Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: More on ColdFusion hacks - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
More on ColdFusion hacks

Thanks to our readers Adam and Oobi we received some additional information regarding recent ColdFusion hacks.
As I wrote in the previous diary (http://isc.sans.org/diary.html?storyid=6715), the attackers are exploiting vulnerable FCKEditor installations, which come enabled by default with ColdFusion 8.0.1 as well as some other ColdFusion packages.

The first thing the attackers do is uploading a ColdFusion web shell – a script very similar to ASP.NET or PHP web shells we've been writing so much about. The web shell I analyzed is very powerful and seems to be recent – according to the date in the script it was released on the 23rd of June by a Chinese hacker "Seraph".

The script has a simple authentication mechanism – it verifies what the URL parameter "action" is set to, as can be seen in the screenshot below:

seraph action variable test

If the parameter "action" is set to "seraph", the user can access the web site, otherwise the script just prints back "seraph". In other words, the URL the attacker accesses after uploading the script will look something like this: http://www.hacked.site/uploaded_file.cfm?action=seraph

A nice thing (for us doing forensics, at least) is that you can now grep through your logs for "action=seraph" to see if you have been hacked with the same script. Keep in mind that this is not a definite test, of course, since the action variable's name can be easily modified.

--
Bojan

I will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Munich July 2019

Bojan

379 Posts
ISC Handler
It would seem that the hacker could leave his footprints easily. I'll have to do more studies for my own site.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!