SharePoint RCE vulnerability allows domain compromise

A sophisticated attack compromised an entire domain, exploiting a critical RCE vulnerability in Microsoft SharePoint.

See also: Yahoo reveals NetIQ iManager flaws that allow RCE

Η επίθεση, η οποία παρέμεινε απαρατήρητη για δύο εβδομάδες, δείχνει τις εξελισσόμενες τακτικές των χάκερ και τη σημασία των ισχυρών μέτρων ασφαλείας.

The attackers gained initial access by exploiting CVE-2024-38094, a remote code execution (RCE) vulnerability in an on-premises SharePoint server. They used a series of GET and POST to deploy a webshell named “ghostfile93.aspx” to the target system.

Rapid7's Resident Response team uncovered the initial breach, which occurred through the exploitation of CVE 2024-38094, a vulnerability in Microsoft SharePoint that allows attackers to execute code remotely.

Once inside the network, the hackers moved laterally, compromising a Microsoft Exchange with domain administrator privileges. They used a variety of tools and techniques to expand their position:

• Impacket: Tried to install and run this collection of Python scripts for network protocol interaction.
• Horoung Antivirus: They installed this Chinese AV software to disable existing security solutions.
• Fast Reverse Proxy (FRP): Used to maintain external access through a firewall.

See also: CISA: Critical Fortinet RCE flaw used in attacks

The intruders demonstrated advanced knowledge of infiltration and network evasion techniques:

• Active Directory Exploitation: Tools such as ADExplorer64.exe, NTDSUtil.exe , and nxc.exe were used to map the AD environment and collect credentials.
• Credential Harvesting: Mimikatz (disguised as 66.exe) was used to extract login information.
• Log Tampering: Used to disable system logging and clear event logs to cover their tracks.
• Persistence: Scheduled tasks were established on the domain controller for the FRP tool.

The attackers remained undetected on the network for two weeks, during which they attempted to compromise third-party backups and used additional tools such as Certify.exe to generate ADFS for increased operations in the Active Directory environment. The hackers also attempted to cover their tracks by compromising system logs and disabling logging mechanisms on the compromised SharePoint server. This action significantly hampered the investigation process.

See also: Linux and UNIX servers exposed to CUPS RCE attacks

An RCE flaw, such as the one in SharePoint, is a significant security vulnerability that allows an attacker to execute arbitrary code on a target system. This type of flaw often arises due to poor input validation, misuse of APIs, or configuration errors that expose systems to unauthorized access. Once exploited, RCE vulnerabilities can be used to install malware, steal data, or propagate further attacks, posing serious risks to both individuals and organizations. Preventing these flaws requires strong security practices, such as regular software updates, code reviews, and implementing strict access controls.

Source: cybersecuritynews