Huntress Details Two-Day MSSQL Attempt to Deploy a Web Shell
Summary
Huntress reconstructed two days of attempts to use MSSQL access to deploy a PHP reverse shell on a Windows server. Windows Defender detected and quarantined the files, and no functioning shell was observed.
Key points
- The activity targeted a Windows Server 2019 Essentials system and used the MSSQL 'sa' account; Huntress assessed that the actor likely had access to the credentials before the observed attempts.
- The actor enabled MSSQL's xp_cmdshell procedure, then used PowerShell via sqlservr.exe and certutil.exe while attempting to create a web-accessible reverse shell.
- The attempted PHP files, maa.php and fata.php, were repeatedly detected and quarantined by Windows Defender.
- The activity spanned about two and a quarter hours across two days. Huntress observed no successful reverse-shell deployment; a day-one request for maa.php returned 404, and no requests for either file appeared in day-two web logs.
- Huntress could not determine the source of the MSSQL logins because the server recorded failed logins but not successful ones.
- Huntress recommends inventorying externally accessible systems, applications, and services, and removing unneeded services or keeping required ones maintained and patched.
Article Details
- Attack Vectors
- The actor apparently used previously obtained access to an MSSQL instance and attempted to use the 'sa' account.
- The actor enabled the xp_cmdshell stored procedure, then ran PowerShell scripts and commands through sqlservr.exe.
- The actor used certutil.exe to decode files and attempted to place PHP reverse-shell files in an accessible web-server directory.
- The reverse-shell attempts did not succeed; Windows Defender detected and quarantined the files.
- Defensive Notes
- Maintain an inventory of systems, applications, and services accessible from the internet.
- Remove services and applications that are not needed for business operations; otherwise, include them in the inventory and keep them updated and patched.
- Huntress reported process and endpoint detections, and Windows Defender detected and quarantined the attempted reverse-shell files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | 0[.]tcp[.]eu[.]ngrok[.]io | Host used as the reverse-shell connection target in the attempted payloads. |
| IPV4 | 41[.]102[.]167[.]182 | Source IP for a GET request for maa.php associated with the attempted reverse-shell activity. |
| URL | hxxps[:]//github[.]com/hightidAOaa/azdaz/raw/main/fata.php | Specific GitHub-hosted URL used in an attempt to download a PHP file containing reverse-shell code. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/hightidAOaa/azdaz/main/maa.php | Specific GitHub-hosted URL used in an attempt to download a PHP reverse shell. |
MITRE ATT&CK
T1059.001 · PowerShellPowerShell scripts and commands were run through sqlservr.exe during the attempts to deploy and execute reverse-shell code.T1078.001 · Default AccountsThe article maps use of the MSSQL 'sa' account to this technique; the actor apparently had access to the credentials before the observed activity.T1105 · Ingress Tool TransferThe actor attempted to download PHP reverse-shell files from GitHub-hosted URLs to the web server.T1140 · Deobfuscate/Decode Files or InformationThe actor used certutil.exe to decode files on the endpoint.T1505.003 · Web ShellThe actor attempted to place PHP reverse-shell files in an accessible web-server directory.
Vendors
Products
MSSQLIn short, the threat actor was using apparently previously obtained access to an MSSQL instance to attempt to upload a reverse shell that would be accessible via the web server.PowerShellAt one point during the attack, the threat actor shifted tactics from running PowerShell scripts via sqlservr.exe, to running PowerShell commands.Windows DefenderSpecifically, as illustrated in Figure 1, a file on the web server, maa.php, was detected by Windows Defender as “VirTool:PHP/Meterpreter.A!MTB”.Windows Server 2019 EssentialsThe endpoint in question is a Windows Server 2019 Essentials system, which has been monitored by Huntress for over a year.
Tools
certutil.exeIn addition, the use of the native Windows utility, certutil.exe, was detected being used to decode a file on the endpoint.sqlmapthe time period of the attack and beyond, the web server logs illustrated repeated successful queries via sqlmap, a freely available open source penetration testing tool used to look for SQL injection vulnerabilities.