Exploit / PoCmedium
Are Your Nagios XI Servers Turning Into Cryptocurrency Miners for Attackers?
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-25296 | Authenticated OS Command Injection in Nagios XI 5.7.5 Windows WMI Wizard | 8.8 | 72% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 118.107.43.174 | e a malicious bash script fetched from the malicious server 118[.]107[.]43[.]174 . One of the observed payloads is shown in Figure 1. |
| sha256 | 2c923d8b553bde8ce3167fe83f35a40a712e2bed2b76ebaf5e3e63642d551389 | g.json http://118[.]107[.]43[.]174/upload/files/config.json 2c923d8b553bde8ce3167fe83f35a40a712e2bed2b76ebaf5e3e63642d551389 run.sh http://118[.]107[.]43[.]174/upload/files/run.sh c711 |
| sha256 | 4079b3b34caa86dce0edc923a3292f5814dd555f28e8e6ec4c879a2c50a80787 | ar.gz http://118[.]107[.]43[.]174/upload/files/xmrig.tar.gz 4079b3b34caa86dce0edc923a3292f5814dd555f28e8e6ec4c879a2c50a80787 |
| sha256 | 54b45e93cee8f08a97b86afa78a78bc070b6167dcc6cdc735bd167af076cb5b3 | SHA256 xmrig http://118[.]107[.]43[.]174/upload/files/xmrig 54b45e93cee8f08a97b86afa78a78bc070b6167dcc6cdc735bd167af076cb5b3 config.json http://118[.]107[.]43[.]174/upload/files/config |
| sha256 | c711bb6cf918b1f140f4162daab37844656eba2e16c25c429606e4c69c990f99 | 1389 run.sh http://118[.]107[.]43[.]174/upload/files/run.sh c711bb6cf918b1f140f4162daab37844656eba2e16c25c429606e4c69c990f99 xmrig.tar.gz http://118[.]107[.]43[.]174/upload/files/xmrig |
From the original article
5 min read at unit42.paloaltonetworks.com
On March 16, 2021, Unit 42 researchers observed an attacker targeting Nagios XI software to exploit the vulnerability CVE-2021-25296 , a remote command injection vulnerability impacting Nagios XI version 5. 7. 5, to conduct a cryptojacking attack and deploy the XMRig coinminer on victims’ devices.
By Haozhe Zhang, Vaibhav Singhal, Zhibin Zhang, Qi Deng · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.