Another hacker file manager.
40.112.248.112 doese not have a DNS A record: no hostname in DNS.
40.112.248.112 resides in a Microsoft address range:
NetRange: 40.74.0.0 - 40.125.127.255
CIDR: 40.76.0.0/14, 40.120.0.0/14, 40.80.0.0/12, 40.125.0.0/17, 40.124.0.0/16, 40.74.0.0/15, 40.96.0.0/12, 40.112.0.0/13
NetName: MSFT
Organization: Microsoft Corporation (MSFT)
RegDate: 2015-02-23
Updated: 2015-05-27
No previous contacts from this IP address, but I recorded 673 accesses from IP addresses in 40.112.0.0/13, between 2015-10-01 04:56:52-06 and 2019-01-22 17:48:41-07 The accesses look like a mix of human, crawlers (mostly MJ12Bot, ugh), and WordPress login guessers. I take it Microsoft doesn't take ISP police duties seriously.
For starters, apparently the attacker thought the installation directory the WordPress blog it was attacking was the single ASCII character 0x0D, control-M, carriage return. This is odd. It may be an artifact of my honey pot not emulating WordPress closely enough, or it may be a bug in the attackers' code.
I'm not sure what the attackers thought they were doing.
The invoked a URL ending in /wp-admin/admin-ajax.php.
Such a PHP file exists in WordPress installs,
and there have been exploits for it.
This appears to be a standard HTTP file upload to admin-ajax.php,
with an HTTP POST parameter named "value",
which confusingly has a value "upload.php".
It's entirely possible that the attackers thought they were uploading
to pre-existing backdoor code in admin-ajax.php,
or it could be further evidence of sloppy or broken attack code.
As a file manager, it's not too bad. It really only supports very basic operations, like changing permissions, deleting and renaming, and then only on a single file at a time.
It does allow uploading arbitrary files, and executing arbitray shell commands remotely.
It also allows you to "encrypt" (really, encode) any values of HTTP parameters passed to and from the file manager's code. This may elude some egress monitoring or something.
It also shows one of 15 hacker quotes on every page display. Very inspirational!
The file manager's code isn't too bad.
Everything is named in snake_case,
but there's a variety of indenting and bracketing styles
that probably mean cut-n-pasted example code,
or multiple "hackers" have worked on it.
It uses the word "folders" for directories,
so the coder(s) have probably migrated from the Windows ecosystem.
- Tryag file manager, Sep 19th, 2017
- Another instance, Jun 1st, 2018
- Blog post consisting entirely of source code, Posted December 5, 2016