Poorly secured Microsoft SQL (MSSQL) servers have become a favorite target for many groups of attackers including ransomware gangs. In a recent attack campaign dubbed DB#JAMMER hackers used brute-force attacks to compromise MSSQL servers and deploy Cobalt Strike and a variant of the Mimic ransomware called FreeWorld.
“One of the things that makes DB#JAMMER standout is how the attacker’s tooling infrastructure and payloads are used,” researchers from security firm Securonix said in a new report. “Some of these tools include enumeration software, RAT payloads, exploitation and credential stealing software, and finally ransomware payloads.”
Initial access to MSSQL servers and achieving persistence
The attackers use brute-force techniques to guess credentials for the targeted MSSQL servers, but it’s not clear if this involved dictionary-based or password spray attempts. The latter usually involves username and password combinations obtained from other database leaks.
Following the initial access, the attackers investigated the database by enumerating all users with access to it and checked if a function called xp_cmdshell was enabled. This Transact-SQL statement allows database users to execute shell commands in Windows and return the output as text. The attackers leveraged xp_cmdshell extensively, first to gather information about the system and the network environment by invoking Windows tools like wmic.exe, net.exe and ipconfig.exe, then to make modifications to Windows accounts and the system registry.
“Three new users were created on the victim host which include windows, adminv$, and mediaadmin$,” the Securonix researchers said. “Each user was added to the ‘remote desktop users’ and ‘administrators’ [groups]. Interestingly enough the attackers attempted to execute a large one-liner, which would create the users and modify group membership. However, several variations of the command were executed to account for groups in different languages: [English, German, Polish, Spanish, and Catalan].”
Further modifications were made to the new users so their passwords and logged in sessions would never expire. The changes to the registry were also extensive and included enabling the Remote Desktop Protocol (RDP) service, disabling User Access Control restrictions, and hiding remote logged in users from the local login screen.
