Full Report
Huntress recently detected interesting activity on an endpoint; a threat actor was attempting to establish a foothold on an endpoint by using commands issued via MSSQL to upload a reverse shell accessible from the web server. All attempts were obviated by MAV and process detections, but boy-howdy, did they try!
Analysis Summary
# Incident Report: Attempted MSSQL-to-Web-Shell Foothold
## Executive Summary
Huntress detected a persistent threat actor attempting to establish a foothold on a Windows Server 2019 Essentials system by leveraging compromised MSSQL 'sa' credentials. The attacker tried to deploy a PHP reverse shell to the web server's root directory via PowerShell and `certutil.exe`. All attempts were successfully blocked by Managed Anti-Virus (MAV) and process-based detections, resulting in no successful compromise.
## Incident Details
- **Discovery Date:** March 20, 2024 (Publication Date)
- **Incident Date:** Over a two-day period (Dates not specified)
- **Affected Organization:** Not Disclosed
- **Sector:** Not Disclosed
- **Geography:** Likely International (Attacker IP sourced from Algeria)
## Timeline of Events
### Initial Access
- **Date/Time:** Day 1
- **Vector:** Credential Compromise / SQL Injection
- **Details:** The attacker utilized previously obtained access to the MSSQL `sa` account. Prior web logs also showed successful `sqlmap` queries from IP `35.195.172[.]146`.
### Lateral Movement
- **Details:** The attacker attempted to pivot from the database service (`sqlservr.exe`) to the web server directory (`inetpub/wwwroot`) by executing operating system commands.
### Data Exfiltration/Impact
- **Details:** None. All reverse shell deployments were quarantined by Windows Defender or blocked by EDR process monitoring.
### Detection & Response
- **Discovery:** Triggered by MAV alerts for "VirTool:PHP/Meterpreter.A!MTB" and EDR detections for suspicious `certutil.exe` and `PowerShell` usage.
- **Response actions taken:** Automated quarantine of malicious files; Huntress analysts monitored the activity and alerted the customer to the ongoing brute force/exploitation attempts.
## Attack Methodology
- **Initial Access:** MSSQL 'sa' account compromise (likely via SQL injection or brute force).
- **Persistence:** Attempted to upload `maa.php` and `fata.php` reverse shells to the web root for persistent remote access.
- **Defense Evasion:** Use of `certutil.exe` to decode payloads; attempts to obfuscate commands via PowerShell.
- **Discovery:** Use of `sqlmap` to identify vulnerabilities.
- **Impact:** Attempted Remote Code Execution (RCE).
## Impact Assessment
- **Financial:** Minimal (Internal investigation time).
- **Data Breach:** None.
- **Operational:** None; services remained online as the attack was obviated.
- **Reputational:** None.
## Indicators of Compromise
- **Network Indicators:**
- `41.102.167[.]182` (Attacker source IP)
- `35.195.172[.]146` (SQLmap source IP)
- `https[:]//raw.githubusercontent[.]com/hightidAOaa/azdaz/main/maa.php`
- `https[:]//github[.]com/hightidAOaa/azdaz/raw/main/fata.php`
- **File Indicators:**
- `maa.php` (Detected as VirTool:PHP/Meterpreter.A!MTB)
- `fata.php`
- **Behavioral Indicators:**
- `sqlservr.exe` spawning `powershell.exe` or `certutil.exe`.
- `Invoke-WebRequest` targeting GitHub/raw content to `inetpub` directories.
## Response Actions
- **Containment:** Automated MAV quarantine of dropped files.
- **Eradication:** Identification and blocking of malicious IP addresses; recommendation to change MSSQL credentials.
- **Recovery:** Verification of web server integrity and removal of staging files.
## Lessons Learned
- **SQL Hardening:** The use of the 'sa' account for external-facing applications remains a high-risk configuration.
- **Monitoring Efficacy:** The combination of signature-based (MAV) and behavior-based (EDR) tools provided defense-in-depth that prevented a breach even when the attacker had valid credentials.
## Recommendations
- **Least Privilege:** Disable the MSSQL 'sa' account or rename it and ensure the database service runs under a low-privilege service account.
- **Input Validation:** Remediate SQL injection vulnerabilities identified by the attacker’s `sqlmap` activity.
- **Egress Filtering:** Restrict servers from reaching out to unauthorized external repositories like GitHub.
- **Disable xp_cmdshell:** Ensure `xp_cmdshell` is disabled in MSSQL to prevent the database from executing OS-level commands.