Thread by @malmoeb

1/ Playing around with #manjusaka, as reported by @TalosSecurity [1].

Following are some insights and potential #ThreatHuning tips and ideas. 🧵

#CyberSecurity @b3ard3dav3ng3r

2/ After starting the ELF binary (a reduced version is publicly available on GitHub [2]), the login credentials are printed out (username: manjusaka, PW: b3e..), and the port (3200) on which the panel is accessible.

3/ The password is different for each instance of manjusaka.

This mechanism prevents the use of default passwords in case scanners would find the login panel.

4/ However, if the IP address from the panel is visited without specifying the port, the instance automatically redirects to microsoft.com - another protection against automated scanner.

5/ But beware, it's trivial to change these default values via command line parameters on startup.

6/ After logging in to the panel, we can create a new project.

7/ The implants of the different projects uses a different URL to connect to the C2 server.

The routing ID "c15.." is used within the URL from the GET request. The pooling frequency is super high - in the free version the latency cannot be adjusted.

8/ The URL "/general/favicon.png" was mentioned in the Talos blog [1], but this URL (/general/) is only used if no project is defined.

9/ We can create implants for Windows and Linux.

The encryption key does not matter in this version because an implant with an encryption key and one without one have identical hash sums.

10/ Whereby already various AV manufacturers recognize the implant from this version.

11/ In the screenshot below, two systems have reported to our C2 instance (a Windows and a Linux machine).

Only one infected host can be selected at a time in the workbench because the selection unlocks further possibilities to interact with the infected machine.

12/ After selecting an infected host, among other things, a live terminal can be opened. Direct commands can be issued on the host via this terminal.

Limitedly, the shell also works for Windows systems, but passget did not work on either platform.

13/ The file browser works on Windows as it does on Linux.

14/ We can also upload files directly to the infected machines.

The freely available version of manjusaka has no persistence mechanism (neither on Win nor on Linux), but with the upload functionality, we could load a binary to the different startup locations.

15/ manjusaka creates a SQLite database named nps.db at the first startup:

$ file nps.db
nps.db: SQLite 3.x database, last written using SQLite version 3036000

16/ This database contains information about the infected hosts and could be interesting to evaluate after the seizure of a C2 instance by LEA.

17/ Last but not least, the Shodan favicon search from the panel currently returns no hits (http.favicon.hash:cbfb102cebf1f72f195697293f138128).

18/ As Talos mentions in the blog post, this freely available version is probably only a teaser of the original software but already potent enough to perform actual attacks.

[1] blog.talosintelligence.com/2022/08/manjus…
[2] github.com/YDHCUI/manjusa…