10410305-1.v1 JSP Webshell

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR–Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Description

CISA received 3 Java Server Pages (JSP) webshells for analysis from an organization where cyber actors exploited vulnerabilities against Zimbra Collaboration Suite (ZCS). Four CVEs are currently being leveraged against ZCS: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333. The files are server side code that allow clients to remotely send commands to be executed on the victim web server.

For more information on cyber actors exploiting vulnerabilities in ZCS, see joint CSA: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite.

Download the PDF version of this report: MAR-10410305.r1.v1.CLEAR, 537 KB

Submitted Files (3)

14bf0cbee88507fb016d01e3ced053858410c389be022d2aa4d075287c781c4a (hiall.jsp)

814a169ba97b168f95af3340b60a6fec1f29c87be89226b1966d9b0abfb19a15 (aes.jsp)

bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6 (cmd.jsp)

bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6

Tags

backdoortrojanwebshell

Details

Antivirus

YARA Rules

• rule CISA_10400779_07 : webshell    
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10400779”
         Date = “2022-08-29”
         Last_Modified = “20220908_1400”
         Actor = “n/a”
         Category = “Webshell”
         Family = “n/a”
         Description = “Detects JSP Webshell samples”
         MD5 = “6f1c2dd27e28a52eb09cdd2bc828386d”
         SHA256 = “6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea”
     strings:
         $s0 = { 78 3D 55 52 4C 44 65 63 6F 64 65 72 }
         $s1 = { 53 74 72 69 6E 67 20 6F 2C 6C 2C 64 }
         $s2 = { 72 65 71 75 65 73 74 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
         $s3 = { 69 6E 64 65 78 4F 66 28 22 63 3D 22 29 }
         $s4 = { 2E 65 78 65 63 28 67 29 }
         $s5 = { 6F 75 74 2E 70 72 69 6E 74 }
         $s6 = { 70 61 72 73 65 42 61 73 65 36 34 42 69 6E 61 72 79 }
         $s7 = { 46 69 6C 65 2E 73 65 70 61 72 61 74 6F 72 }
         $s8 = { 6F 3D 22 55 70 6C 6F 61 64 65 64 }
         $s9 = { 6F 75 74 2E 70 72 69 6E 74 28 65 29 }
     condition:
         filesize < 10KB and all of them
  }
• rule CISA_10401765_01 : webshell backdoor
  {
     meta:
         Author = “CISA Code & Media Analysis”
         Incident = “10401765”
         Date = “2022-09-02”
         Last_Modified = “20220916_2100”
         Actor = “n/a”
         Category = “Webshell Backdoor”
         Family = “n/a”
         Description = “Detects JSP webshell samples”
         MD5_1 = “91de296c801db00a24a2832b5e12d345”
         SHA256_1 = “bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6”
     strings:
         $s1 = { 70 61 67 65 20 69 6d 70 6f 72 74 3d 22 6a 61 76 61 2e 69 6f 2e 2a 2c 20 6a 61 76 61 2e 75 74 69 6c 2e 2a 2c 20 6a 61 76 61 78 2e 78 6d 6c 2e 62 69 6e 64 2e 2a 2c 20 6a 61 76 61 2e 6e 65 74 2e 2a }
         $s2 = { 65 76 61 6c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 65 6d 62 65 64 29 }
         $s3 = { 70 3d 52 75 6e 74 69 6d 65 2e 67 65 74 52 75 6e 74 69 6d 65 28 29 2e 65 78 65 63 28 67 29 }
         $s4 = { 69 3d 6e 65 77 20 44 61 74 61 49 6e 70 75 74 53 74 72 65 61 6d 28 70 2e 67 65 74 49 6e 70 75 74 53 74 72 65 61 6d 28 29 29 }
         $s5 = { 72 3d 6e 65 77 20 44 61 74 61 49 6e 70 75 74 53 74 72 65 61 6d 28 72 65 71 75 65 73 74 2e 67 65 74 49 6e 70 75 74 53 74 72 65 61 6d 28 29 29 }
         $s6 = { 6c 3d 72 2e 72 65 61 64 4c 69 6e 65 28 29 29 21 3d 6e 75 6c 6c 29 }
         $s7 = { 62 3d 64 2e 69 6e 64 65 78 4f 66 28 22 62 3d 22 29 }
         $s8 = { 6e 3d 64 2e 69 6e 64 65 78 4f 66 28 22 6e 3d 22 29 }
         $s9 = { 6d 3d 44 61 74 61 74 79 70 65 43 6f 6e 76 65 72 74 65 72 2e 70 61 72 73 65 42 61 73 65 36 34 42 69 6e 61 72 79 }
         $s10 = { 6f 75 74 2e 70 72 69 6e 74 28 22 3c 70 72 65 3e 22 29 }
         $s11 = { 73 3d 69 2e 72 65 61 64 4c 69 6e 65 28 29 29 21 3d 6e 75 6c 6c 29 }
         $s12 = { 66 3d 76 28 64 2e 73 75 62 73 74 72 69 6e 67 28 32 2c 6e 2d 31 29 29 2b 46 69 6c 65 2e 73 65 70 61 72 61 74 6f 72 2b 76 28 64 2e 73 75 62 73 74 72 69 6e 67 28 6e 2b 32 2c 62 2d 31 29 29 }
         $s13 = { 73 74 72 65 61 6d 3d 6e 65 77 20 46 69 6c 65 4f 75 74 70 75 74 53 74 72 65 61 6d 28 }
         $s14 = { 78 3d 55 52 4c 44 65 63 6f 64 65 72 2e 64 65 63 6f 64 65 28 77 2c 22 55 54 46 2d 38 22 29 }
         $s15 = { 6f 3d 22 55 70 6c 6f 61 64 65 64 3a 20 22 2b 66 }
     condition:
         filesize < 5KB and all of them
  }

ssdeep Matches

No matches found.

Description

This file is a JSP webshell that also allows file upload to the victim web server. If the client request body contains “c=”, the script reads the contents of the body starting from the third character and executes it as a command in a separate process. The output from that command is sent back to the client.

If the client request body does not contain “c=” and is not an empty string, the script will attempt to write a file on the victim web server. The script assumes that the request body is in the following format and parses its contents accordingly: “{file directory} n={filename} b={data encoded in base64}”. The script decodes the base64 encoded data, and writes it to the location specified by the file directory and filename values obtained from the client request body. If the file upload was successful, confirmation is sent back to the client.

Screenshots