Posts: 715
Threads: 404
Joined: Oct 2023
Reputation:
162
11-02-2023, 07:09 PM
(This post was last modified: 12-16-2023, 06:25 PM by 1van .
Edit Reason: Izmenjen naslov.
)
Prodaje pristup serveru najvise privilegije parlament.gov.rs
Attached Files Image(s)
There is no patch for stupidity - Kevin Mitnick
Posts: 934
Threads: 349
Joined: Sep 2022
Reputation:
306
user ID apache nije baš privilegovan, tipično nema ni shell pristup nego ide na /sbin/nologin ili tako nešto slično
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
A to verovatno znači i da su ostali na sličan način kompromitovani ili će biti:
https://www.esolutions.rs/klijenti/ . Ovaj je npr. sigurno njihov isto:
https://bezbedanbalkan.net/thread-811-po...la#pid2173 .
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Ako odemo na
https://securitytrails.com/list/apex_dom...ent.gov.rs , vidimo da samo par domena kod Mainstream doo (sa slike gore *m.ha.rs):
rik.parlament.gov.rs, probarik.esolutions.rs, 92.249.52.143
test.rik.parlament.gov.rs, rik.ha.rs 92.249.52.143
www.rik.parlament.gov.rs rik.ha.rs 92.249.52.143
api.rik.parlament.gov.rs rikapi.ha.rs 92.249.52.152
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Ima nekih zanimljivih tragova i ovde:
https://platform.socradar.com/app/threat...ent.gov.rs
Infected Device - Accounts for "parlament.gov.rs" were observed for sale on the Russian Market, On May 02, 2023
Code:
{
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Da li je ovo neki razvojni server RIK-a (Republička Izborna Komisija)?
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
12-16-2023, 07:47 PM
(This post was last modified: 12-17-2023, 08:41 PM by 1van .
Edit Reason: Ubačeni detalji.
)
Na SOCRadar za esolutions.rs:
https://platform.socradar.com/app/threat...lutions.rs
Infected Device - Accounts for "esolutions.rs" were observed for sale on the Russian Market, On Jul 03, 2023
Code:
{
mre.esolutions.rs => 79.101.42.217 (lan01-telekom.esolutions.rs, riktest.parlament.gov.rs)
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Izvor:
https://platform.socradar.com/app/threat...ent.gov.rs
Infected Device - Accounts for "parlament.gov.rs" were observed for sale on the Russian Market, On Oct 06, 2023
Code:
{
Infected Device - Accounts for "parlament.gov.rs" were observed for sale on the Russian Market, On Oct 04, 2023
Code:
{
Infected Device - Accounts for "rik.parlament.gov.rs" were observed for sale on the Russian Market, On May 28, 2023
Code:
{
Infected Device - Accounts for "rik.parlament.gov.rs" were observed for sale on the Russian Market, On Jan 19, 2023
Code:
{
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Host lms.rik.parlament.gov.rs ima kombinaciju RedHat/Apache, IP: 212.200.91.146, provajder Telekom,
https://www.shodan.io/host/212.200.91.146
Plus sa SOCRadar:
https://platform.socradar.com/app/threat...ent.gov.rs
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Posts: 1,729
Threads: 665
Joined: Sep 2022
Reputation:
127
Zanimljivi podaci sa
https://securitytrails.com/domain/lms.ri.../history/a .
Malo posle objave incidenta promenjen je IP, prethodni 212.200.91.140 je bio Ubuntu/Apache:
https://www.shodan.io/host/212.200.91.140
“If you think you are too small to make a difference, try sleeping with a mosquito.” - Dalai Lama XIV
Kompromitovan parlament.gov.rs | rik.parlament.gov.rs, probarik.esolutions.rs
