{"id":1769,"date":"2025-02-05T10:03:36","date_gmt":"2025-02-05T10:03:36","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/05\/hackers-exploiting-a-six-year-old-iis-vulnerability-to-gain-remote-access\/"},"modified":"2025-02-05T10:03:36","modified_gmt":"2025-02-05T10:03:36","slug":"hackers-exploiting-a-six-year-old-iis-vulnerability-to-gain-remote-access","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/05\/hackers-exploiting-a-six-year-old-iis-vulnerability-to-gain-remote-access\/","title":{"rendered":"Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access"},"content":{"rendered":"

Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The eSentire Threat Response Unit (TRU) revealed that threat actors are actively exploiting a six-year-old IIS vulnerability in Progress Telerik UI for ASP.NET AJAX to gain remote access to systems.<\/p>\n

This vulnerability, identified as CVE-2019-18935, allows attackers to execute arbitrary code on vulnerable servers, posing a significant risk to organizations that have not updated their systems.<\/p>\n

While this security flaw enables threat actors to gain remote access<\/a> to systems running vulnerable versions of the software.<\/p>\n

TRU observed the threat actors using w3wp.exe (IIS worker process) to load a reverse shell and run subsequent commands for reconnaissance via cmd.exe.<\/p>\n

Cybersecurity analysts at TRU noted<\/a> that the reverse shells were dropped in the C:WindowsTemp directory.<\/p>\n

Exploitation Process<\/strong><\/h2>\n

The exploitation process begins when threat actors send a specific request to the IIS server to determine if the file upload handler is available.<\/p>\n

Once confirmed, they use a customized proof-of-concept (PoC) to upload and execute a remote shell.<\/p>\n

The reverse shell is a mixed-mode .NET assembly that connects to a command and control (C2) server at 213.136.75.130<\/code> via Windows Sockets.<\/p>\n

\n
\"\"
Decompiled Reverse Shell (Source \u2013 eSentire)<\/figcaption><\/figure>\n<\/div>\n

After establishing a reverse shell, attackers execute commands to gather system information, including user enumeration using net.exe<\/code> and net1.exe<\/code>.<\/p>\n

TRU also observed the deployment of the open-source privilege escalation<\/a> tool<\/a> JuicyPotatoNG on the host, along with several batch files whose purpose is currently unknown.<\/p>\n

\n
\"\"
Remote Shell Loaded by w3wp.exe IIS Worker Process Leading to Recon Commands (Source \u2013 eSentire)<\/figcaption><\/figure>\n<\/div>\n

To detect such reverse shells, a Yara rule can be used:-<\/p>\n

rule TCP_Reverse_Shell_Windows_x64 { \n    meta: \n        description = \"Detects Windows based 64-bit TCP reverse shell\"\n        author = \"YungBinary\"\n        hash = \"b971bf43886e3ab1d823477826383dfaee1e2935788226a285c7aebeabee7348\"\n    strings: \n        $winsock_2_0 = { 66 B? 02 00 FF 15 } \n        $winsock_2_1 = { 66 B? 02 01 FF 15 } \n        $winsock_2_2 = { 66 B? 02 02 FF 15 }\n        $winsock_1_0 = { 66 B? 01 00 FF 15 } \n        $winsock_1_1 = { 66 B? 01 01 FF 15 } \n        $socket_params = { 41 B8 06 00 00 00 BA 01 00 00 00 B9 02 00 00 00 } \n        $cmd = { 48 C7 44 24 ?? 00 00 00 00 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? (01 | 00) 00 00 00 45 33 C9 45 33 C0 48 8D 15 ?? ?? ?? ?? 33 C9 FF 15 } \n        $wait = { BA FF FF FF FF 48 8B 4C ?? ?? FF 15 } \n    condition: \n        uint16(0) == 0x5a4d and \n        ((1 of ($winsock*)) and $socket_params and $cmd and $wait) \n}<\/code><\/pre>\n
\n
\"\"
Vulnerable version decision tree (Source \u2013 eSentire)<\/figcaption><\/figure>\n<\/div>\n
To mitigate these threats, organizations should implement robust patch management and vulnerability management<\/a> services.<\/p>\n
Additionally, deploying Endpoint Detection and Response (EDR<\/a>) solutions across all systems can help detect and respond to such attacks.<\/p>\n
Investigate Real-World Malicious Links & Phishing Attacks With\u00a0Threat Intelligence Lookup<\/strong>\u00a0-\u00a0Try for Free<\/a><\/code><\/strong><\/p>\n
The post Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access The eSentire Threat Response Unit (TRU) revealed that threat actors are actively exploiting a six-year-old IIS vulnerability in Progress Telerik UI for ASP.NET AJAX to gain remote access to systems. This vulnerability, identified as CVE-2019-18935, allows attackers to execute arbitrary code on vulnerable servers, posing […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,131],"tags":[130],"class_list":["post-1769","post","type-post","status-publish","format-standard","hentry","category-cyber-security-news","category-vulnerability","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1769"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=1769"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/1769\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=1769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=1769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=1769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}