26412 No No Less Likely Less Likely Critical 9.1 8.2
CVE-2021-26854 No No Less Likely Less Likely Important 6.6 5.8
CVE-2021-26855 No Yes Detected Detected Critical 9.1 8.4
CVE-2021-26857 No Yes More Likely Detected Critical 7.8 7.2
CVE-2021-26858 No Yes Detected Detected Important 7.8 7.2
CVE-2021-27065 No Yes Detected Detected Critical 7.8 7.2
CVE-2021-27078 No No Less Likely Less Likely Important 9.1 8.2

Related Microsoft Posts:

HAFNIUM targeting Exchange Servers with 0-day exploits
Multiple Security Updates Released for Exchange Server
Released: March 2021 Exchange Server Security Updates
Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: March 2, 2021 (KB5000871)
Description of the security update for Microsoft Exchange Server 2010 Service Pack 3: March 2, 2021 (KB5000978)

 

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

0 comment(s)

Qakbot infection with Cobalt Strike

Published: 2021-03-03
Last Updated: 2021-03-03 00:01:13 UTC
by Brad Duncan (Version: 1)
0 comment(s)

Introduction

On Tuesday 2021-03-02, I generated a Qakbot (Qbot) infection on a Windows host in one of my Active Directory (AD) test environments, where I saw Cobalt Strike as follow-up activity.  I've seen Cobalt Strike from Qakbot infections before.  Below are two that I documented in December 2020.

I haven't documented one for the ISC yet, so today's diary reviews my Qakbot infection with Cobalt Strike seen on Tuesday 2021-03-02.


Shown above:  Flow chart for the Qakbot infection with Cobalt Strike from Tuesday 2021-03-02.

Images


Shown above:  Spreadsheet extracted from a zip archive attached to malspam pushing Qakbot.


Shown above:  Traffic from the infection filtered in Wireshark (image 1 of 3).


Shown above:  Traffic from the infection filtered in Wireshark (image 2 of 3).


Shown above:  Traffic from the infection filtered in Wireshark (image 3 of 3).


Shown above:  Initial DLL saved a the victim's Windows host.


Shown above:  Artifact saved to disk during the Qakbot infection.


Shown above:  Registry updates caused by Qakbot.

Indicators of Compromise (IOCs)

Malware from the infected Windows host:

SHA256 hash: 16a0c2f741a14c423b7abe293e26f711fdb984fc52064982d874bf310c520b12

SHA256 hash: 24753d9f0d691b6d582da3e301b98f75abbdb5382bb871ee00713c5029c56d44

Traffic to retrieve the initial Qakbot DLL:

  • 8.209.64[.]96 port 80 - kfzhm28pwzrlk02bmjy[.]com - GET /mrch.gif

Qakbot C2 traffic:

  • 207.246.77[.]75 port 995 - HTTPS traffic

Cobalt Strike traffic:

  • 45.144.29[.]185 port 443 - HTTPS traffic
  • 45.144.29[.]185 port 443 - logon.securewindows[.]xyz - HTTPS traffic
  • 45.144.29[.]185 port 8080 - 45.144.29[.]185:8080 - GET /WjSH
  • 45.144.29[.]185 port 8080 - logon.securewindows[.]xyz:8080 - GET /cx
  • 45.144.29[.]185 port 8080 - 45.144.29[.]185:8080 - GET /en_US/all.js
  • 45.144.29[.]185 port 8080 - 45.144.29[.]185:8080 - POST /submit.php?id=248927919

Final words

A pcap of the infection traffic and the associated malware can be found here.

---

Brad Duncan
brad [at] malware-traffic-analysis.net

0 comment(s)
Diary Archives