An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies
Overview.
This report summarizes cases in which Suo5 (an HTTP/HTTPS-based tunneling tool) was exploited for pivoting—a technique used to expand the scope of an attack to other systems or networks by passing through a system that has already been compromised—by using compromised web servers as relay points to access internal networks for lateral movement. It also explains the relationship between tunneling (a technology that encapsulates data from one protocol within another protocol for transmission) and port forwarding (a technology that forwards traffic from a specific host and port to another host or port).
Features of Suo5.
Suo5 uses HTTP/HTTPS communication to relay TCP traffic and enables access to internal networks via a SOCKS5 proxy. It supports both full-duplex and half-duplex transmission modes, and allows for the adjustment of HTTP methods, headers, and User-Agent strings. It is designed to operate in Java, PHP, and IIS/.NET environments, as well as in reverse proxy environments with Nginx as the front end.
Confirmed Incident.
- File Deployment Method: By exploiting a file upload vulnerability, the attacker uploaded Suo5.Aspx to a Windows Server-based IIS web server after renaming it to FilesImages.Aspx. The attacker then used this file to establish a communication path and expand the attack surface to internal systems.
- Memory Injection Method: After gaining administrator privileges on a Java-based Jenkins server, the attacker exploited the Script Console, a feature for executing Groovy scripts. Using a Groovy script, the attacker registered the Suo5 functionality in runtime memory as a Servlet and Filter, thereby establishing a Path to internal systems without requiring a separate file.
Key Traces.
In the file-based method, repeated POST requests to FilesImages.Aspx were logged in the web logs. Additionally, during the dynamic compilation process of IIS/ASP.NET, DLL and .Compiled files were created in the Temporary ASP.NET Files directory, allowing analysis of the execution path and Suo5-related activities through these files.
With the memory injection method, no actual files were left on disk, and web logs recorded requests for /login.Php or /login. Java logs revealed the PluginServletFilter chain, a doFilter() call in Script1.Groovy, and an error stack trace related to ClassFormatError.
Detection and Response.
The report recommends not relying solely on specific IOCs but monitoring web requests, server-side behavior, and internal network communications together. Administrators should check for URIs not normally used, repeated POST requests, abnormal User-Agent headers, and access outside of business hours, as well as monitor for the creation and modification of new files in web application paths. Additionally, it is necessary to disable or restrict access to capabilities for executing scripts on the server, such as Groovy, minimize internal network access scope, and implement antivirus and EDR solutions.
