Access WebShell - GET /human2.aspx - on port 443.

Post data - /machine2.aspx - on port 80.

Upload file - PUT /api/v1/folders//files uploadType=resumable&fileId= - on port 443.

Prepare session - POST /guestaccess.aspx - on port 443.

Perform SQL injection - POST /moveitisapi/moveitisapi.dll - on port 443.

Post data - POST /machine2.aspx on port 80.

Upload file - POST /api/v1/folders//files uploadType=resumable - on port 443.

Check folder - GET /api/v1/folders - on port 443.

Check token - POST /api/v1/token - on port 443.

Health check - POST /guestaccess.aspx - on port 443.

The MOVEit vulnerability allows adversaries to implant a remote web shell on the victim's machine.Īs shown in the diagram above, an adversary performs the following steps to implant a malicious webshell. MOVEit is typically used for file transfer operations by organizations and has a web application that supports different types of databases like MySQL, Microsoft SQL Server, and Azure SQL.

This vulnerability, upon successful exploitation, could allow an unauthenticated attacker to gain access to the MOVEit Transfer's database and allow them to infer information about the internals of the database and alter or delete their elements. On 3, Progress Software disclosed a critical vulnerability CVE-2023-34362 in the MOVEit application.

The software has been heavily used in the healthcare industry as well as thousands of IT departments in financial services and government sectors. The MOVEit encrypts files and uses secure File Transfer Protocols to transfer data with automation, analytics and failover options. MOVEit is a managed file transfer software produced by Progress(formerly Ipswitch).

Download ipswitch ws_ftp pro