Mirai code re
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE The Realtek SDK, a software development kit embedded in routers, gateways, and similar network equipment sold under many OEM brands, contains an improper input validation flaw (CWE-20) in its miniigd UPnP SOAP service. A remote, unauthenticated attacker can trigger it by sending a crafted NewInternalClient request to the vulnerable SOAP interface, causing execution of malicious code on the device. Successful exploitation gives attackers control of affected devices, which can be used for botnet recruitment, staging further attacks, or ransomware operations. Affected parties are owners of devices built on the Realtek SDK, particularly routers and gateways with the UPnP service exposed to the internet. Exploitation is ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-09-18 and EPSS assigns it a 100% probability of exploitation within 30 days, though ransomware use is not confirmed. Do: Inventory devices that use the Realtek SDK and check whether the miniigd UPnP/SOAP service is reachable from untrusted networks; apply firmware updates from your device vendor as soon as available, or per CISA's required action, disable UPnP or block the service from internet exposure if mitigations are unavailable. No patch level is published in this dataset, so verify fix status against OEM advisories and review device logs for crafted NewInternalClient SOAP requests. | — | 100% | KEV |
| mass≈1,000,000+ devices (hundreds of thousands of internet-exposed hosts observed in public scans; SDK embedded in many OEM routers) | |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability. Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code. NVD description · AI analysis pending | 8.8 | 78% |
| — | ||
| CVE-2018-10561 | Authentication Bypass in Dasan GPON Home Routers (CVE-2018-10561) CVE-2018-10561 is a critical authentication bypass (CWE-287, CVSS 9.8) in Dasan GPON home router firmware: the devices fail to properly enforce login when a specific suffix is added to a URL. An attacker simply appends "?images" to any protected URL — for example /menu.html?images/ or /GponForm/diag_FORM?images/ — and the router treats the request as already authenticated. Once bypassed, the attacker gains full access to the device's management interface, enabling configuration changes, diagnostics, and use of the router as a botnet node or network pivot. All Dasan Gigabit Passive Optical Network (GPON) routers running the affected firmware are exposed, especially units with their web interface reachable from the internet; CISA notes the impacted product is end-of-life. Exploitation is active and widespread: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-31), carries a 92.9% EPSS probability of exploitation within 30 days, and IoT botnets have historically targeted these routers. Do: CISA's required action is to disconnect or replace these routers if still in use, since the product is end-of-life and should not remain deployed. As an interim mitigation, remove the device's web management interface from internet exposure and block or strip requests containing "?images"; verify exposure by loading /menu.html?images/ without logging in — if it returns the management page, the device is vulnerable. A community mitigation tool and unofficial patch have been published by researchers, but replacement remains the recommended fix, and defenders should expect continued botnet scanning of exposed units. | 9.8 | 93% | KEV PoC ×2 |
| massseveral hundred thousand internet-exposed routers (10^5-10^6 range) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha256 | 1b3bb39a3d1eea8923ceb86528c8c38ecf9398da1bdf8b154e6b4d0d8798be49 | c083eb080bf75879c84f8885b11b6d3d67aa35e345ce1a3ee762444 and 1b3bb39a3d1eea8923ceb86528c8c38ecf9398da1bdf8b154e6b4d0d8798be49 ) and the Mirai leaked source code. HTTP flooding module HT |
| sha256 | 25461130a268f3728a0465722135e78fd00369f4bccdede4dd61e0c374d88eb8 | a37466b5c8cd28ae6af2504484e1925187edffbcc63a60d2e4e1bd8 and 25461130a268f3728a0465722135e78fd00369f4bccdede4dd61e0c374d88eb8 ) also contained multiple exploits, like the RCE exploit in |
| sha256 | 7fe8e2efba37466b5c8cd28ae6af2504484e1925187edffbcc63a60d2e4e1bd8 | ted IP addresses. Some of the recent Gafgyt variants (e.g., 7fe8e2efba37466b5c8cd28ae6af2504484e1925187edffbcc63a60d2e4e1bd8 and 25461130a268f3728a0465722135e78fd00369f4bccdede4dd61e0c |
| sha256 | da20bf020c083eb080bf75879c84f8885b11b6d3d67aa35e345ce1a3ee762444 | but for the purpose of this blog we are using the hashes ( da20bf020c083eb080bf75879c84f8885b11b6d3d67aa35e345ce1a3ee762444 and 1b3bb39a3d1eea8923ceb86528c8c38ecf9398da1bdf8b154e6b4d0 |
Full article1,000 words · extracted from securityaffairs.com · click to collapse
Uptycs’ threat research team recently detected several variants of the Linux-based botnet malware family, “Gafgyt,”some of them re-used Mirai code.
Uptycs’ threat research team recently detected several variants of the Linux-based botnet malware family, “Gafgyt”, via threat intelligence systems and our in-house osquery-based sandbox. Upon analysis, we identified several codes, techniques and implementations of Gafgyt, re-used from the infamous Mirai botnet.
In this blog, we’ll take a look at some of the re-used Mirai modules, their functionality, and the Uptycs EDR detection capabilities of Gafgyt.
Gafgyt
Gafgyt (also known as Bashlite) is a prominent malware family for *nix systems, which mainly target vulnerable IoT devices like Huawei routers, Realtek routers and ASUS devices. Gafgyt also uses some of the existing exploits (CVE-2017-17215, CVE-2018-10561) to download the next stage payloads, which we will discuss further on.
Gafgyt malware variants have very similar functionality to Mirai, as a majority of the code was copied.
Technical Analysis: Gafgyt; Re-used Mirai modules
During our analysis of Gafgyt, we identified several recent variants that have re-used some code modules from the Mirai source code. The modules are:
- HTTP flooding
- UDP flooding
- TCP flooding
- STD module
- Telnet Bruteforce
We will provide details of these modules and their functionality, but for the purpose of this blog we are using the hashes (da20bf020c083eb080bf75879c84f8885b11b6d3d67aa35e345ce1a3ee762444 and 1b3bb39a3d1eea8923ceb86528c8c38ecf9398da1bdf8b154e6b4d0d8798be49) and the Mirai leaked source code.
HTTP flooding module
HTTP flooding is a kind of DDoS attack in which the attacker sends a large number of HTTP requests to the targeted server to overwhelm it. The creators of Gafgyt have re-used this code from the leaked Mirai source code.
The below figure (Figure 1) shows the comparison of the Gafgyt and Mirai HTTP flooding module.
Figure 1: HTTP flooder module. (Click to see larger version.)
In the above image, the left is the Gafgyt decompiled code, which matches the Mirai source code on the right.
UDP flood module
UDP flooding is a type of DDoS attack in which an attacker sends several UDP packets to the victim server as a means of exhausting it. Gafgyt contained this same functionality of UDP flooding, copied from the leaked Mirai source code (see Figure 2).
Figure 2: UDP flooder module. (Click to see larger version.)
TCP flood module
Gafgyt performs all types of TCP flood attacks like SYN, PSH, FIN, etc. In this type of attack, the attacker exploits a normal three-way TCP handshake the victim server receives a heavy number of requests, resulting in the server becoming unresponsive.
The below image shows the TCP flooder module of Gafgyt, which contained the similar code from Mirai (see Figure 3).
Figure 3: TCP flooder module. (Click to see larger version.)
STD module
Gafgyt contains an STD module which sends a random string (from a hardcoded array of strings) to a particular IP address. This functionality has also been used by Mirai (see Figure 4).
Figure 4: STD module. (Click to see larger version.)
Brute force module
Not only flooding modules are being used. Recent Gafgyt also contained other modules with little tweaks, like a telnet bruteforce scanner (see Figure 5).
Figure 5: Telnet bruteforce module. (Click to see larger version.)
CVEs used by Gafgyt
Gafgyt uses existing vulnerabilities in IoT devices to turn them into bots and later perform DDoS attacks on specifically targeted IP addresses. Some of the recent Gafgyt variants (e.g., 7fe8e2efba37466b5c8cd28ae6af2504484e1925187edffbcc63a60d2e4e1bd8 and 25461130a268f3728a0465722135e78fd00369f4bccdede4dd61e0c374d88eb8) also contained multiple exploits, like the RCE exploit in Huawei Routers and the authentication bypass exploit in GPON Home Routers (see Figure 6, 7, 8).
Figure 6: Huawei Exploit inside binary (CVE-2017-17215). (Click to see larger version.)
_.png){kind=link}
Figure 7: Realtek Exploit inside binary (CVE-2014-8361). (Click to see larger version.)
_.png){kind=link}
In Figures 6 and 7, you can see the Gafgyt malware binary embeds Remote Code Execution exploits for Huawei and Realtek routers, by which the malware binary:
- using wget command, fetches the payload.
- gives the execution permission to payload using chmod command.
- executes the payload.
Figure 8: GPON Router Exploit inside binary (CVE-2018-10561). (Click to see larger version.)
_.png){kind=link}
In the same way, the Gafgyt malware binary uses CVE-2018-10561 for authentication bypass in vulnerable GPON routers; the malware binary fetches a malicious script using wget command and then executes the script from /tmp location (bins.sh in Figure 8).
Figure 9: Downloaded malicious script. (Click to see larger version.)
The malicious script:
- using wget command, fetches the payload.
- gives the execution permission to payload using chmod command.
- executes the payload.
- removes the payload.
The IP addresses used for fetching the payloads in Figure 9 (above) were generally the open directories where malicious payloads for different architectures were hosted by the attacker (see Figure 10).
Figure 10: Malware programs hosted upon open directory. (Click to see larger version.)
Uptycs EDR detection
Uptycs’ EDR capabilities, armed with YARA process scanning, detected both Gafgyt variants with a threat score of 10/10 (see Figure 11, 12).
Figure 11: Uptycs detection for Gafgyt I. (Click to see larger version.)
Figure 12: Uptycs detection for Gafgyt II. (Click to see larger version.)
Malware authors may not always innovate, and researchers often discover that malware authors copy and re-use leaked malware source code. In order to identify and protect against these kinds of malware attacks, we recommend the following measures:
- Regularly monitor the suspicious processes, events, and network traffic spawned on the execution of any untrusted binary.
- Keep systems and firmware updated with the latest releases and patches.
Additional details, including the Indicators of Compromise (IoCs) are available in the analysis published by Siddharth Sharma which is available at https://www.uptycs.com/blog/mirai-code-re-use-in-gafgyt.
About the author: Security researcher Siddharth Sharma
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Mirai)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/116882/cyber-crime/gafgyt-re-uses-mirai-code.html