This article is contributed. See the original author and article here.

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:CLEAR–Disclosure is not limited. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

CISA received 3 Java Server Pages (JSP) webshells for analysis from an organization where cyber actors exploited vulnerabilities against Zimbra Collaboration Suite (ZCS). Four CVEs are currently being leveraged against ZCS: CVE-2022-24682, CVE-2022-27924, CVE-2022-27925 chained with CVE-2022-37042, and CVE-2022-30333. The files are server side code that allow clients to remotely send commands to be executed on the victim web server.

For more information on cyber actors exploiting vulnerabilities in ZCS, see joint CSA: Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite.

Download the PDF version of this report: MAR-10410305.r1.v1.CLEAR, 537 KB

Submitted Files (3)

14bf0cbee88507fb016d01e3ced053858410c389be022d2aa4d075287c781c4a (hiall.jsp)

814a169ba97b168f95af3340b60a6fec1f29c87be89226b1966d9b0abfb19a15 (aes.jsp)

bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6 (cmd.jsp)

Findings

bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6

Tags

backdoortrojanwebshell

Details
Name cmd.jsp
Size 976 bytes
Type HTML document, ASCII text, with very long lines, with no line terminators
MD5 91de296c801db00a24a2832b5e12d345
SHA1 010aee65009b9faeb3a4e24ca777d3aaa51b0bd3
SHA256 bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6
SHA512 673a100072df4be4bb73828dde5b04d68b3aa59a78f1af42594e5771620ad4205389ff4d83456faa5262cd780e69deef7f34fe03757531cabb7faac093ad2546
ssdeep 24:gzYIRLk+nn9IH/v+xVnVjQ4vajJHG3c3FvcVsUveakUSg:gh9cgVGo3c9cuakvg
Entropy 5.251748
Antivirus
ESET Java/JSP.AC trojan
Trend Micro Backdoo.E99CED14
Trend Micro HouseCall Backdoo.E99CED14
YARA Rules
  • rule CISA_10400779_07 : webshell    
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10400779”
           Date = “2022-08-29”
           Last_Modified = “20220908_1400”
           Actor = “n/a”
           Category = “Webshell”
           Family = “n/a”
           Description = “Detects JSP Webshell samples”
           MD5 = “6f1c2dd27e28a52eb09cdd2bc828386d”
           SHA256 = “6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea”
       strings:
           $s0 = { 78 3D 55 52 4C 44 65 63 6F 64 65 72 }
           $s1 = { 53 74 72 69 6E 67 20 6F 2C 6C 2C 64 }
           $s2 = { 72 65 71 75 65 73 74 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
           $s3 = { 69 6E 64 65 78 4F 66 28 22 63 3D 22 29 }
           $s4 = { 2E 65 78 65 63 28 67 29 }
           $s5 = { 6F 75 74 2E 70 72 69 6E 74 }
           $s6 = { 70 61 72 73 65 42 61 73 65 36 34 42 69 6E 61 72 79 }
           $s7 = { 46 69 6C 65 2E 73 65 70 61 72 61 74 6F 72 }
           $s8 = { 6F 3D 22 55 70 6C 6F 61 64 65 64 }
           $s9 = { 6F 75 74 2E 70 72 69 6E 74 28 65 29 }
       condition:
           filesize < 10KB and all of them
    }
  • rule CISA_10401765_01 : webshell backdoor
    {
       meta:
           Author = “CISA Code & Media Analysis”
           Incident = “10401765”
           Date = “2022-09-02”
           Last_Modified = “20220916_2100”
           Actor = “n/a”
           Category = “Webshell Backdoor”
           Family = “n/a”
           Description = “Detects JSP webshell samples”
           MD5_1 = “91de296c801db00a24a2832b5e12d345”
           SHA256_1 = “bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6”
       strings:
           $s1 = { 70 61 67 65 20 69 6d 70 6f 72 74 3d 22 6a 61 76 61 2e 69 6f 2e 2a 2c 20 6a 61 76 61 2e 75 74 69 6c 2e 2a 2c 20 6a 61 76 61 78 2e 78 6d 6c 2e 62 69 6e 64 2e 2a 2c 20 6a 61 76 61 2e 6e 65 74 2e 2a }
           $s2 = { 65 76 61 6c 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 65 6d 62 65 64 29 }
           $s3 = { 70 3d 52 75 6e 74 69 6d 65 2e 67 65 74 52 75 6e 74 69 6d 65 28 29 2e 65 78 65 63 28 67 29 }
           $s4 = { 69 3d 6e 65 77 20 44 61 74 61 49 6e 70 75 74 53 74 72 65 61 6d 28 70 2e 67 65 74 49 6e 70 75 74 53 74 72 65 61 6d 28 29 29 }
           $s5 = { 72 3d 6e 65 77 20 44 61 74 61 49 6e 70 75 74 53 74 72 65 61 6d 28 72 65 71 75 65 73 74 2e 67 65 74 49 6e 70 75 74 53 74 72 65 61 6d 28 29 29 }
           $s6 = { 6c 3d 72 2e 72 65 61 64 4c 69 6e 65 28 29 29 21 3d 6e 75 6c 6c 29 }
           $s7 = { 62 3d 64 2e 69 6e 64 65 78 4f 66 28 22 62 3d 22 29 }
           $s8 = { 6e 3d 64 2e 69 6e 64 65 78 4f 66 28 22 6e 3d 22 29 }
           $s9 = { 6d 3d 44 61 74 61 74 79 70 65 43 6f 6e 76 65 72 74 65 72 2e 70 61 72 73 65 42 61 73 65 36 34 42 69 6e 61 72 79 }
           $s10 = { 6f 75 74 2e 70 72 69 6e 74 28 22 3c 70 72 65 3e 22 29 }
           $s11 = { 73 3d 69 2e 72 65 61 64 4c 69 6e 65 28 29 29 21 3d 6e 75 6c 6c 29 }
           $s12 = { 66 3d 76 28 64 2e 73 75 62 73 74 72 69 6e 67 28 32 2c 6e 2d 31 29 29 2b 46 69 6c 65 2e 73 65 70 61 72 61 74 6f 72 2b 76 28 64 2e 73 75 62 73 74 72 69 6e 67 28 6e 2b 32 2c 62 2d 31 29 29 }
           $s13 = { 73 74 72 65 61 6d 3d 6e 65 77 20 46 69 6c 65 4f 75 74 70 75 74 53 74 72 65 61 6d 28 }
           $s14 = { 78 3d 55 52 4c 44 65 63 6f 64 65 72 2e 64 65 63 6f 64 65 28 77 2c 22 55 54 46 2d 38 22 29 }
           $s15 = { 6f 3d 22 55 70 6c 6f 61 64 65 64 3a 20 22 2b 66 }
       condition:
           filesize < 5KB and all of them
    }
ssdeep Matches

No matches found.

Description

This file is a JSP webshell that also allows file upload to the victim web server. If the client request body contains “c=”, the script reads the contents of the body starting from the third character and executes it as a command in a separate process. The output from that command is sent back to the client.

If the client request body does not contain “c=” and is not an empty string, the script will attempt to write a file on the victim web server. The script assumes that the request body is in the following format and parses its contents accordingly: “{file directory} n={filename} b={data encoded in base64}”. The script decodes the base64 encoded data, and writes it to the location specified by the file directory and filename values obtained from the client request body. If the file upload was successful, confirmation is sent back to the client.

Screenshots

Figure 1 - The snippet of code that parses the client request body for the command to execute on the victim web server.

Figure 1 – The snippet of code that parses the client request body for the command to execute on the victim web server.