Ghost in the shell: Investigating web shell attacks
microsoft.com · 4 Feb 2020 · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2019-0604Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports99.9%Top 0.03%88.8priority
- CVE-2019-16759vBulletin PHP Module Remote Code Execution VulnerabilityvBulletin · vBulletinKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.7%Top 0.05%73.7priority
Where it names them
CVE-2019-0604 Original (opens in a new tab) ↗
To implant web shells, adversaries take advantage of security gaps in internet-facing web servers, typically vulnerabilities in web applications, for example CVE-2019-0604 or CVE-2019-16759.
CVE-2019-16759 Original (opens in a new tab) ↗
To implant web shells, adversaries take advantage of security gaps in internet-facing web servers, typically vulnerabilities in web applications, for example CVE-2019-0604 or CVE-2019-16759.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.