Alien

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

Web applications remain one of the most common attack surfaces... arbitrary code execution obtained through a web application often serves as the initial foothold. | If we discover a SQL injection vulnerability, we can exploit it using sqlmap... sqlmap.py -u 'YOUR URL' --os-shell

exec ( 'tasklist /NH /FO CSV' , $outputLines );

<?php @ eval ( $_POST [ 'pass' ]); ?>

The POST data below demonstrates how this webshell can be exploited... pass=print "Content-Type: text/html\n\n";system("whoami");

Hooking the ioctl() API in the libbinder.so using an open-source library called xHook is one of the means it uses to communicate with PREDATOR... ALIEN attempts to hook the following APIs in the audio libraries being used by a process.

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

The environment string serves two purposes: It determines whether the plugin is compatible with the current webshell... For instance, if the environment of the current webshell is PHP/v8.X/OneShell...

For example, the implant can inject code that was read earlier from “/system/fonts/NotoColorEmoji.ttf” into the system_server process memory for execution... The overall injection process is achieved using ptrace() and mmap() to inject the code into the target process.

For privilege escalation, the spyware is configured to use a method called QUAILEGGS, or, if QUAILEGGS is not present, it will use a different method called “kmem.” ... We assess that QUAILEGGS likely exploits the aforementioned zero-day vulnerability CVE-2021-1048.

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

Each of these call chains set up a process structure used to intercept specific ioctl commands, where the spyware uses the functionality of that process to abuse the SELinux context to grant different functionality to the other processes.

If you are concerned about WAFs and IDSs, you can enable Event Horizon for evasion.

For example, the implant can inject code that was read earlier from “/system/fonts/NotoColorEmoji.ttf” into the system_server process memory for execution... The overall injection process is achieved using ptrace() and mmap() to inject the code into the target process.

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

The DEX file thus uses these hooks for two key purposes: Hiding Applications/packages : The plugin in the DEX can hook and filter out a specific package/application name from the list of installed packages and applications.

Hooking the ioctl() API in the libbinder.so using an open-source library called xHook is one of the means it uses to communicate with PREDATOR... ALIEN attempts to hook the following APIs in the audio libraries being used by a process.

Languages such as PHP and Classic ASP execute payloads through eval() , while Java and .NET rely on reflective loading.

an attacker can find the password of MySQL in phpMyAdmin/config.inc.php

The spyware can also add certificates to the current user-trusted certificate authorities by writing the certificate authority’s (CA) public certificate to the path “/data/misc/user/0/cacerts-added”.

The core idea is to obtain all running processes from the remote server and compare them against a database of known anti-virus software.

exec ( 'tasklist /NH /FO CSV' , $outputLines ); ... The core idea is to obtain all running processes from the remote server and compare them against a database of known anti-virus software.

The spyware uses a variety of sources to gather information about the system. It will enumerate various directories on the file system and read multiple files to extract as much statically available data from the infected device.

If any of these manufacturers' names match, it will recursively enumerate the contents of the following directories on disk...

Alien also provides a virtual terminal. Users can use this feature to establish SSH connections to other machines.

Users can use this feature to establish SSH connections to other machines.

Once another webshell has been deployed on an internal host, DriftingComet can be used to establish a pivot between compromised servers, allowing you to progressively reach deeper targets within the network.

The implant gathers configuration information, but it will also collect contacts, calls and messaging information by copying the content of the files listed below... The content obtained is then written to “/data/local/tmp/wd/”, before being exfiltrated.

This spyware can record audio from different sources by several means. It can record from microphone, earpiece- and VOIP-based calls, using deep-level techniques like memcpy hooking inside audio-related processes, or more simply, creating a RECORD interface using the OpenSLES native library.

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

Whenever Alien is about to send an HTTP request, it forwards the payload to Event Horizon. Event Horizon then executes the selected tamper script, transforms the payload, and returns the obfuscated result back to Alien.

the entire payload is encrypted using XOR and then encoded in Base64 before transmission... The generated OneShell first decodes the incoming Base64 data, decrypts it using the configured XOR key, and finally executes the recovered payload using eval().