From JBRJ to JUCEC: Exposed Infrastructure Reveals a Broad Brazilian Government Intrusion Campaign

Hunt.io Attack Capture↗ (opens in a new tab) flagged three open directories on a single Malaysian VPS between August 27 and August 29, 2026, on ports 9998, 18080, and 18082.

The evidence confirms active compromise of the Brazilian Federal Biodiversity Research Institute, a reusable Zimbra and Active Directory hunting kit already inside a Brazilian state government network, and a portable Linux kernel privilege-escalation toolkit staged alongside the other attack infrastructure.

Let's walk through what was recovered.

Key Findings

• Hunt.io tracked three open directories at 111.90.145[.]92 (Kuala Lumpur, Malaysia, Shinjiru Technology Sdn Bhd, AS45839) on ports 9998, 18080, and 18082.

• Port 9998 documents a confirmed, multi-stage compromise of the Instituto de Pesquisas Jardim Botânico do Rio de Janeiro (JBRJ), Brazil's federal botanical research institute.

• Port 18082 is a self-contained "z-kit" already deployed inside JUCEC, the Junta Comercial do Estado do Ceará (Ceará's state Board of Trade), a Brazilian state government agency.

• Port 18080 is a clean, multi-language mirror of a public POC for CVE-2026-31431 ("Copy Fail"), a real Linux kernel local privilege escalation bug.

Host Infrastructure

Hunt.io lists 111.90.145[.]92↗ (opens in a new tab) under Shinjiru Technology Sdn Bhd (AS45839), based in Kuala Lumpur, Malaysia, with three open-directory warnings on record: two dated 2026-08-27 and one dated 2026-08-29.

At 111.90.145[.]92:9998↗ (opens in a new tab), an exposed open directory contained 289 files with no subdirectories, totaling approximately 615 KB. Hunt.io recorded the directory on 2026-08-29.

At 111.90.145[.]92:18082↗ (opens in a new tab), the exposed opendir contains 434 files across four subdirectories, totaling approximately 553 KB. The directory was observed on 2026-08-27, indicating a second exposed service on the same infrastructure.

A third instance was accessible at 111.90.145[.]92:18080↗ (opens in a new tab), exposing 87 files across two subdirectories with a total size of approximately 1.83 MB. Hunt.io recorded this directory on 2026-08-27, providing another exposed directory on the same host.

The table below shows the full scope.

Compromise of the Rio de Janeiro Botanical Garden Research Institute (JBRJ)

The scripts in 111.90.145[.]92:9998 share the local path prefix /root/pentest/florariojaneiro/loot/, matching the target subdomain florariojaneiro.jbrj.gov.br↗ (opens in a new tab).

A copy of the target's page source, saved as extra_painel_php, confirms the domain with the tag <meta property="og:url" content="//florariojaneiro.jbrj.gov.br/">.

The evidence carries enough timestamps to reconstruct roughly two days of the intrusion.

Stolen Internal Documentation

The files appear in two naming formats: the original filename and a second version with the internal repository path flattened into the filename (extra_docs_PAINEL_CONSULTAS_SQL_md, corresponding to docs/PAINEL_CONSULTAS_SQL.md referenced in AGENTS.md). The copies are identical and contain JBRJ internal data, including the staging host, .env path, and SQL audit panel source. This indicates the files came from the compromised host.

The Exploitation Chain: Two Bugs, One Portal

The open directory contains 77 ipt_*.py scripts driving an attack chain against ipt.jbrj.gov.br, JBRJ's GBIF Integrated Publishing Toolkit (IPT) instance. The scripts target two separate vulnerabilities, which the operator's tooling labels as CVE-2026-71880 and CVE-2026-71878.

The scripts can be summarized as follows:

• ipt_check_ssti.py and ipt_preview_ssti.py locate the injection point.

• ipt_ssti.py, labeled internally as CVE-2026-71880, exploits a FreeMarker ?interpret server-side template injection through IPT resource metadata.

  

• ipt_ssti_500.py, ipt_ssti_ctrl.py, ipt_ssti_inc.py, ipt_ssti_ls.py, ipt_ssti_sq.py, and ipt_ssti_rce.py iterate on that SSTI, capturing error bodies, testing file reads, and eventually publishing a private IPT resource whose description field carries the payload.

• ipt_cve71878.py and ipt_cve_interno.py target a second, separately labeled bug, CVE-2026-71878, by posting to IPT's setupDefaultAdministrator.do endpoint to create an extra administrator account under the email ipt.ops.2026@jbrj.org and a password redacted here as Jb_REDACTED_.

  

• ipt_race.py runs the CVE-2026-71878 exploit as a race condition, flooding IPT's origin-validation threads so isBaseURLValid() times out and the check can be bypassed.

• ipt_sql_source.py, ipt_fileurl.py, ipt_fileurl_mp.py, ipt_next.py, ipt_analyze.py, ipt_commit.py, ipt_cte_write.py, and ipt_dblink.py build out IPT's own JDBC "SQL source" and DuckDB integration features into a file-read and command-execution primitive, including forcing committed writes via dblink_exec so they survive IPT's normal transaction rollback.

• ipt_duck_files.py, ipt_duck_sqli.py, ipt_duckdb.py, and ipt_duckdb2.py push that further, using DuckDB's read_blob, read_csv, and COPY functions to read arbitrary host files and write new ones through IPT's own database layer.

From SSTI to a JSP Web Shell and Confirmed Code Execution

After gaining file-write access, the attacker used 14 scripts (ipt_jsp_fauna.py through ipt_jsp_fauna13.py) to develop and update a JSP web shell. The shell was written through IPT’s DuckDB file-write function rather than a separate upload flaw, while other scripts handled the remaining post-exploitation steps:

ipt_tomcat_rce.py, ipt_tomcat_shell.py, and ipt_tomcat_pivot.py drive the same shell to enumerate the Tomcat service, write a cleaner command-execution JSP, and pivot toward other internal hosts. ipt_persist.py plants a backup copy on the container's EFS mount, with an inline comment telling the tool not to touch /srv/ipt/config, and ipt_restore.py re-drops the JSP if a container rebuild wipes it.

The directory contains 29 raw output files, all prefixed with rce_, capturing the output returned by the executed commands.

Two Stolen Sets of AWS Temporary Credentials

extract_imds.py, ipt_imds_role.py, ipt_imds_ssti.py, and ipt_imds_url.py abuse the IPT/Tomcat foothold to reach the EC2 Instance Metadata Service. The operator recovered two sets of temporary AWS credentials from the instance metadata service, associated with two IAM roles.:

ipt_aws_enum.py and ipt_aws_enum2.py use the boto3 SDK with the stolen role keys to enumerate AWS services region by region.

ipt_aws_logs.py uses the same credentials to query CloudWatch log groups, streams, and events, likely seeking additional secrets or evidence of the intrusion in JBRJ's logging infrastructure.

rce_imds_list.txt and rce_imds_net.txt capture the IAM role name and the container's internal network details that enabled the IMDS pivot.

Credential Harvesting Across JBRJ's Application Stack

With access to IPT, the operator started targeting other systems. access.txt, a notes file kept by the operator, records the accounts they tried, the passwords that worked, and brief notes about what each account could access. The full scope is easier to understand in one table before looking at how each application was accessed:

JABOT and jabotimage: A Ten-Script Account-Takeover Pipeline

The ten scripts form a step-by-step workflow for JABOT and its image system. The docstrings in each script describe the changes made at each stage, making it possible to follow the process from one script to the next:

The sequence of unlocking accounts, cracking a reset token, setting a new password for a real staff account, and then moving into file inclusion and upload-based RCE testing shows a deliberate, staged compromise.

Fauna do Brasil: A Second, Self-Built Database Foothold

The credentials in access.txt provided access beyond the five bcrypt-hashed application accounts. The notes also exposed database credentials, privileged accounts, API credentials, and reused secrets across multiple systems:

• A Java PBE-protected JDBC connection pool was listed under the internal label "Carla Maria Luise". The operator manually decrypted it and recovered plaintext credentials for florarj and ipt, both associated with the Jardim database.

• The credential fauna/!f_REDACTED_ provided access to a separate PostgreSQL environment. The environment was PostgreSQL 15.1 on Ubuntu and included the fauna and fauna_ca databases.

• The PostgreSQL environment exposed supabase_admin and postgres superuser accounts.

• The operator wrote directly to fauna_ca.op_c_a and created an account named iptops26 with password Op_REDACTED_ and profile level 8 (GerenteDeUsuarios, or user manager).

• The same iptops26 credentials were also added to PostgREST's authentication table, providing an API-level identity in addition to the database record.

• The notes contained credentials for an existing librarian account, rforzza / fl_REDACTED_, along with other staff accounts protected by weak passwords.

• Other exposed secrets included a GBIF.BR organization token and a DataCite API key used for DOI minting for JBRJ datasets.

• The GBIF.BR organization token was also reused as the password for the CKAN centralit account, linking credentials across two otherwise separate systems.

Note: fauna_crack.py runs the hashes against rockyou.txt and a separate fauna_wl.txt wordlist. The custom list includes the target's name as well as plaintext passwords that had already been recovered from IPT and Jardim. This shows that credentials found in one part of the environment were being reused to test access to another.

CKAN, CITSmart, and the Downstream RDS Instance

ipt_pg_dump.py, ipt_pg_grants.py, ipt_pg_plain.py, ipt_pg_plain2.py, and ipt_pg_users.py query JBRJ's PostgreSQL instance, identified in the code comments as JBRJ RDS instance, through IPT's SQL source feature. The scripts specifically look for short, plaintext-recoverable passwords in the Jardim application schema.

ckan_rds.txt documents a separate PostgreSQL finding involving an internally labeled CVE-2026-42031↗ (opens in a new tab) ts_rewrite issue. The issue was confirmed against the ckan_default role, which was not a superuser, on RDS host running PostgreSQL 16.13.

• The flaw provided a CONNECT path to multiple databases.

• The affected databases covered several parts of the institute's infrastructure, including the data catalog, GIS, and IT service management systems.

• The operator could also enumerate admin database roles on the instance and named staff accounts.

• ckan_users.json contains a dump of the CKAN user table, including account IDs, creation dates, sysadmin flags, and named staff and partner-organization accounts.

• The dump also includes accounts belonging to JBRJ IT staff that were marked with the sysadmin flag.

Note: reuse_flora.py and reuse_gbif_pw.py try passwords recovered elsewhere in the campaign against CITSmart, CKAN, and Matomo. spray_edalcin.py and spray_plain.py test a small set of weak, organization-related passwords against the same applications. The end of access.txt also contains persistence notes, including a hidden loot directory at /srv/ipt/logs/.dw/ and a note that daily access is handled through ipt_sh.py "id".

Kernel Exploit Staging on the Compromised Container

iouring_probe.c is a small, self-contained io_uring_setup() syscall probe used to check whether the target kernel exposes the io_uring interface before attempting an io_uring-based local privilege escalation. ipt_jsp_iouring.py runs the same check remotely through the JSP shell, while ipt_jsp_lpe_cves.py tests preconditions for recent Linux LPE CVEs, as described in its own docstring.

Note: The scripts show that the operator was testing ways to move beyond the low-privileged tomcat account.

A Zimbra, Active Directory, and Helpdesk Hunting Kit Live Inside Junta Comercial do Estado do Ceará

The open directory at 111.90.145[.]92:18082 contains 321 files, most of which are small PHP, PowerShell, Python, C#, or compiled JAR utilities.

The files appear to have been deployed for activity against JUCEC, the Junta Comercial do Estado do Ceará (Ceará's state Board of Trade), and its e-Simples business registration portal.

The servers below were identified from IP addresses that recur across dozens of scripts:

A Shared Webshell Key Ties the Kit Together

I found the same hardcoded key, Hx_Redacted_, in 34 different webshells across the directory, spanning PHP, ASP.NET, JSP, Python, and PowerShell. The analysis shows that the webshells support directory listing, file reading, and command execution, as shown in the table below.

Zimbra Mail Server: SOAP Reconnaissance, Authentication Bypass Testing, and SMTP Spraying

The port 18082 directory contains more than 50 scripts and support files related to Zimbra. The main findings are:

• Access paths: The scripts cover unauthenticated admin SOAP reconnaissance on port 7071, account-level SOAP authentication, SMTP on ports 25 and 587, and direct SSH access.

• Credential spraying: nspray.ps1 tests ten credential pairs against four named JUCEC staff members across jucec.ce.gov.br and esimples.ce.gov.br.

• SMTP testing: smtptryp.ps1 tests another ten passwords against a single mailbox.

• Mailbox access: zmail.py successfully logs into glpi@esimples.ce.gov.br, obtains a live Zimbra session token, and uses it to search the account's inbox. This is the only confirmed mailbox compromise found in the directory.

• Credential reuse: The same credentials are later tested against Gmail IMAP.

• Internal relay: The already-compromised host 10.25.x.x is used to relay SOAP traffic, making the requests appear to originate from an internal system.

• File deletion: zrm.ps1 deletes eighteen named files after the activity is complete.

Active Directory: Working Domain Credentials and NTDS Extraction

Thirteen scripts handled the initial directory enumeration using the reused _redacted_.sync credential. They connected to the domain controller and enumerated the environment before elevated access was available. Two scripts, next.ps1 and smb2.ps1, later used the recovered _redacted_\Administrator credential to access the domain's administrative shares.

• Initial enumeration: Thirteen scripts used _redacted_.sync to query the domain controller and enumerate the directory.

• Administrator access: next.ps1 and smb2.ps1 used the recovered _redacted_\Administrator credential with full domain administrator privileges.

• Administrative shares: Both scripts accessed the C$ and ADMIN$ shares directly.

• Lateral movement: The activity then included SSH-based lateral movement.

• Shadow copy access: A Volume Shadow Copy was triggered remotely through WMI.

• Credential database extraction: The scripts accessed ntds.dit, SYSTEM, and SECURITY from the shadow-copy device path, allowing the domain's password hashes to be extracted without accessing the live database files.

File Share Hunting and Data Exfiltration

A large group of PowerShell scripts systematically walks JUCEC's internal file shares looking for backups and sensitive documents.

The activity ranges from broad share enumeration to targeted collection of specific files and directories.

• Backup and file-share discovery: huntbkp.ps1, huntc.ps1, huntex.ps1, huntftp.ps1, huntip.ps1, huntip2.ps1, huntn.ps1, huntdir.ps1, huntz.ps1, huntti.ps1, bkp.ps1, bkp2.ps1, bkp3.ps1, bkp4.ps1, and bkp5.ps1 enumerate JUCEC's internal shares and backup infrastructure, including "Centro de Eventos" folder, and the D:\JUCEC share.

• Targeted file collection: huntcs.ps1, ticopy.ps1, ticopy2.ps1, tifind.ps1, and tifind2.ps1 search for and copy PGFN_Acessos.csv from the Núcleo de Tecnologia directory.

• Directory archiving: sczip.ps1 and scbox.ps1 locate and archive the Núcleo de Tecnologia directory through _redacted_.local.

• Zimbra file collection: getxlsx.ps1 copies spreadsheet files containing "Zimbra" in their filenames from a mailing-list share.

• Local backup discovery: readbkp.ps1 inventories the C:\Backup Sistemas directory on the drop host.

• Administrator profile discovery: scuser.ps1 enumerates the local Administrator's Desktop, Documents, and Downloads folders.

• File and software discovery: arqfind.ps1 searches for cached share listings, while findbr.ps1 checks for Chrome installation paths.

• Host reconnaissance: nutec.ps1 checks host liveness, and svcs.ps1 enumerates listening TCP ports and running services on the drop host.

GLPI Helpdesk: Database Dump and Persistence Through a Scheduled Task

gsql.py, gsenha.py, gtkt.py, gldump.py, and gldump.sh all authenticate to a local MySQL instance against database glpidb, using the password redacted as ju_REDACTED_, dumping mail collector configuration (including any stored SMTP credentials), ticket follow-up content, and searching ticket bodies for keyword matches.

cron.txt is a crontab entry that copies a cached plugin metadata file over the top of GLPI's own setup script every 25 minutes, a lightweight file-based persistence mechanism, and gfin.py/gfix.py install and verify that crontab entry.

Additionally, gclean.py is the corresponding cleanup script, removing leftover Python files from /tmp and running a final gfix.py pass. gpersist.py separately drops a mini.php-style webshell for GLPI-adjacent persistence, and gsc_run.py is a thin command-runner wrapper against that shell.

osTicket: Configuration Hunting and CAPTCHA Harvesting

huntost.ps1 searches JUCEC's web roots for osTicket configuration strings, effectively bridging the GLPI and osTicket hunting efforts described below.

ostfind.php, ostfind2.php, and ostgrep.php scan internal IP ranges and JUCEC web roots for osTicket's ost-config.php file and its secret salt.

ostbak.ps1 retrieves backup copies of the same configuration file over HTTP. ostm.php and ostmysql.php then test a short list of MySQL root and osTicket credentials against port 3306 on the identified host, including several root password combinations.

ostopen.php, along with ostbody.txt and scpbody.txt, submits or replays pre-built osTicket support-ticket requests, including one populated with the real name and email address of a JUCEC staff member (_redacted_@jucec.ce.gov.br). This appears to test whether the ticketing form could be abused.

ost_captcha.png and ost_captcha_live.png contain CAPTCHA images collected from the login form. osthi.php is a one-line PHP version fingerprinting probe, while ostlink.ps1 and ostscan.ps1 perform additional connectivity and link-discovery checks against the same host.

Openfire Chat Server Compromise

A large family targets Openfire and the path from unauthenticated access to persistent tooling runs through five stages:

jrun.ps1 uses a captured Openfire session cookie (JSESSIONID plus CSRF token) to run authenticated commands directly, including reading the server's XMPP and Kerberos keytabs.

Microsoft SQL Server: JUCEC's Internal EasyCapture Application

sql2.ps1, sqldump.ps1, and sqlq.ps1 connect directly to a Microsoft SQL Server instance using the connection string _REDACTED_, querying both the named application database and the server's own master database.

sqmore.php/sqmorego.ps1 and sqscan.php/sqrun.ps1 do broader port scanning of nearby internal hosts for the same class of service.

sqpwn.php/sqpwngo.ps1, sqweb.php/sqgo.ps1, sqwm.php, sqwm2.php/sqwmgo.ps1, sqint.php/sqintgo.ps1, sqauth.php/sqau.ps1, sq10000.php/sq10kgo.ps1, and sqsmb.php/sqsmb.ps1 form a related family of SOAP and web-service probes and SMB session tests, reusing the same _redacted_\google.sync credential over SMB.

mc.py and mcget.py test an exposed Memcached instance, capable of leaking whatever keys the operator could guess or brute-force from that cache.

Internal Drop Server Management and Cleanup

Another internal host appears to function as an operator-controlled internal staging and relay server within JUCEC's network. The tooling stored on the host can be grouped into the following activities:

1. Application discovery and ScriptCase enumeration

   • scapps.ps1 and scfast.ps1 enumerate five application directories: alan, auxiliar, dados, jaux, and mac.
   • sclook.ps1 checks whether a NetMake ScriptCase development environment is installed.
   • findcfg.php, cfg2.php, cfg3.php, cfg4.php, and cfg5.php locate and extract JUCEC's internal ScriptCase configuration files, including a production database configuration and an SQLite database containing ScriptCase developer credentials.
   • dec.php and decsc.php decrypt ScriptCase's proprietary configuration format to recover plaintext configuration values.

2. Command execution and tool staging

   • scmysql.ps1, scof.py, scget.py, scget2.py, scinv.py, scw.py, scw2.py, scfin.py, scsvc.py, and sc.py act as lightweight command-execution wrappers.
   • soap.zip, usoap.zip, usoap2.zip, and usoap3.zip, together with their corresponding PowerShell launchers, provide additional compressed toolsets for deployment.

3. Webshells and additional payload delivery

   • d.z is a raw binary blob containing an embedded .php file signature.
   • da.php is a heavily obfuscated, multilayer-encoded PHP loader that uses base64 encoding and custom string transformations before dynamically constructing an eval call.
   • Its behavior is consistent with a generic obfuscated backdoor rather than a payload specific to Zimbra or JUCEC.
   • scclean.py, scdec.ps1, and scdrop.ps1 support staged-file cleanup and decryption activities on the host.

4. Browser and session-data collection

   • chacc.php searches Chrome's saved-preferences data for stored JUCEC-related session information.
   • chmail.ps1 and chmail2.ps1 interact directly with the Chrome process using native Windows API calls through inline C# code.
   • chtask.ps1 and runchrome.bat terminate and relaunch Chrome under a specified user profile, apparently to obtain a fresh and unlocked browser session.

5. Google Cloud Directory Sync credential decryption

   • dec.bat and dec2.bat invoke Google Cloud Directory Sync's encrypt-util.exe to decrypt stored configuration secrets, including an operator-held encrypted value represented here as s5_REDACTED_.
   • decgcds.ps1 and decoauth.ps1 independently implement the same AES decryption process in PowerShell and operate on captured encrypted values labeled ldap and def.
   • jar.bat and jarls.ps1 inspect GCDS's DirSync.jar, searching for cryptographic routines using strings such as Encrypt, Crypto, Cipher, PBE, and Generate. This appears to support the subsequent decryption attempts.

6. Captured Google authentication material

   • ga_ac2dm.txt, ga_ah.txt, ga_gm.txt, and ga_oauthmail.txt contain captured Google ClientLogin requests associated with _redacted_@jucec.ce.gov.br.
   • The requests contain a password in URL-encoded form, represented here as ju_REDACTED_, and request device-sync, mail, and OAuth-related tokens.
   • gauth.txt is another variant of the same authentication request and identifies its source as Jucec-gcds-1.0.

7. Direct Gmail session access through Chrome DevTools

   • gdump.cs, gdump3.cs, and gdump4.cs are successive versions of a C# utility that connects to Chrome's local DevTools Protocol endpoint at 127.0.0.1:9222.
   • The utilities locate an already authenticated Gmail tab and interact with the session through the browser debugging interface, allowing mail to be accessed without directly supplying the account password.
   • glogin.cs performs a related function by automating Gmail login through the same debugging interface.
   • These tools require Chrome to be running with remote debugging enabled and therefore appear intended for use on a previously accessed workstation.

8. Scheduled-task persistence

   • mk.bat, sc-mk.bat, persist.ps1, persist-sc.ps1, and persist-sc2.ps1 create or maintain a Scheduled Task named WaaSHealthCheck.
   • The task is designed to resemble a legitimate Windows Update health-check task.
   • It periodically copies a disguised PHP payload, display.dll.php, from C:\ProgramData\Microsoft\Windows\Caches into the web root under names such as hx.php or cache.php.
   • This provides a persistence mechanism independent of the webshells already deployed.

9. Persistence monitoring and secondary payload deployment

   • sc-q.php/sc-q.ps1 and sc-task.php query the status of the WaaSHealthCheck task and identify the currently logged-in user.
   • task1.ps1 extends the same copy operation to a second destination disguised as an oficios/imagens document or image directory.
   • runc2.ps1 through runc5.ps1, runcfg.ps1, rungrep.ps1, runls.ps1, and runsoap.bat provide simple copy-and-execute functionality for staging PHP and SOAP payloads on the internal server.

10. Network probing and auxiliary utilities

    • probe.py provides generic connectivity testing.
    • sites.py checks URL responses.
    • listen.py implements a raw TCP listener on port 18099.
    • untar.py retrieves and extracts a remote archive from http://x.x.x.x/mbox.tgz.

11. Cleanup and removal

    • rmd.ps1 and rmfin.ps1 provide final cleanup functionality.
    • These scripts remove the operator's staging directory and specified residual files from the compromised web root.

Target Scope Beyond JUCEC: Eighteen Rio Grande do Norte Municipal Councils

vfy.sh runs the same Hx_redacted_ webshell key against eighteen municipal government domains in the state of Rio Grande do Norte.

• cmielmomarinho.rn.gov.br
• camaramunicipaldeextremoz.rn.gov.br
• japi.rn.gov.br
• messiastargino.rn.gov.br
• piparosepasseios.com.br
• saaeextremoz.com.br
• camarabomjesus.rn.gov.br
• camaramunicipaldearez.rn.gov.br
• camarasjc.rn.gov.br
• cmcaicaradonorte.rn.gov.br
• cmmessiastargino.rn.gov.br
• cmparazinho.rn.gov.br
• cmsaobentodonorte.rn.gov.br
• cmserracaiada.rn.gov.br
• cmserranegradonorte.rn.gov.br
• caraubas.rn.leg.br
• serradesaobento.rn.leg.br
• taipu.rn.leg.br

Port 18080: A Kernel Privilege Escalation Dropper Ready to Deploy

The smallest directory contains a faithful mirror of the public CVE-2026-31431 (“Copy Fail”) Linux kernel exploit.

The vulnerability affects the kernel’s algif_aead interface and can allow an unprivileged user to modify file contents in the page cache by exploiting a crafted failed decryption request. This can be abused to alter files such as setuid-root binaries or /etc/passwd, enabling local privilege escalation.

The key files in the exposed directory are listed below:

exploit.c is the primary dropper. It walks the embedded payload four bytes at a time, patches each window into the target's page cache, then executes it:

1for (off_t off = 0; (size_t)off < len; off += 4) {
2    unsigned char window[4] = { 0, 0, 0, 0 };
3    size_t take = (len - (size_t)off >= 4) ? 4 : len - (size_t)off;
4    memcpy(window, PAYLOAD + off, take);
5    if (patch_chunk(file_fd, off, window) < 0) { ... }
6}
7execl("/bin/sh", "sh", "-c", cmd, (char *)NULL);

exploit-passwd.c takes a different approach from variants that target setuid binaries. Instead, it manipulates the cached contents of /etc/passwd so that the current user’s account is temporarily associated with a privileged UID, then invokes su. Authentication still relies on /etc/shadow, but the altered account information can cause the subsequent privilege transition to behave incorrectly. The approach does not require an embedded payload and relies on the fact that /etc/passwd is normally readable by unprivileged users.

payload.c is the payload produced by exploit.c. It is a minimal static program that uses the vendored nolibc implementation, so it does not depend on the system’s C library at runtime. vulnerable.c is a non-destructive checker that determines whether the target is potentially exploitable without actually performing the page-cache corruption.

Operator Assessment

Portuguese-language documentation, variable names, and comments run through both the port 9998 and port 18082 directories, and every named target across both, JUCEC, e-Simples, JBRJ, and the eighteen Rio Grande do Norte municipalities, is Brazilian. The recovered tooling uses Brazilian Portuguese terminology and references multiple Brazilian public-sector and federal research targets.

Mitigations

• Patch internet-facing applications and prioritize critical vulnerabilities.
• Remove hardcoded secrets from source code, scripts, and configuration files.
• Prevent credential reuse and rotate compromised credentials immediately.
• Apply least privilege to privileged and service accounts.
• Secure Active Directory and monitor unusual SMB, LDAP, WMI, and credential-dumping activity.
• Harden cloud metadata access and enforce least-privilege IAM permissions.
• Monitor for webshells and unexpected changes to web-facing files.
• Protect browser sessions and restrict remote debugging interfaces.
• Secure internal staging servers with proper network access controls.
• Harden email platforms with MFA and protection against password spraying.
• Monitor persistence mechanisms such as scheduled tasks, cron jobs, SSH keys, and unauthorized services.
• Segment critical systems to limit lateral movement.
• Rotate credentials after compromise, including application, database, domain, cloud, SSH, and session credentials.
• Hunt for IOCs and attacker behavior across endpoint, network, identity, cloud, and application telemetry.

Conclusion

The exposed directories examined in this investigation provide a detailed view into a multi-stage intrusion operation targeting Brazilian public-sector and research environments.

The evidence includes a confirmed compromise of JBRJ's IPT environment, subsequent access to application and database infrastructure, harvesting of AWS temporary credentials, credential reuse across multiple services, webshell deployment, and preparation for privilege escalation.

A separate directory contained an extensive toolkit targeting JUCEC, including Zimbra, Active Directory, Openfire, GLPI, osTicket, SQL Server, internal file shares, and browser sessions.

The same infrastructure also contained a staged Linux kernel privilege-escalation toolkit and tooling referencing additional Brazilian government targets.

Several recurring weaknesses stand out: exposed services, insufficiently protected credentials, credential reuse, excessive privileges, weak segmentation, and inadequate monitoring of persistence and lateral-movement activity. The investigation also demonstrates how an initial application compromise can become significantly more serious when cloud credentials, database access, administrative accounts, and internal network connectivity are subsequently exposed.

Organizations operating internet-facing applications should therefore treat application security, identity protection, cloud credential isolation, network segmentation, and continuous threat hunting as interconnected controls rather than separate security functions.

MITRE ATT&CK Mapping

Indicators of Compromise

Network infrastructure

Files, tools, and identifiers