title: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
status: test
description: Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877
references:
- https://seclists.org/fulldisclosure/2023/Jan/1
- https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-20
tags:
- attack.initial-access
- attack.t1190
- cve.2022-44877
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains|all:
- '/login/index.php'
- 'login='
cs-uri-query|contains:
# TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
- 'login=$('
# Common keywords related to python reverse shells
- 'base64'
- 'subprocess'
- 'socket'
- '${IFS}' # Usage of the input field separator to avoid writing spaces
# B64 Encoded "python" with different offsets
- 'cHl0aG9u'
- 'B5dGhvb'
- 'weXRob2'
condition: selection
falsepositives:
- Web vulnerability scanners
level: high