Rewterz Threat Alert – Attack Campaign Using Drupalgeddon2

Severity

Medium

Analysis Summary

An attack campaign using the Drupalgeddon2 unauthenticated remote code execution vulnerability to execute malicious code and deface websites. In the case analyzed for their blog, Akamai researchers identified a compromised bodysurfing website logging website requests containing code execution attempts. After cleaning up old infections and reducing a web server’s security posture, the code is used to download two files, a GIF image and a TXT file. The GIF image has the appropriate GIF header but is actually used to execute embedded PHP code. The PHP code first performs website defacement and displays a notification of the infection to visitors to the site. Hidden behind this defacement page are functions that allow the attacker to execute various commands via GET or POST requests, such as scanning for local credentials, getting system configurations, and opening a web shell. The TXT file downloaded in the initial infection contains a malicious Perl script. It provides the attacker with denial of service (DoS) and RAT capabilities. For command and control, it leverages an IRC server that has since been taken down. The researchers note that the attack seems to be more opportunistic than targeted.

Impact

• Denial of service
• Credential theft
• Exposure of sensitive information

Indicator of Compromise

IP

91[.]121[.]160[.]194

SH256

e18bf4ddee0b0db77541f3a3ea52d3bbe8fa943dd0ca3f573572fea22533afbe

SHA1

0ef7f63d746c34819d21057bd58b02781777bb29

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.