Tag: Windows

A strange case occurred recently on our Windows Server 2019.

It runs some Hyper-V VMs,
Apache+PHP7 via mod_fcgid (as a service logged in as a restricted user www),
Nginx (as a service logged in as a restricted user www-front),
A nodejs server and stunnel (which was working as local system, it’s obviously a mistake, now corrected)

So the firewall was on with only necessary ports open to public.

One day I noticed that an extra Administrator account named ht was added and security log cleared.

From what I can tell from logs, it all started with a request to the file on an old legacy website. The whole site was ionCube encoded, except this file:

<?PHP
$current_memory = ini_get('memory_limit');
$current_memory = preg_replace('/D/', '', $current_memory);
if ($current_memory <= '512') { ini_set('memory_limit','1024M'); }

ini_set('max_execution_time','120');

phpinfo();
?>

Then, somehow this file was appended with code that saves uploaded file, though www user has no write permissions on this directory altogether. I even tried to append something myself as www and got “Access Denied”, as expected.

Something even more weird happens, local system disables the firewall

A Windows Defender Firewall setting in the Public profile has changed.
New Setting:
Type:   Enable Windows Defender Firewall
Value:  No
Modifying User: SYSTEM
Modifying Application:  C:WindowsSystem32netsh.exe

A new user gets created and added to admins group.
That user connects via RDP which is now available as the Firewall is down, makes a web shell under that website root directory (which was not writeable for the www user), makes a couple of requests to it, then does nothing more.

So the question is, how did he manage to do things using the Local System account? Could it be a vulnerability in stunnel? Any similar cases known?