1

I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is still a backdoor on my website, and I need to clean it. Here is the information they gave me:

  1. Backdoor script URL: http://my.website.com/images/xxx.jsp
  2. My IP address and port: 1.1.1.1:80
  3. Hacker's IP address and port: 2.2.2.2:2000

After that I confirmed they are correct, there is a backdoor script. However frankly, I am worrying more about them than some random hackers from internet due to there reputation. So I try to learn how they know that. Here is my assumption:

  1. The hacker's IP already reported, I can find it in this blacklist: https://cleantalk.org/blacklists/1.1.1.1 for example. And they also know this list.
  2. They filtered all packages to that IP address, and get the backdoor script URL from the HTTP headers in that packages.

My questions are:

  1. Is my assumption correct?
  2. If it is a HTTPS website, could they still get the URL?
Improve this question

1 Answer 1

Reset to default
5

While it is hard to know what they did exactly I expect that they simply watch services like Phishtank or URLhaus or might also have access to the results of scanning infrastructure as needed for Google SafeBrowsing or Microsoft Smartscreen (Baidu might have similar services) or that the URL was reported to them as suspicious.
None of this requires them to do expensive traffic analysis or to even break HTTPS.

Improve this answer
3
  • Here is the attack process and the report process I am trying to chain: 1. The hacker uploaded the xxx.jsp file. It is exactly the same as this txt file. There I find Java.lang.Runtime.exec() and DriverManager.getConnection(). So I guess this is some kind of reverse shell that execute SQL statement or Shell commend, rather than a template contains malicious javascript code. And I tried egrep -r 'xxx.jsp|eHh4LmpzcA==' . on the HTTP ROOT directory, eHh4LmpzcA== is base64 for xxx.jsp and I got nothing.
    – someone
    Apr 22, 2019 at 7:48
  • So I guess a normal user can not access this jsp at all, since there is no link to this resource. The hacker could somehow modify my web page to include his malicious javascript code through this reverse shell, for example login.jsp; If he/she did the last step, there is a chance that login.jsp would be reported to either of the watch services you provided in your answer. But they know xxx.jsp is the backdoor. In summarize, my assumption is only js code could be reported to the watch services, did I miss something?
    – someone
    Apr 22, 2019 at 7:48
  • 1
    @someone: "... since there is no link to this resource" - I'm not sure that I understand you correctly. In my opinion it does not matter if you have created an explicit link or not. All what matters is that the malicious page could be accessed through some URL. This URL could then have been distributed by phishing mails etc. And this URL would thus be reported as malicious.
    – Steffen Ullrich
    Apr 22, 2019 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .