Technology1 min read

Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers

By · Published by Everything Blog

In short

Discovered during proactive threat hunting on October 25, the attack leveraged a single HTTP request to chain the PHP2Shell remote code execution vulnerability with the Fragnesia kernel flaw. Once inside the perimeter, the perpetrators deployed around 40 custom scripts to enumerate internal directories and embed themselves within an Active Directory environment. Although the targeted hardware vendor has received private disclosure, public details regarding the affected software models remain undisclosed to prevent further exploitation.

Key points

  • Threat actors compromised three servers tied to a U.S. government-affiliated organization…: Threat actors compromised three servers tied to a U.S. government-affiliated organization to establish persistent Active Directory access.
  • Code commenting and script structure indicate the adversary utilized artificial intellige…: Code commenting and script structure indicate the adversary utilized artificial intelligence tooling to assist in developing post-exploitation utilities.
  • Researchers withheld the identity of the impacted major vendor and specific software buil…: Researchers withheld the identity of the impacted major vendor and specific software builds while remediation efforts proceed.

Sources checked by our analysis pipeline: 1

Custom PHP2Shell Exploit Chained with Kernel LPE to Root Firewalls in the Wild

On October 25, Dream researchers uncovered artifacts of what appeared to be a Chinese AI-assisted campaign that rooted 25 servers, including systems in a US government-affiliated environment. The attacker combined PHP2Shell with a kernel privilege-escalation exploit to compromise exposed systems.

The affected devices run specific versions of a large vendor’s firewall software. For security purposes, we are not disclosing the vendor or the affected versions, and the vendor has been notified.

The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.

The operation illustrates how an exposed management interface can become a path into an organization’s identity infrastructure. For government defenders, vulnerability discovery is just the beginning, after which the real challenge extends from identifying vulnerable systems to understanding and containing the access a compromise makes possible.

The research below was conducted with proactive threat hunting using Dream’s autonomous cyber research product, Hero.

Discovery

Dream researchers identified a complete attack operation that included a custom weaponization of the PHP2Shell exploit…

Technology

More in Technology