Attacker Used Recreation Platform File Uploads to Deploy Webshells and Steal Payment Data
Summary
Huntress traced compromises of three recreation-platform servers to abuse of a member-file upload function. The attacker deployed webshells, targeted payment data, evaded detection, and later injected a credential-stealing browser trojan.
Key points
- The attacker registered platform accounts and exploited the member-file upload function to deploy ASPX webshells on three servers.
- Webshells enabled host and IIS reconnaissance, credential and configuration searches, and attempts to locate payment-card data in Fortis webhook logs.
- On a later server, the attacker copied and disguised webshells and altered file timestamps to hinder detection and forensic analysis.
- After a server returned to production, the attacker injected a payload into a jQuery file loaded by the authentication page.
- The browser payload used attacker-controlled WebRTC and WebSocket infrastructure to harvest credentials in real time.
- Huntress reported that it removed the attacker from the first two servers; the third server was returned to production before being fully secured, enabling a return.
Article Details
- Attack Vectors
- Created platform member accounts and exploited the file-upload function to upload and execute ASPX webshells.
- Used webshells to enumerate server and IIS configuration, search for credentials and payment-card data, and access payment webhook logs.
- Copied and renamed webshells across web directories, then manipulated file timestamps to hinder detection and forensic analysis.
- Uploaded PowerShell and JavaScript files, then modified a legitimate jQuery asset loaded by the authentication page to inject a browser agent that harvested credentials.
- Used WebRTC and WebSocket channels to communicate with attacker-controlled infrastructure.
- Defensive Notes
- Huntress removed the attacker from the first two servers and locked them down.
- The attacker returned after the third server was put back into production prematurely; ensure compromised servers are fully secured before restoring production access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0d8f7bf30aa1ac95d59fed24c433dd2b3d57767f38c088721699c841c6e861d3 | Hash of the attacker-associated Plant_ccrtc_mousewheel.ps1 PowerShell script. |
| SHA256 | 0d93c3a8ded46887f79ac4ca7f238c458de2231243176f6c05062e34f238d19a | Hash of the attacker-associated Plant_ccrtc_fast.ps1.b64 encoded PowerShell script. |
| SHA256 | 5f69ff7a2e024f94cc5f816fa16c90054b09d9ac430b1f8b0631dfdd4472905e | Hash of the attacker-associated Plant_ccrtc_mousewheel.ps1.b64 encoded PowerShell script. |
| SHA256 | 7bb594a77f726bf21a49f717024f2915f82f47eb623d2ad305259301de1f1ab4 | Hash of the attacker-associated Ccrtc_sdk_init.js.b64 encoded JavaScript file. |
| SHA256 | b06b581d91f4108900d188c3ee1af18502a8cb65d4e101663b791bd670867485 | Hash of the attacker-associated Ccrtc_sdk_init.js JavaScript file. |
| SHA256 | e9dee286069afb6b411febb96b91a963cd16baffbf8b6aa951e0ef1a7e0e3879 | Hash of the attacker-associated Plant_ccrtc_fast.ps1 PowerShell script. |
| URL | hxxps[:]//chat[.]ririmochii[.]workers[.]dev/core[.]js | Attacker-controlled URL serving the injected browser agent. |
| URL | hxxps[:]//fk[.]bubuneeko[.]workers[.]dev/_cf/ice | Attacker-controlled URL used to fetch ICE/TURN credentials. |
| URL | hxxps[:]//fk[.]bubuneeko[.]workers[.]dev/_cf/rel | Attacker-controlled WebRTC signaling/relay URL. |
MITRE ATT&CK
T1005 · Data from Local SystemSearched for and read payment webhook logs to obtain cardholder data.T1016 · System Network Configuration DiscoveryUsed ipconfig and examined the hosts file and network connections during host and network reconnaissance.T1059.001 · PowerShellExecuted PowerShell scripts to search web roots and modify a jQuery asset.T1059.007 · JavaScriptInjected JavaScript into a jQuery asset to load a browser agent that harvested credentials.T1070.006 · TimestompChanged webshell and target-file timestamps to match legitimate website components and hinder forensic analysis.T1078 · Valid AccountsRegistered and reused platform accounts to access the upload functionality and return to the compromised server.T1082 · System Information DiscoveryRan commands including systeminfo and hostname to gather host information.T1083 · File and Directory DiscoveryEnumerated directories and searched filesystem drives and web roots for files, configuration, and payment-related paths.T1505.003 · Web ShellUploaded ASPX webshells to the platform and copied them into web directories to execute commands.T1552.001 · Credentials In FilesSearched web.config files and application source for passwords, connection strings, and other credentials.
People
Products
Fortiscmd.exe /c findstr /s /i /m "AuthorizeNet Fortis CardConnect BluePay PayPal Braintree Stripe" E:\Content\info\*.*With their eye on payment transaction logs generated by a Fortis webhook integration, the attackerIISIIS 8.3 tilde enumerationjQueryE:\Content\info\master\jquery.validate.min.aspxMicrosoft Windowscmd.exe /c type C:\Windows\System32\drivers\etc\hosts
Tools
appcmd.exe/fi "imagename eq w3wp.exe"The attacker then used standard IIS and Windows administration tools appcmd.exe and powershell.exe to enumerate IIS sites and map configurations for all hosted sites, virtualPowerShellthroughout the kill chain, from the large number of failed initial access probes to the final upload of PowerShell scripts with extensive comments in the provided instructions.sqlcmdFigure 1: Sqlcmd is used to connect to the database with the obtained SQL credentials and search cardholder data.