/
← Voltar ao feed
high exploit público

NoBooze1 malware delivered to TP-Link AX21 routers and Raisecom web interfaces by a single actor via command injection

1 fonte(s) · 1 atualização(ões) · publicado 15/07/2025 23:46 · coletado há 1 dia

F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotated, always keeping one of the two constant, which F5 uses to attribute the activity to a single actor. The stage-one bash script downloads seven architecture-specific ELF binaries (MIPS, ARM, x86, x86-64) and runs each in turn. F5 does not assess the malware as a Mirai variant. The article's title cites CVE-2019-9082 (ThinkPHP), but the analysis concerns CVE-2023-1389, so the title reference appears to be an error. The monthly review also shows overall CVE targeting declining in June 2025, with CVE-2017-9841 (PHPUnit) still dominant and CVE-2023-1389 rising.

Technical Details

  • Exploit URL pattern: /cgi-bin/luci/;stok=/locale?form=country&country=$(COMMAND).
  • The stage-one script runs cd /tmp; wget from 220.158.232.99/j/<binary>, then chmod 777, executes the binary with the argument tplink, and removes it. Binaries: mle1, mbe1, aale1, a5le1, a7le1, xle1, xale1.
  • The analyzed x86-64 sample xale1 is statically linked and packed with an unrecognized (possibly custom) packer using LZMA. It prints the string "twinks :3" on exit. The unpacker uses sys_mmap and reads /proc/self/exe. It then renames itself to a random four-letter name and deletes it, marks the memory executable, and jumps to the unpacked ELF. F5 judges the unpacker and malware were likely written by different authors.
  • The unpacked binary resolves domains via hardcoded DNS servers (1.1.1.1, 8.8.8.8, 8.8.4.4) and communicates only over cleartext HTTP.
  • It downloads an additional architecture-specific payload from hxxp://DOMAIN/meow/nkSUFFIX, using wget or busybox wget, then runs it and deletes it.
  • Hardcoded shell vocabulary (scp, mount, tcpdump, sed, mkfifo, pgrep, netstat) suggests RAT-like recon and lateral movement capability.
  • Suspected C2 domains: cross-compiling[.]org (suspended), i-kiss-boys[.]com, furry-femboys[.]top, twinkfinder[.]nl and 3gipcam[.]com (the last four on AS14956, RouterHosting LLC).
  • Raisecom exploitation (CVE-2024-7120) shares stage-one infrastructure with the TP-Link activity. F5 infers the later stages are similar but has not confirmed this.
  • F5 expects the actor to expand to other command-injection CVEs.
  • The sensors are passive, so benign and malicious recon cannot be reliably separated.

Remediation

  • Scan the environment for vulnerabilities and patch high-priority ones promptly, including TP-Link AX21 and Raisecom devices.
  • Deploy a WAF or similar control to detect and block web exploits.
  • Monitor anomalous outbound traffic for devices participating in DDoS or botnet activity.
  • Use a DDoS mitigation service.
  • Block the listed IPs and domains and hunt for the listed hashes.

3 exploits públicos

Há código de exploração publicado no Exploit-DB para CVE-2023-1389, CVE-2019-9082. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-51677 ↗ · remoto · hardware · pub. 10/08/2023 não verificado

    TP-Link Archer AX21 - Unauthenticated Command Injection

    This script exploits CVE-2023-1389, a command injection in the web interface of the TP-Link Archer AX21, where the country setting of the locale handler reaches a shell unsanitized. The attacker needs only network reach to the router's web interface, no login, and firmware older than 1.1.4 Build 20230219. Sending the crafted request twice runs commands as root, and here it opens a reverse shell to the attacker. It is a short but working proof of concept that matches the listed CVE.

    CVE-2023-1389 · autor: Voyag3r · explicação gerada por IA
  2. exploit-db.com · EDB-48333 ↗ · remoto · linux · pub. 16/04/2020 verificado

    ThinkPHP - Multiple PHP Injection RCEs (Metasploit)

    This Metasploit module exploits remote code execution in the ThinkPHP 5.x web framework through the public index page, where a crafted request makes the framework call a PHP function with attacker-chosen input. The attacker needs only network access to the web server, with no login or user interaction, and a ThinkPHP version up to 5.0.23. The module reads the version from an error page and picks one of two techniques, one per CVE. It runs system commands as the web server user and can drop a Linux payload for a remote session. It is a mature, working exploit.

    CVE-2019-9082 · autor: Metasploit · explicação gerada por IA
  3. exploit-db.com · EDB-46488 ↗ · aplicação web · php · pub. 04/03/2019 não verificado

    zzzphp CMS 1.6.1 - Cross-Site Request Forgery

    This is a cross-site request forgery proof of concept against the zzzphp CMS 1.6.1 admin panel, in the template file editing function. The admin save form has no anti-CSRF token, so a malicious web page can silently submit a forged edit. The attacker only needs to lure a logged-in administrator to that page; no credentials or local access are required. The forged edit writes a PHP expression into a site template, which the CMS later evaluates, leading to remote code execution. It is a simple, working-looking PoC (unverified), and the author describes it as a follow-up to CVE-2019-9041.

    CVE-2019-9082 · autor: Yang Chenglong · explicação gerada por IA

Linha do tempo

  1. f5.com ↗ · pub. 15/07/2025 23:46 · coletado 19/10 18:02 primeiro registro

    NoBooze1 malware delivered to TP-Link AX21 routers and Raisecom web interfaces by a single actor via command injection

    ler a análise desta fonte

    F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotated, always keeping one of the two constant, which F5 uses to attribute the activity to a single actor. The stage-one bash script downloads seven architecture-specific ELF binaries (MIPS, ARM, x86, x86-64) and runs each in turn. F5 does not assess the malware as a Mirai variant. The article's title cites CVE-2019-9082 (ThinkPHP), but the analysis concerns CVE-2023-1389, so the title reference appears to be an error. The monthly review also shows overall CVE targeting declining in June 2025, with CVE-2017-9841 (PHPUnit) still dominant and CVE-2023-1389 rising.

    Technical Details

    • Exploit URL pattern: /cgi-bin/luci/;stok=/locale?form=country&country=$(COMMAND).
    • The stage-one script runs cd /tmp; wget from 220.158.232.99/j/<binary>, then chmod 777, executes the binary with the argument tplink, and removes it. Binaries: mle1, mbe1, aale1, a5le1, a7le1, xle1, xale1.
    • The analyzed x86-64 sample xale1 is statically linked and packed with an unrecognized (possibly custom) packer using LZMA. It prints the string "twinks :3" on exit. The unpacker uses sys_mmap and reads /proc/self/exe. It then renames itself to a random four-letter name and deletes it, marks the memory executable, and jumps to the unpacked ELF. F5 judges the unpacker and malware were likely written by different authors.
    • The unpacked binary resolves domains via hardcoded DNS servers (1.1.1.1, 8.8.8.8, 8.8.4.4) and communicates only over cleartext HTTP.
    • It downloads an additional architecture-specific payload from hxxp://DOMAIN/meow/nkSUFFIX, using wget or busybox wget, then runs it and deletes it.
    • Hardcoded shell vocabulary (scp, mount, tcpdump, sed, mkfifo, pgrep, netstat) suggests RAT-like recon and lateral movement capability.
    • Suspected C2 domains: cross-compiling[.]org (suspended), i-kiss-boys[.]com, furry-femboys[.]top, twinkfinder[.]nl and 3gipcam[.]com (the last four on AS14956, RouterHosting LLC).
    • Raisecom exploitation (CVE-2024-7120) shares stage-one infrastructure with the TP-Link activity. F5 infers the later stages are similar but has not confirmed this.
    • F5 expects the actor to expand to other command-injection CVEs.
    • The sensors are passive, so benign and malicious recon cannot be reliably separated.

    Remediation

    • Scan the environment for vulnerabilities and patch high-priority ones promptly, including TP-Link AX21 and Raisecom devices.
    • Deploy a WAF or similar control to detect and block web exploits.
    • Monitor anomalous outbound traffic for devices participating in DDoS or botnet activity.
    • Use a DDoS mitigation service.
    • Block the listed IPs and domains and hunt for the listed hashes.