Defence Impairment Olympics

What it is

A Huntress IR case study (incident starting June 7) of a webserver compromise via Adobe ColdFusion flaws — RCE CVE-2023-26360, access-control bug CVE-2023-29298, and deserialization flaw CVE-2023-29300 — where the actor planted steganographic ASPX webshells in an IIS wwwroot\Images directory. The summary names the techniques; this page carries the concrete IoCs and the detection heuristic.

How it works

The webshell is hidden inside an image file: the .aspx renders as a normal picture in an image viewer but contains human-legible JavaScript appended at the end (visible in a text editor). Two hex-encoded strings act as operational beacons — 4F 4E 45 50 49 45 43 45 decodes to ONEPIECE (returned when the shell receives a command) and another string decodes to x_best_911 (returned when it executes one). ONEPIECE appeared in every webshell across the attack, making it a reliable cross-sample IoC.

The key detection: reconnaissance commands like whoami spawning from parent process w3wp.exe (the IIS worker process), with the webshell's directory (wwwroot\Images) in the command line. A legitimate web app serves content; it does not run OS recon, so this parent-child relationship flags a live webshell.

Preconditions / Affected

An internet-facing IIS server running vulnerable Adobe ColdFusion. CVE-2023-29298 defeats the access control that normally blocks external requests to /CFIDE/adminapi/ paths — historical logs showed hits on endpoints including setdsn.cfm, formatjdbcurl.cfm, serverinstance.cfc, and servermonitoring.cfc.

What to do

• Hunt for OS recon processes (e.g. whoami, net) with w3wp.exe as the parent process.
• Grep webshell/response traffic and files for the strings ONEPIECE and x_best_911, and for the hex sequence above.
• Review IIS logs for requests to the /CFIDE/adminapi/_datasource/ and serverinstance.cfc / servermonitoring.cfc endpoints listed on the page.
• Named webshells seen: UA4fp7R.aspx, WRBYTR5750images.aspx — inspect wwwroot\Images (or any image directory) for recently created .aspx files.
• Do not return the server to production until remediation is fully complete and the ColdFusion vulnerabilities are patched. The reason this incident recurred is the operational failure below.

Caveats

Insufficient logging meant Huntress could not confirm the exact initial-access mechanism — the ColdFusion exploitation is inferred from historical log evidence, not directly observed. Timestomped MAC metadata means file timestamps on recovered webshells cannot be trusted for the forensic timeline.

flowchart TD
    A[Webshell detected & deleted] --> B{Remediation completed<br/>before server back online?}
    B -->|No — server restored early| C[Actor re-uploads webshell<br/>Jun 10, Jun 11]
    B -->|Yes| D[Chain broken]
    C --> A

The loop is the whole story: the server was put back online twice before remediation finished, letting the actor return on June 10 and June 11, each time adding evasion (enumeration, then timestomping).