PHP2Shell RCE Hunting Across Exposed Open Directories

Summary

An unidentified threat actor successfully exfiltrated 68.8 GB of database backups from a Philippine government agency. The operation was exposed after the attacker left a staging server running an unauthenticated Python HTTP directory accessible from the internet. Tools recovered from the server included a rebranded GodPotato payload called Wrqsnx and a PowerShell stager.

Investigation

The investigation involved reverse-engineering recovered payloads and examining access logs from the exposed staging server. Researchers traced the attacker’s infrastructure to a Linux host operated by UpCloud Ltd and identified the victim through certificate matching associated with the Philippine Overseas Employment Administration. Analysis showed that the operator used a PowerShell stager to execute the payload in memory and evade disk-based detection.

Mitigation

Organizations should disable directory listing across web servers and ensure staging environments are never publicly exposed. Apply strict access controls to sensitive database backups and monitor for unauthorized use of utilities such as Rclone or Impacket. Service accounts should also be regularly audited for SeImpersonate privileges to reduce local privilege escalation risk from tools such as GodPotato.

Response

When unauthorized staging directories or known exploitation tools such as Impacket are detected, isolate affected systems immediately. Perform memory forensics to identify in-memory stagers and inspect systems for suspicious named pipes. Audit service account activity for unexpected token impersonation, privilege escalation, or SYSTEM-level command execution.

Simulation Execution

• Attack Narrative & Commands: An adversary has obtained a specialized stager named portalload.ps1. To avoid leaving a large footprint on the disk, the adversary intends to use this script to reassemble encoded fragments directly into memory. The attacker executes the script via the PowerShell CLI. This action is intended to trigger the SOC’s detection of the specific filename, which in a real-world scenario, would be an attempt to use a known-malicious tool.

• Regression Test Script:

  # Simulation script to trigger the 'portalload.ps1' detection rule.
  # This creates a dummy file to simulate the presence of the stager.
  New-Item -Path "$env:TEMPportalload.ps1" -ItemType "File" -Value "# Simulated Stager Content"
  
  # Execute the 'malicious' stager via PowerShell to generate the detection telemetry
  Start-Process powershell.exe -ArgumentList "-File `"$env:TEMPportalload.ps1`""

• Cleanup Commands:

  # Cleanup the dummy file created during simulation
  Remove-Item -Path "$env:TEMPportalload.ps1" -Force