This repository contains information regarding post-exploitation activities linked to the Cisco IOS XE Software Web Management User Interface mass exploitations. Cisco Talos [1] published a fingerprint that could check if the implant was active on Cisco IOS XE devices. For reference:
curl -k -X POST "https://DEVICEIP/webui/logoutconfirm.html?logon_hash=1" If the HTTP response consists of a hexadecimal string, this is a high-confidence indicator that the device is compromised. However, as multiple sources have mentioned [2,3], the number of implants that can be discovered using this method has gone down significantly.
Investigated network traffic to a compromised device has shown that the threat actor has upgraded the implant to do an extra header check.
Thus, for a lot of devices, the implant is still active, but now only responds if the correct Authorization HTTP header is set.
We took another look at the initial blogpost by Cisco Talos and noticed an extra location check in the implant code:
Based on the above screenshot of the implant code shared by Cisco Talos we found another method that can be used to fingerprint the presence of the implant.
curl -k "https://DEVICEIP/%25"Using the %25 (percent encoded percent), we meet the conditions specified in the extra location check. This will cause the server to respond with a different HTTP response than it normally would when the implant is not running.
A telltale of implant operation is a <head><title>404 Not Found</title></head> in the body. An example HTTP body is as such:
$ curl -k 'https://DEVICEIP/%25'
<html>
<head><title>404 Not Found</title></head>
<body bgcolor="white">
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>If the implant is not present, you will get a different response. For example:
$ curl -k 'https://DEVICEIP/%25'
<script>window.onload=function(){ url ='/webui';window.location.href=url;}</script>We created a small script that checks for compromise using the above fingerprinting method. Script can be found here:
Example usage:
$ pip3 install requests
$ python3 iocisco.py 1.1.1.1
[*] Found no sign of compromise for either http://1.1.1.1/%25 or https://1.1.1.1/%25[1]: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/
[2]: https://www.bleepingcomputer.com/news/security/number-of-hacked-cisco-ios-xe-devices-plummets-from-50k-to-hundreds/
[3]: https://twitter.com/onyphe/status/1715633541264900217
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent