Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Medium
An attack campaign using the Drupalgeddon2 unauthenticated remote code execution vulnerability to execute malicious code and deface websites. In the case analyzed for their blog, Akamai researchers identified a compromised bodysurfing website logging website requests containing code execution attempts. After cleaning up old infections and reducing a web server’s security posture, the code is used to download two files, a GIF image and a TXT file. The GIF image has the appropriate GIF header but is actually used to execute embedded PHP code. The PHP code first performs website defacement and displays a notification of the infection to visitors to the site. Hidden behind this defacement page are functions that allow the attacker to execute various commands via GET or POST requests, such as scanning for local credentials, getting system configurations, and opening a web shell. The TXT file downloaded in the initial infection contains a malicious Perl script. It provides the attacker with denial of service (DoS) and RAT capabilities. For command and control, it leverages an IRC server that has since been taken down. The researchers note that the attack seems to be more opportunistic than targeted.
IP
91[.]121[.]160[.]194
SH256
e18bf4ddee0b0db77541f3a3ea52d3bbe8fa943dd0ca3f573572fea22533afbe
SHA1
0ef7f63d746c34819d21057bd58b02781777bb29