Critical Remote Code Execution via Malicious Obfuscated Malw...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://patchstack.com/articles/remote-code-execution-vulnerability-found-in-imunify360/
• Blog Title: Critical: Remote Code Execution via Malicious Obfuscated Malware in Imunify360 AV (AI-bolit)
• Suggested Section: Linux Hardening > Linux Privilege Escalation > Imunify360 Ai-Bolit Deobfuscation RCE (Abusing AV/Scanner Deobfuscators)

🎯 Content Summary

What: Critical remote code execution in Imunify360 AV (Ai‑Bolit) before v32.7.4.0. The PHP deobfuscation engine executes attacker‑controlled function names and payloads extracted from obfuscated malware. No CVE assigned as of November 12, 2025. Estimated impact scope: product is used to protect up to 56M websites. Proposed CVSS v3.1: 8.2 (vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C/CR:H/IR:H/AR:H).

🔧 Technical Details

Abusing deobfuscators that execute recovered functions: Craft obfuscated PHP so that decoded function names resolve to command/code‑execution sinks (e.g., system, exec, shell_exec, eval). Encode names/args (hex, delta/ord, base64+gzinflate, pack()) so the scanner resolves them and then calls them via call_user_func_array(). This turns the scanner into the executor of your payload under its OS privileges.

Function‑sequence (delta/ord) chaining: If a deobfuscation pipeline accepts a list of functions extracted from content and applies them sequentially, ensure your payload controls that list to include at least one sink. Each safe transform (decode/unescape) culminates in a terminal sink that runs commands or PHP code.

Orchestrator mismatch exploitation: Even if a CLI default disables deep deobfuscation, target the production orchestrator/wrapper...

🤖 Agent Actions

I analyzed the Patchstack post and confirmed it documents a new, high-impact technique: abusing AV/scanner deobfuscators that dynamically execute attacker-recovered function names. This is not currently covered in HackTricks. The technique leads to local privilege escalation on Linux when the scanner runs as root (common for Imunify360 Ai‑Bolit), so the most appropriate place is Linux Hardening > Linux Privilege Escalation.

What I added and where:

• Created a new technical page explaining the technique and the concrete Imunify360 Ai‑Bolit case:

  • src/linux-hardening/privilege-escalation/imunify360-ai-bolit-deobfuscation-rce.md
    • Covers: internal root cause (call_user_func_array via Helpers::executeWrapper), two vulnerable flows (eval-hex, delta/ord), orchestrator mismatch (--deobfuscate forced), exploitation steps, PoC, detection/triage, hardening with allow-list, and version status.
    • Includes code snippets and a references section with the Patchstack article and vendor links.

• Linked the new page from the main Linux Privilege Escalation index:

  • src/linux-hardening/privilege-escalation/README.md
    • Inserted a concise section “Imunify360 Ai‑Bolit deobfuscation RCE (abusing AV/scanner deobfuscators)” with a ref link to the new page.

Files changed:

• Created: src/linux-hardening/privilege-escalation/imunify360-ai-bolit-deobfuscation-rce.md
• Modified: src/linux-hardening/privilege-escalation/README.md (added a new short section + internal ref)

Why this placement:

• Similar to other product-specific LPE patterns in this folder (e.g., VMware Tools discovery abuse, Splunk/Logstash pages).
• The core trick is local privilege escalation via a privileged scanner’s deobfuscation pipeline executing attacker-controlled functions.

Notes:

• I kept content concise, technical, and generalized the abuse pattern while providing Ai‑Bolit specifics and PoC.
• References are included at the end of the new page as required.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://patchstack.com/articles/remote-code-execution-vulnerability-found-in-imunify360/

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening > Linux Privilege Escalation > Imunify360 Ai-Bolit Deobfuscation RCE (Abusing AV/Scanner Deobfuscators)".

Repository Maintenance:

• MD Files Formatting: 910 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0