{"id":22399,"date":"2025-04-04T16:49:45","date_gmt":"2025-04-04T19:49:45","guid":{"rendered":"https:\/\/www.ethicalhacker.com.br\/site\/?p=22399"},"modified":"2025-04-04T16:49:46","modified_gmt":"2025-04-04T19:49:46","slug":"falha-critica-do-ivanti-utilizada-para-implantar-malware","status":"publish","type":"post","link":"https:\/\/www.ethicalhacker.com.br\/site\/2025\/04\/exploits\/falha-critica-do-ivanti-utilizada-para-implantar-malware\/","title":{"rendered":"Falha cr\u00edtica do Ivanti utilizada para implantar malware"},"content":{"rendered":"\n<p class=\"story-title\" style=\"text-align: justify;\"><strong>Falha cr\u00edtica do Ivanti \u00e9 explorada ativamente para implantar malware TRAILBLAZE e BRUSHFIRE<\/strong><\/p>\n<p style=\"text-align: justify;\">A\u00a0falha cr\u00edtica no Ivanti Connect Secure (CVE-2025-22457), um\u00a0<em>stack-based buffer overflow<\/em>\u00a0que permite\u00a0execu\u00e7\u00e3o remota de c\u00f3digo (RCE), est\u00e1 sendo ativamente explorada para distribuir os malwares\u00a0TRAILBLAZE\u00a0e\u00a0BRUSHFIRE. Segundo a Mandiant, o grupo\u00a0UNC5221\u00a0(ligado \u00e0 China) est\u00e1 por tr\u00e1s dos ataques, utilizando t\u00e9cnicas sofisticadas para evadir detec\u00e7\u00e3o e manter persist\u00eancia em sistemas comprometidos.<\/p>\n<p style=\"text-align: justify;\">Neste artigo, apresentaremos\u00a0dois exemplos pr\u00e1ticos de mitiga\u00e7\u00e3o usando Python, ajudando equipes de seguran\u00e7a a\u00a0detectar explora\u00e7\u00f5es\u00a0e\u00a0proteger sistemas vulner\u00e1veis.<\/p>\n<p>\u00a0<\/p>\n<p><strong>1. Detec\u00e7\u00e3o de explora\u00e7\u00e3o ativa (an\u00e1lise de logs em tempo real)<\/strong><\/p>\n<p style=\"text-align: justify;\">Os invasores exploram o\u00a0<strong>CVE-2025-22457<\/strong>\u00a0para injetar comandos maliciosos. Uma forma de mitigar riscos \u00e9\u00a0monitorar logs do Ivanti Connect Secure em busca de padr\u00f5es suspeitos, como tentativas de buffer overflow ou execu\u00e7\u00e3o de comandos shell.<\/p>\n<p>\u00a0<\/p>\n<p><strong>1. Exemplo em Python: Monitoramento de logs<\/strong><\/p>\n<p>\u00a0<\/p>\n<pre><span class=\"token keyword\">def<\/span> <span class=\"token function\">monitor_logs<\/span><span class=\"token punctuation\">(<\/span>log_file<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    suspicious_patterns <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">[<\/span>\n        <span class=\"token string\">r\"buffer overflow\"<\/span><span class=\"token punctuation\">,<\/span>  \n        <span class=\"token string\">r\"\\.\/\\.\\.\/\\.\\.\/\"<\/span><span class=\"token punctuation\">,<\/span>  <span class=\"token comment\"># Tentativa de path traversal  <\/span>\n        <span class=\"token string\">r\"wget|curl|bash -c\"<\/span><span class=\"token punctuation\">,<\/span>  <span class=\"token comment\"># Comandos suspeitos  <\/span>\n        <span class=\"token string\">r\"TRAILBLAZE|BRUSHFIRE|SPAWN\"<\/span>  <span class=\"token comment\"># IOCs conhecidos  <\/span>\n    <span class=\"token punctuation\">]<\/span>\n    \n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">with<\/span> <span class=\"token builtin\">open<\/span><span class=\"token punctuation\">(<\/span>log_file<span class=\"token punctuation\">,<\/span> <span class=\"token string\">'r'<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">as<\/span> f<span class=\"token punctuation\">:<\/span>\n            f<span class=\"token punctuation\">.<\/span>seek<span class=\"token punctuation\">(<\/span><span class=\"token number\">0<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token number\">2<\/span><span class=\"token punctuation\">)<\/span>  <span class=\"token comment\"># Vai para o final do arquivo (log em tempo real)<\/span>\n            <span class=\"token keyword\">while<\/span> <span class=\"token boolean\">True<\/span><span class=\"token punctuation\">:<\/span>\n                line <span class=\"token operator\">=<\/span> f<span class=\"token punctuation\">.<\/span>readline<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\n                <span class=\"token keyword\">if<\/span> line<span class=\"token punctuation\">:<\/span>\n                    <span class=\"token keyword\">for<\/span> pattern <span class=\"token keyword\">in<\/span> suspicious_patterns<span class=\"token punctuation\">:<\/span>\n                        <span class=\"token keyword\">if<\/span> re<span class=\"token punctuation\">.<\/span>search<span class=\"token punctuation\">(<\/span>pattern<span class=\"token punctuation\">,<\/span> line<span class=\"token punctuation\">,<\/span> re<span class=\"token punctuation\">.<\/span>IGNORECASE<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n                            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"[ALERTA] Atividade suspeita detectada: <br \/><\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>line<span class=\"token punctuation\">.<\/span>strip<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n                            <span class=\"token comment\"># Opcional: Enviar alerta via e-mail ou SIEM<\/span>\n                time<span class=\"token punctuation\">.<\/span>sleep<span class=\"token punctuation\">(<\/span><span class=\"token number\">0.1<\/span><span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">except<\/span> FileNotFoundError<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Arquivo de log n\u00e3o encontrado: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>log_file<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Uso: monitorar logs do Ivanti (ajuste o caminho conforme necess\u00e1rio)<\/span>\nmonitor_logs<span class=\"token punctuation\">(<\/span><span class=\"token string\">\"\/var\/log\/ivanti\/connect_secure.log\"<\/span><span class=\"token punctuation\">)<br \/><br \/><br \/><\/span><\/pre>\n<p><strong>Como funciona?<\/strong><\/p>\n<ul>\n<li>\n<p>Detecta\u00a0<strong>padr\u00f5es de explora\u00e7\u00e3o<\/strong>\u00a0(buffer overflow, comandos suspeitos).<\/p>\n<\/li>\n<li>\n<p>Identifica\u00a0<strong>indicadores de comprometimento (IOCs)<\/strong>\u00a0associados ao TRAILBLAZE e BRUSHFIRE.<\/p>\n<\/li>\n<li>\n<p>Pode ser integrado a\u00a0<strong>ferramentas SIEM<\/strong>\u00a0(Splunk, ELK) para an\u00e1lise automatizada.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>2. Verifica\u00e7\u00e3o automatizada de patch (compara\u00e7\u00e3o de vers\u00f5es vulner\u00e1veis)<\/strong><\/p>\n<p style=\"text-align: justify;\">A Ivanti j\u00e1 liberou corre\u00e7\u00f5es (<strong>22.7R2.6 para Connect Secure<\/strong>). Um script Python pode\u00a0verificar automaticamente se o sistema est\u00e1 atualizado, evitando explora\u00e7\u00f5es de\u00a0<em>N-day vulnerabilities<\/em>.<\/p>\n<p>\u00a0<\/p>\n<p><strong>2. Exemplo em Python: Verificador de vers\u00e3o do Ivanti<\/strong><\/p>\n<p>\u00a0<\/p>\n<pre><span class=\"token keyword\">import<\/span> subprocess\n<span class=\"token keyword\">import<\/span> re\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">check_ivanti_version<\/span><span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\n        <span class=\"token comment\"># Comando para verificar a vers\u00e3o do Ivanti (ajuste conforme necess\u00e1rio)<\/span>\n        result <span class=\"token operator\">=<\/span> subprocess<span class=\"token punctuation\">.<\/span>run<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">[<\/span><span class=\"token string\">\"ivanti-version-check\"<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">,<\/span> capture_output<span class=\"token operator\">=<\/span><span class=\"token boolean\">True<\/span><span class=\"token punctuation\">,<\/span> text<span class=\"token operator\">=<\/span><span class=\"token boolean\">True<\/span><span class=\"token punctuation\">)<\/span>\n        version_output <span class=\"token operator\">=<\/span> result<span class=\"token punctuation\">.<\/span>stdout\n        \n        <span class=\"token comment\"># Extrai a vers\u00e3o usando regex<\/span>\n        version_match <span class=\"token operator\">=<\/span> re<span class=\"token punctuation\">.<\/span>search<span class=\"token punctuation\">(<\/span><span class=\"token string\">r\"Ivanti Connect Secure (\\d+\\.\\d+R\\d+\\.\\d+)\"<\/span><span class=\"token punctuation\">,<\/span> version_output<span class=\"token punctuation\">)<\/span>\n        <span class=\"token keyword\">if<\/span> <span class=\"token keyword\">not<\/span> version_match<span class=\"token punctuation\">:<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">\"[ERRO] N\u00e3o foi poss\u00edvel detectar a vers\u00e3o do Ivanti.\"<\/span><span class=\"token punctuation\">)<\/span>\n            <span class=\"token keyword\">return<\/span>\n        \n        current_version <span class=\"token operator\">=<\/span> version_match<span class=\"token punctuation\">.<\/span>group<span class=\"token punctuation\">(<\/span><span class=\"token number\">1<\/span><span class=\"token punctuation\">)<\/span>\n        vulnerable_versions <span class=\"token operator\">=<\/span> <span class=\"token punctuation\">[<\/span><span class=\"token string\">\"22.7R2.5\"<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">\"9.1R18.9\"<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">\"22.7R1.3\"<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">\"22.8R2\"<\/span><span class=\"token punctuation\">]<\/span>\n        \n        <span class=\"token keyword\">if<\/span> current_version <span class=\"token keyword\">in<\/span> vulnerable_versions<span class=\"token punctuation\">:<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"[CR\u00cdTICO] Vers\u00e3o vulner\u00e1vel detectada: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>current_version<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">. <br \/>Atualize para 22.7R2.6 ou superior!\"<\/span><\/span><span class=\"token punctuation\">)<br \/><\/span>\n        <span class=\"token keyword\">else<\/span><span class=\"token punctuation\">:<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"[OK] Vers\u00e3o segura detectada: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>current_version<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n            \n    <span class=\"token keyword\">except<\/span> Exception <span class=\"token keyword\">as<\/span> e<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"[ERRO] Falha ao verificar vers\u00e3o: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>e<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Executa a verifica\u00e7\u00e3o<\/span>\ncheck_ivanti_version<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<br \/><br \/><br \/><\/span><\/pre>\n<p><strong>Como funciona?<\/strong><\/p>\n<ul>\n<li>\n<p><strong>Automatiza a detec\u00e7\u00e3o de vers\u00f5es vulner\u00e1veis<\/strong>\u00a0do Ivanti.<\/p>\n<\/li>\n<li>\n<p><strong>Reduz riscos de explora\u00e7\u00e3o<\/strong>\u00a0de\u00a0<em>N-day vulnerabilities<\/em>\u00a0(como o CVE-2025-22457).<\/p>\n<\/li>\n<li>\n<p>Pode ser\u00a0<strong>agendado no cron<\/strong>\u00a0para verifica\u00e7\u00f5es peri\u00f3dicas.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>Prote\u00e7\u00e3o Proativa Contra Amea\u00e7as<\/strong><\/p>\n<p style=\"text-align: justify;\">A explora\u00e7\u00e3o do\u00a0<strong>CVE-2025-22457<\/strong>\u00a0e a distribui\u00e7\u00e3o dos malwares\u00a0<strong>TRAILBLAZE\/BRUSHFIRE<\/strong>\u00a0mostram que invasores est\u00e3o agindo rapidamente. Com Python, podemos:<\/p>\n<p style=\"text-align: justify;\"><strong>Monitorar logs em tempo real<\/strong>\u00a0para detectar explora\u00e7\u00f5es.<br \/><strong>Verificar automaticamente vers\u00f5es vulner\u00e1veis<\/strong>\u00a0e garantir a aplica\u00e7\u00e3o de patches.<\/p>\n<p>\u00a0<\/p>\n<p><strong>Recomenda\u00e7\u00f5es adicionais:<\/strong><\/p>\n<ul>\n<li>\n<p><strong>Isole sistemas comprometidos<\/strong>\u00a0e fa\u00e7a um\u00a0<em>factory reset<\/em>\u00a0(conforme orienta\u00e7\u00e3o da Ivanti).<\/p>\n<\/li>\n<li>\n<p><strong>Implemente EDR\/XDR<\/strong>\u00a0para detec\u00e7\u00e3o de atividades maliciosas em mem\u00f3ria.<\/p>\n<\/li>\n<li>\n<p><strong>Monitore tr\u00e1fego de sa\u00edda<\/strong>\u00a0para detectar exfiltra\u00e7\u00e3o de dados.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p style=\"text-align: justify;\">A seguran\u00e7a cibern\u00e9tica exige\u00a0resposta r\u00e1pida e automa\u00e7\u00e3o. Python \u00e9 uma ferramenta poderosa para mitigar riscos em cen\u00e1rios como esse.<\/p>\n<p>\u00a0<\/p>\n<p>Fonte e imagens:<a href=\"https:\/\/thehackernews.com\/2025\/04\/critical-ivanti-flaw-actively-exploited.html\" target=\"_blank\" rel=\"noopener\"> https:\/\/thehackernews.com\/2025\/04\/critical-ivanti-flaw-actively-exploited.html<\/a><\/p>\n<pre>\u00a0<\/pre>\n<pre><span class=\"token punctuation\"><br \/><br \/><\/span><\/pre>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Falha cr\u00edtica do Ivanti \u00e9 explorada ativamente para implantar malware TRAILBLAZE e BRUSHFIRE A\u00a0falha cr\u00edtica no Ivanti Connect Secure (CVE-2025-22457), um\u00a0stack-based buffer overflow\u00a0que permite\u00a0execu\u00e7\u00e3o remota de c\u00f3digo (RCE), est\u00e1 sendo ativamente explorada para distribuir os malwares\u00a0TRAILBLAZE\u00a0e\u00a0BRUSHFIRE. Segundo a Mandiant, o grupo\u00a0UNC5221\u00a0(ligado \u00e0 China) est\u00e1 por tr\u00e1s dos ataques, utilizando t\u00e9cnicas sofisticadas para evadir detec\u00e7\u00e3o e [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":22403,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89,100,21,105],"tags":[],"class_list":["post-22399","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-basico","category-diversos","category-exploits","category-noticias"],"_links":{"self":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/comments?post=22399"}],"version-history":[{"count":6,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22399\/revisions"}],"predecessor-version":[{"id":22406,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/22399\/revisions\/22406"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media\/22403"}],"wp:attachment":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media?parent=22399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/categories?post=22399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/tags?post=22399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}