SpeakUp: A New Undetected Backdoor Linux Trojan
research.checkpoint.com · 4 Feb 2019 · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
6 CVEs- CVE-2016-3088Apache ActiveMQ Improper Input Validation VulnerabilityApache · ActiveMQKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports98.5%Top 0.08%86.0priority
- CVE-2017-10271Oracle Corporation WebLogic Server Remote Code Execution VulnerabilityOracle · WebLogic ServerKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1499.004Application or System Exploitation2 reports>99.9%Top 0.01%84.4priority
- CVE-2018-2894Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)Oracle Corporation · WebLogic ServerPublic exploit1 report50.2%Top 1.1%76.3priority
- CVE-2012-0874The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform…Public exploit1 report15.6%Top 3.2%73.9priority
- CVE-2018-20062ThinkPHP "noneCms" Remote Code Execution VulnerabilityThinkPHP · noneCmsKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.5%Top 0.05%73.7priority
- CVE-2010-1871Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability83.4%Top 0.32%73.0priority
Where it names them
CVE-2016-3088 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability.
Code Execution (CVE-2018-20062) Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271) Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088)
CVE-2017-10271 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
in the targeted servers: a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization
Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271)
CVE-2018-2894 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion
Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894)
CVE-2012-0874 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities
File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088) JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871) JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874)
CVE-2018-20062 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Exploiting CVE-2018-20062 for uploading a PHP shell
Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below:
NoneCMS ThinkPHP Remote Code Execution (CVE-2018-20062)
CVE-2010-1871 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
b) CVE-2010-1871: JBoss Seam Framework remote code execution
Component Remote Code Execution (CVE-2017-10271) Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088) JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.