Msnshell: the problematic official download Link Tracking

Problematic page: http://www.msnshell.net/download.html
 
There should be a problem with the official website. It seems that it has been replaced. There are only over 300 k files, and a bunch of virus reports such as virustotal; 5.xmbis available for downloading to the cloud software station. Local scanning and quick cloud scanning seem non-toxic.
 
From the perspective of the website, the web software used is old, dz 6.1, WordPress 2.0.4, and a closed wiki.
 
New Discovery with http://webscan.360.cn, discovery http://ilove.msnshell.com. Check that the voting plug-in has been injected. The table name is dedecms and the user permission is only USAGE.
 
Penetration Testing does not like shell. Lenovo dedecms has a bunch of problems. I guess this is the cause of the fall of servers?
 
Follow up.
 
Inject and query the background administrator table and find a weak password in the Information reviewer. Then, the system finds a column Directory Vulnerability in the Image Browsing function, however, due to permission issues, you cannot view or read files other than images, or upload other files. It is estimated that the super administrator will have the upload function and the corresponding Upload Vulnerability.
 
In addition, regarding the account, I suspect that the "Information reviewer" was left by hackers, because the logon ip Address "220.178.37.42" is not good in google's reputation and may also be a zombie. In iis5, another super administrator who has the permission to transfer files has been deciphered (but pay-as-you-go query is required). It is estimated that the transfer of shell is not a problem from the "09:38:02" at the end.
 
However, the above speculation may be biased because SQL injection may also be used to erase the intrusion information (effective test ).
 
Therefore, in the subsequent attack steps, it is assumed that the hacker created a super Administrator through SQL injection (or updated an existing common Administrator account to the super account) and then logged on to the background, find the background Upload Vulnerability, pass the shell, and replace the official file with a Trojan. However, I am not brave enough to confirm whether there is a background Upload Vulnerability.
 
Finally, dede version is really old, 2. 1 ......
 
Tracking completed

Nuclear'atk Network Security Research Center