From fc81c76727c84f0ca462e63ec548c4f6db45c16f Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 14 Apr 2025 12:39:07 -0600 Subject: [PATCH 1/4] Haag's Crushed Shell: A Tale of CrushFTP Exploitation CVE-2025-31161 --- .../windows_shell_process_from_crushftp.yml | 51 +++++++++++++++++ ...ftp_authentication_bypass_exploitation.yml | 57 +++++++++++++++++++ ...rushftp_max_simultaneous_users_from_ip.yml | 53 +++++++++++++++++ stories/crushftp_vulnerabilities.yml | 4 ++ 4 files changed, 165 insertions(+) create mode 100644 detections/endpoint/windows_shell_process_from_crushftp.yml create mode 100644 detections/web/crushftp_authentication_bypass_exploitation.yml create mode 100644 detections/web/crushftp_max_simultaneous_users_from_ip.yml diff --git a/detections/endpoint/windows_shell_process_from_crushftp.yml b/detections/endpoint/windows_shell_process_from_crushftp.yml new file mode 100644 index 0000000000..7a74bb4357 --- /dev/null +++ b/detections/endpoint/windows_shell_process_from_crushftp.yml @@ -0,0 +1,51 @@ +name: Windows Shell Process from CrushFTP +id: 459628e3-1b00-4e9b-9e5b-7da8961aea35 +version: 1 +date: '2025-04-03' +author: Michael Haag, Splunk +status: experimental +type: TTP +description: Detects execution of a shell process with CrushFTP as a parent process. May indicate post-exploitation of a vulnerability in CrushFTP such as CVE-2025-31161 authentication bypass. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is crushftpservice.exe. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=crushftpservice.exe AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_shell_process_from_crushftp_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. +known_false_positives: Unknown. Filter as needed. +references: + - https://nvd.nist.gov/vuln/detail/CVE-2025-31161 + - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update + - https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Possible CrushFTP exploitation detected on $dest$ related to CVE-2025-31161. + risk_objects: + - field: dest + type: system + score: 65 + threat_objects: [] +tags: + analytic_story: + - CrushFTP Vulnerabilities + asset_type: Endpoint + cve: + - CVE-2025-31161 + mitre_attack_id: + - T1059.001 + - T1059.003 + - T1190 + - T1505 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint \ No newline at end of file diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml new file mode 100644 index 0000000000..50ee6140e5 --- /dev/null +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -0,0 +1,57 @@ +name: CrushFTP Authentication Bypass Exploitation +id: 82eb7f64-d219-4e21-acfe-956de84c1a35 +version: 1 +date: '2025-04-08' +author: Michael Haag, Splunk +status: production +type: TTP +description: The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities. +data_source: +- CrushFTP +search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?[^:]+):(?[^\\]]+)\\]" | rex field=_raw "cmd:(?[^\\*\\r\\n]+)" | where isnotnull(cmd) AND (match(cmd, "mesch\.exe") OR match(cmd, "b64exec") OR match(cmd, "fullinstall") OR match(cmd, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, username, cmd | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`' +how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. This detection searches for CrushFTP logs containing suspicious command execution patterns commonly associated with exploitation of the CVE-2025-31161 vulnerability. +known_false_positives: False positives may occur if there are legitimate administrative commands being executed on the CrushFTP server that match the suspicious patterns. Review the commands being executed to determine if the activity is legitimate administrative work or potential malicious activity. +references: +- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation +- https://nvd.nist.gov/vuln/detail/CVE-2025-31161 +- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update +drilldown_searches: +- name: View the detection results for - "$src_ip$" + search: '%original_detection_search% | search src_ip = "$src_ip$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$src_ip$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $username$ + risk_objects: + - field: src_ip + type: system + score: 80 + - field: username + type: user + score: 60 + threat_objects: [] +tags: + analytic_story: + - CrushFTP Vulnerabilities + asset_type: Web Server + mitre_attack_id: + - T1190 + - T1059.003 + - T1059.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network + cve: + - CVE-2025-31161 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log + sourcetype: crushftp:sessionlogs + source: crushftp \ No newline at end of file diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml new file mode 100644 index 0000000000..043bdb5ff6 --- /dev/null +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -0,0 +1,53 @@ +name: CrushFTP Max Simultaneous Users From IP +id: 75dfd9f4-ca64-45d0-9422-4bde6d26a59e +version: 1 +date: '2025-04-08' +author: Michael Haag, Splunk +status: production +type: Anomaly +description: The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. +data_source: +- CrushFTP +search: '`crushftp` "*User access not allowed. Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?[^:]+):(?[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(username) as username by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`' +how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:username:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior. +known_false_positives: In environments where multiple users legitimately access CrushFTP from behind the same NAT or proxy, this may generate false positives. Tune the threshold based on your organization's usage patterns. +references: +- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation +- https://nvd.nist.gov/vuln/detail/CVE-2025-31161 +- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update +drilldown_searches: +- name: View the detection results for - "$src_ip$" + search: '%original_detection_search% | search src_ip = "$src_ip$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$src_ip$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Potential brute force or automated attack against CrushFTP detected from IP $src_ip$ + risk_objects: + - field: src_ip + type: system + score: 45 + threat_objects: [] +tags: + analytic_story: + - CrushFTP Vulnerabilities + asset_type: Web Server + mitre_attack_id: + - T1110.001 + - T1110.004 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network + cve: + - CVE-2025-31161 +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/crushftp11_session.log + sourcetype: crushftp:sessionlogs + source: crushftp diff --git a/stories/crushftp_vulnerabilities.yml b/stories/crushftp_vulnerabilities.yml index a72cb1f9d8..37bb20650b 100644 --- a/stories/crushftp_vulnerabilities.yml +++ b/stories/crushftp_vulnerabilities.yml @@ -9,6 +9,9 @@ narrative: CVE-2024-4040 exposes a severe server-side template injection vulnera references: - https://github.com/airbus-cert/CVE-2024-4040 - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ +- https://nvd.nist.gov/vuln/detail/CVE-2025-31161 +- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update +- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation tags: category: - Adversary Tactics @@ -19,3 +22,4 @@ tags: usecase: Advanced Threat Detection cve: - CVE-2024-4040 + - CVE-2025-31161 From 6bd0f5ab8f341f465a08a26ddfc9041edcd840ba Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 18 Apr 2025 11:28:32 -0600 Subject: [PATCH 2/4] Update windows_shell_process_from_crushftp.yml --- .../windows_shell_process_from_crushftp.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_shell_process_from_crushftp.yml b/detections/endpoint/windows_shell_process_from_crushftp.yml index 7a74bb4357..b88a289397 100644 --- a/detections/endpoint/windows_shell_process_from_crushftp.yml +++ b/detections/endpoint/windows_shell_process_from_crushftp.yml @@ -3,14 +3,14 @@ id: 459628e3-1b00-4e9b-9e5b-7da8961aea35 version: 1 date: '2025-04-03' author: Michael Haag, Splunk -status: experimental +status: production type: TTP -description: Detects execution of a shell process with CrushFTP as a parent process. May indicate post-exploitation of a vulnerability in CrushFTP such as CVE-2025-31161 authentication bypass. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is crushftpservice.exe. +description: The following analytic identifies instances where CrushFTP's service process (crushftpservice.exe) spawns shell processes like cmd.exe or powershell.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because CrushFTP should not normally spawn interactive shell processes during regular operations. If confirmed malicious, this behavior could indicate successful exploitation of vulnerabilities like CVE-2025-31161, potentially allowing attackers to execute arbitrary commands with the privileges of the CrushFTP service. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=crushftpservice.exe AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_shell_process_from_crushftp_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=crushftpservice.exe AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process Processes.original_file_name Processes.user Processes.action Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_path Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_path Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_shell_process_from_crushftp_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. known_false_positives: Unknown. Filter as needed. references: @@ -48,4 +48,12 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - security_domain: endpoint \ No newline at end of file + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/crushftp/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + + \ No newline at end of file From 95049154e96aa8cd30bd54ea353035dc1a3458bb Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 18 Apr 2025 13:25:39 -0600 Subject: [PATCH 3/4] Update crushftp_authentication_bypass_exploitation.yml --- .../web/crushftp_authentication_bypass_exploitation.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/web/crushftp_authentication_bypass_exploitation.yml b/detections/web/crushftp_authentication_bypass_exploitation.yml index 50ee6140e5..bd9717dbb9 100644 --- a/detections/web/crushftp_authentication_bypass_exploitation.yml +++ b/detections/web/crushftp_authentication_bypass_exploitation.yml @@ -8,7 +8,7 @@ type: TTP description: The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities. data_source: - CrushFTP -search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?[^:]+):(?[^\\]]+)\\]" | rex field=_raw "cmd:(?[^\\*\\r\\n]+)" | where isnotnull(cmd) AND (match(cmd, "mesch\.exe") OR match(cmd, "b64exec") OR match(cmd, "fullinstall") OR match(cmd, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, username, cmd | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`' +search: '`crushftp` | rex field=_raw "\\[HTTP:[^:]+:(?[^:]+):(?[^\\]]+)\\]" | rex field=_raw "cmd:(?[^\\*\\r\\n]+)" | where isnotnull(process) AND (match(process, "mesch\.exe") OR match(process, "b64exec") OR match(process, "fullinstall") OR match(process, "run")) | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, user, process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_authentication_bypass_exploitation_filter`' how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. This detection searches for CrushFTP logs containing suspicious command execution patterns commonly associated with exploitation of the CVE-2025-31161 vulnerability. known_false_positives: False positives may occur if there are legitimate administrative commands being executed on the CrushFTP server that match the suspicious patterns. Review the commands being executed to determine if the activity is legitimate administrative work or potential malicious activity. references: @@ -25,12 +25,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $username$ + message: Potential CrushFTP authentication bypass exploitation from IP $src_ip$ as user $user$ risk_objects: - field: src_ip type: system score: 80 - - field: username + - field: user type: user score: 60 threat_objects: [] From 9f8f28c0b571a3cd3a38a0a0c597c3ea68eaa5cc Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Fri, 18 Apr 2025 13:27:09 -0600 Subject: [PATCH 4/4] Update crushftp_max_simultaneous_users_from_ip.yml --- detections/web/crushftp_max_simultaneous_users_from_ip.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/web/crushftp_max_simultaneous_users_from_ip.yml b/detections/web/crushftp_max_simultaneous_users_from_ip.yml index 043bdb5ff6..fd9eb99a8c 100644 --- a/detections/web/crushftp_max_simultaneous_users_from_ip.yml +++ b/detections/web/crushftp_max_simultaneous_users_from_ip.yml @@ -8,8 +8,8 @@ type: Anomaly description: The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. data_source: - CrushFTP -search: '`crushftp` "*User access not allowed. Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?[^:]+):(?[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(username) as username by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`' -how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:username:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior. +search: '`crushftp` "*User access not allowed. Max simultaneous users from your IP*" | rex field=_raw "SESSION\\|\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+\\.\\d+\\|\\[HTTP:[^:]+:(?[^:]+):(?[0-9\\.]+)\\]" | stats count min(_time) as firstTime max(_time) as lastTime values(user) as user by src_ip | where count >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `crushftp_max_simultaneous_users_from_ip_filter`' +how_to_implement: To implement this detection, you need to ingest CrushFTP logs into your Splunk environment. Configure CrushFTP to forward logs to Splunk via a syslog forwarder or direct file monitoring. Ensure the sourcetype is correctly set for the CrushFTP logs. The detection requires the SESSION field and the "[HTTP:*:user:IP]" format in the logs. Adjust the threshold in the "where count >= 3" clause based on your environment's normal behavior. known_false_positives: In environments where multiple users legitimately access CrushFTP from behind the same NAT or proxy, this may generate false positives. Tune the threshold based on your organization's usage patterns. references: - https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation