Threat Level: green Handler on Duty: Jan Kopriva

SANS ISC: More on ColdFusion hacks SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
More on ColdFusion hacks

Thanks to our readers Adam and Oobi we received some additional information regarding recent ColdFusion hacks.
As I wrote in the previous diary (, the attackers are exploiting vulnerable FCKEditor installations, which come enabled by default with ColdFusion 8.0.1 as well as some other ColdFusion packages.

The first thing the attackers do is uploading a ColdFusion web shell – a script very similar to ASP.NET or PHP web shells we've been writing so much about. The web shell I analyzed is very powerful and seems to be recent – according to the date in the script it was released on the 23rd of June by a Chinese hacker "Seraph".

The script has a simple authentication mechanism – it verifies what the URL parameter "action" is set to, as can be seen in the screenshot below:

seraph action variable test

If the parameter "action" is set to "seraph", the user can access the web site, otherwise the script just prints back "seraph". In other words, the URL the attacker accesses after uploading the script will look something like this:

A nice thing (for us doing forensics, at least) is that you can now grep through your logs for "action=seraph" to see if you have been hacked with the same script. Keep in mind that this is not a definite test, of course, since the action variable's name can be easily modified.


I will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Baltimore Fall: Virtual Edition 2021


400 Posts
ISC Handler
Jul 5th 2009
It would seem that the hacker could leave his footprints easily. I'll have to do more studies for my own site.

Sign Up for Free or Log In to start participating in the conversation!