blob: 04324308934c25cd6461c4f5751b90a83ba17274 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
# C2 and Exploitation Paths Observed
# PLI-AS (AS51852)
/api/trpc/setup.setup -- tRPC setup endpoint targeting, POST with JSON body, port 3000
/wp-login.php -- WordPress credential enumeration, TLS, Go-http-client/1.1
# HOSTKEY (AS57043)
/ISAPI/Streaming/channels/10101 -- Hikvision camera streaming, RTSP DESCRIBE, Basic auth credential stuffing
/Streaming/Channels/10201 -- Hikvision camera streaming (alternate path)
# KPRONET (AS214940)
/.git/HEAD -- Git repository discovery, secret harvesting
/.git/index -- Git index file enumeration
/.git/config -- Git remote configuration extraction
/.env -- Environment file exfiltration (database creds, API keys, secrets)
# From prior week, still relevant:
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE
/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN
/global-protect/login.esp -- Palo Alto GlobalProtect
/sslvpnLogin.html -- SSL VPN portal enumeration
/guacamole/ -- Apache Guacamole RDP gateway probing
|
