{"uuid": "8e932422-7e08-490e-b895-3f264faf3963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27852", "type": "seen", "source": "https://t.me/hacking_Attack/24365", "content": "Black Hat Ethical Hacking\nHacked sites push TeamViewer using fake expired certificate alert\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacked sites push TeamViewer using fake expired certificate alertPost Views: 159 \nReading Time: 1 Minute\nThreat actors are compromising Windows IIS servers to add expired certificate notification pages that prompt visitors to download a malicious fake installer.\nInternet Information Services (IIS) is Microsoft Windows web server software included with all Windows versions since Windows 2000, XP, and Server 2003.\n\nThe message shown on the malicious certificate expiration error pages reads: \u201cDetected a potential security risk and has not extended the transition to [sitename]. Updating a security certificate may allow this connection to succeed. NET::ERR_CERT_OUT_OF_DATE.\u201d\n\nAs Malwarebytes Threat Intelligence security researchers observed, the malware installed via a fake update installer [VirusTotal] signed with a Digicert certificate.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/Malicious%20page%20hosted%20on%20hacked%20IIS%20server.png \n<figcaptionMalicious page hosted on hacked IIS server \nSee Also: Complete Offensive Security and Ethical Hacking Course\nThe payload dropped on infected systems is TVRAT\u00a0(aka TVSPY, TeamSpy, TeamViewerENT, or Team Viewer RAT), a malware designed to provides its operators with full remote access to infected hosts.\n\nOnce deployed on infected device, the malware will silently install and launch an instance of the TeamViewer remote control software.\n\nAfter being launched, the TeamViewer server will reach out to a command-and-control (C2) server to let the attackers know they can remotely take complete control of the newly compromised computer.\n\nTVRAT first surfaced in 2013\u00a0when it was delivered via spam campaigns as malicious attachments that tricked targets into enabling Office macros.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/TeamViewerr%20installed%20by%20TVRAT.png \n<figcaptionTeamViewer\u00a0installed by TVRAT IIS servers: vulnerable and targetedWhile the method used by the attackers to compromise IIS servers is not yet known, attackers can use various ways to breach a Windows IIS serverr.\n\nFor instance, exploit code targeting a critical wormable vulnerability found in the HTTP Protocol Stack (HTTP.sys) used by the Windows IIS web server has been publicly available since May.\n\nMicrosoft patched the security flaw (tracked as CVE-2021-31166) during the May Patch Tuesday and said it only impacts Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.\n\nThere hasn\u2019t been any malicious activity abusing this flaw in the wild since then and, as we reported at the time, most potential targets were likely safe from attacks given that home users with the latest Windows 10 versions would\u2019ve updated and companies don\u2019t commonly use the latest Window Server versions.\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges I've built a PoC for CVE-2021-31166 the \"HTTP Protocol Stack Remote Code Execution Vulnerability\": https://t.co/8mqLCByvCp \ud83d\udd25\ud83d\udd25 pic.twitter.com/yzgUs2CQO5\n\n\u2014 Axel Souchet (@0vercl0k) May 16, 2021\nHowever, state-sponsored level threat actors have also leveraged various other exploits to compromise internet-facing IIS servers in the past.\n\nThe most recent example is an advanced persistent threat (APT) group tracked as Praying Mantis or TG1021, which targeted\u00a0Microsoft IIS web servers\u00a0according to an August report from Israeli security firm Sygnia.\n\nIn their attacks, Praying Mantis used a Checkbox Survey RCE Exploit (CVE-2021-27852), a VIEWSTATE Deserialization[...]", "creation_timestamp": "2026-09-01T20:02:21.971905Z"}