Huntress Details Webshell Attack That Disabled Defenses and Dumped Credentials
Summary
Huntress details a webshell intrusion in which an attacker disabled logging and security tools, weakened WDigest protection, and dumped credentials. A server was re-compromised after being restored before remediation was complete.
Key points
- The attacker used steganography to conceal ASPX webshells on a compromised IIS server; Huntress could not determine the exact initial access method.
- The attacker returned after the server was restored before remediation was complete, using timestomping and enumeration to conceal activity.
- A batch script disabled IIS logging and Microsoft Defender protections, stopped security and logging tools, and removed the ModSecurity web application firewall.
- The attacker enabled plaintext WDigest credential storage and used Mimikatz-related tooling to dump credentials; the article reports no sensitive data exfiltration or encryption.
- Huntress recommends complete, verified remediation before restoring servers, along with current patches, adequate logging, and restricting unnecessary internet access.
Article Details
- Attack Vectors
- A webshell was uploaded to a vulnerable server; Huntress could not determine the exact initial access mechanism. Historical logs showed possible exploitation attempts targeting Adobe ColdFusion vulnerabilities CVE-2023-26360, CVE-2023-29298, and CVE-2023-29300.
- The actor used steganography to conceal webshells within images, then ran enumeration commands through the webshell.
- The actor weakened defenses by disabling logging and security monitoring, modifying Microsoft Defender settings, stopping security and logging processes, and removing the ModSecurity IIS module.
- The actor altered timestamps, enumerated accounts and registry contents, extracted credentials stored in the registry, weakened WDigest credential protection, and used Mimikatz-related tooling to dump credentials from memory.
- After remediation, the server was returned online before remediation was complete, allowing the actor to return and continue the attack.
- Defensive Notes
- Keep software fully patched and up to date.
- Ensure web servers and endpoints have sufficient, correctly configured logging.
- Place servers behind a firewall or VPN when they do not require internet access.
- Complete and verify remediation before returning affected systems to service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 40859ede262098086962ab00c89f02452aa9941c88c7f4ac002db166179980c6 | SHA-256 hash of the 03Fl3i.aspx webshell artifact listed in the incident indicators. |
| SHA256 | 793768ce4fadab044c7502ea5ec4d8e1569283f289dfd73419e119f32d56d0f3 | SHA-256 hash of the jT1Ds.php PHP webshell. |
| SHA256 | 94cd18f3f030fcc9b259dc410b17ea72a1f9800ee654f8e0f07a87bb9443b593 | SHA-256 hash of C:\ProgramData\x\i.bat, the defense-impairment and enumeration batch file found on the endpoint. |
| SHA256 | bd74a00f4d2ec3bf50d13ddf324bb368b2464d547abd0c572ef5e2f77943a920 | SHA-256 hash of the UA4fp7R.aspx steganographic webshell. |
| SHA256 | f0ff36ecdc843351913dbfbd9122b62563894936ff64215a7a2f89181ebdb57f | SHA-256 hash of the RG0eQV6.php webshell. |
| SHA256 | f63d293e117cae1d0a6c24359fc1361a9dc48178049cc6491051b09268c8c39c | SHA-256 hash of the WRBYTR5750images.aspx webshell. |
MITRE ATT&CK
T1003 · OS Credential DumpingThe actor used Mimikatz-related tooling and a kernel driver to dump credentials from memory.T1012 · Query RegistryThe actor queried Windows Registry keys to enumerate installed software and extract ODBC credentials.T1027.003 · SteganographyThe actor concealed a webshell in an image using steganography.T1059.001 · PowerShellThe batch script invoked PowerShell commands to alter Microsoft Defender settings and run DisableDefender.ps1.T1059.003 · Windows Command ShellThe actor used Windows command-shell and batch commands to enumerate the host, impair defenses, and clean up artifacts.T1069.001 · Local GroupsThe actor used net1 commands to enumerate local administrator groups in multiple languages.T1070.001 · Clear Windows Event LogsThe actor cleared Windows Security, System, Application, and Setup event logs.T1070.004 · File DeletionThe actor deleted generated files and tools during cleanup to reduce file-based indicators.T1070.006 · TimestompThe actor falsified MAC timestamps on a reuploaded webshell to hinder forensic timeline reconstruction.T1112 · Modify RegistryThe actor changed registry settings to weaken WDigest credential protection, disable Defender monitoring, and configure IFEO debuggers.T1505.003 · Web ShellThe actor uploaded and used ASPX and PHP webshells to execute commands on the compromised server.T1546.012 · Image File Execution Options InjectionThe actor configured Image File Execution Options debugger values for Sysmon, Filebeat, and SetACL.exe to freeze or neutralize those processes.T1552.002 · Credentials in RegistryThe actor exported ODBC credentials stored in plaintext in the Windows Registry.T1562.001 · Disable or Modify ToolsThe actor disabled or impaired Microsoft Defender and stopped or neutralized security and logging tools, including Sysmon and Filebeat.
CVE
CVE-2023-26360possible exploitation of ColdFusion bugs, including a critical remote code execution vulnerability (CVE-2023-26360), improper access control bug (CVE-2023-29298), and deserialization flaw (CVE-2023-29300).CVE-2023-29298a critical remote code execution vulnerability (CVE-2023-26360), improper access control bug (CVE-2023-29298), and deserialization flaw (CVE-2023-29300).CVE-2023-29300(CVE-2023-26360), improper access control bug (CVE-2023-29298), and deserialization flaw (CVE-2023-29300).
People
Adrian GarciaAcknowledged for contributions to the investigation and write-up.Amelia CasleyAcknowledged for contributions to the investigation and write-up.Anton OvrutskyAcknowledged for contributions to the investigation and write-up.Lindsey O'Donnell-WelchNamed with the report's authors.Mark O'HalloranNamed as an author of the Huntress incident report.Olly MaxwellAcknowledged for contributions to the investigation and write-up.
Vendors
AdobeThere was, however, some evidence that the particular server had potentially suffered an Adobe ColdFusion exploitation attempt.ElasticThese included Sysmon, Elastic's filebeat log analysis tool and security software such as Cortex's cyserver.exe, DrWebCom, ImmunetProtect, and Sentinel.Microsoftdozen different types of defence impairment commands, including disabling the IIS logs, tampering with Microsoft Defender, using WMI Event Consumer to clear the Windows Event Logs, using timestomping, and more.
Products
Adobe ColdFusionThere was, however, some evidence that the particular server had potentially suffered an Adobe ColdFusion exploitation attempt.Filebeatbatch script called i.bat - that showed the threat actor attempting to disable Defender, kill Sysmon and Filebeat, uninstall the ModSecurity WAF, downgrade WDigest credential protection— all before Mimikatz wasIISlater carrying out almost a dozen different types of defence impairment commands, including disabling the IIS logs, tampering with Microsoft Defender, using WMI Event Consumer to clear the Windows Event Logs, usingMicrosoft Defender Antimalware Platformdifferent types of defence impairment commands, including disabling the IIS logs, tampering with Microsoft Defender, using WMI Event Consumer to clear the Windows Event Logs, using timestomping, and more.ModSecurity IISThe threat actor then used appcmd.exe to enumerate the sites hosted on the IIS server and then deleted the ModSecurity IIS module.Sysmon- and batch script called i.bat - that showed the threat actor attempting to disable Defender, kill Sysmon and Filebeat, uninstall the ModSecurity WAF, downgrade WDigest credential protection— all before Mimikatz