In both cases the attackers used the vulnerability to upload encrypted files with the extension .txt which were then decoded using the Certutil WIndows utility into .jsp files that served as web shells — backdoor scripts that allow attackers to remote execute commands on a server. In one of the incidents the attackers created a staging folder where they dropped several utilities: a cookie exporting DLL file that is part of Microsoft’s Edge browser, a network resource scanner called fscan.exe, a copy of the Microsoft Resource Compiler, and other executables.
The malicious web shell also contained code that attempted to decrypt passwords for ColdFusion data sources. ColdFusion saves passwords in encrypted form with a seed value that was hard-coded in ColdFusion 8, but is unique for each installation in later versions.
“A threat actor who has control over the database server can use the values to decrypt the data source passwords in ColdFusion version 8 or older,” CISA explains. “The victim’s servers were running a newer version at the time of compromise; thus, the malicious code failed to decrypt passwords using the default hard-coded seed value for the older versions.”
The attackers behind the second incident seem to have been more skilled and used more advanced reconnaissance tactics. They enumerated domain trusts by using nltest commands and they collected information about local and domain administrative accounts by using commands such as localgroup, net user, net user /domain and ID. They also attempted to discover network configuration, time logs, and query user information.
According to CISA the attackers attempted to copy and exfiltrate system registry hives such as HKEY_LOCAL_MACHINE (HKLM) and the Security Account Manager (SAM), but the activity was detected and blocked. “The SAM Registry file may allow for malicious actors to obtain usernames and reverse engineer passwords; however, no artifacts were available to confirm that the threat actors were successful in exfiltrating the SAM Registry hive,” the agency said.
The attackers also dumped the memory of the local security authority subsystem service (LSASS), which usually contains NTLM credentials for user accounts that were used on the system, including disabled credentials that might still be valid on other systems.
