title: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
status: test
description: Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877
references:
    - https://seclists.org/fulldisclosure/2023/Jan/1
    - https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-20
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-44877
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains|all:
            - '/login/index.php'
            - 'login='
        cs-uri-query|contains:
            # TOD: Include other commonly used reverse shells. Examples: https://www.revshells.com/
            - 'login=$('
            # Common keywords related to python reverse shells
            - 'base64'
            - 'subprocess'
            - 'socket'
            - '${IFS}' # Usage of the input field separator to avoid writing spaces
            # B64 Encoded "python" with different offsets
            - 'cHl0aG9u'
            - 'B5dGhvb'
            - 'weXRob2'
    condition: selection
falsepositives:
    - Web vulnerability scanners
level: high