An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies

This analysis details the exploitation of Suo5, a tunneling tool that facilitates HTTP/HTTPS-based TCP traffic relay and SOCKS5 proxy access to internal systems. Suo5 supports various transmission modes and environments such as Java, PHP, IIS/.NET, and Nginx. Attackers deploy Suo5 either by exploiting file upload vulnerabilities on IIS servers through renamed ASPX files or by injecting it into memory via Jenkins Script Console using Groovy scripts that register Suo5 as Servlet and Filter components. Key indicators include repeated POST requests in web server logs, presence of DLL files in Temporary ASP.NET Files directories, and PluginServletFilter chains visible in Java logs. Detection strategies focus on monitoring abnormal web request patterns, server-side behaviors, unusual User-Agent headers, unauthorized URI access, and file changes in web application directories. Recommended mitigations include restricting script execution privileges and enforcing network segmentation to limit lateral movement.

Successful exploitation allows attackers to pivot from compromised web servers into internal networks by relaying TCP traffic and establishing SOCKS5 proxy access. This can enable unauthorized access to internal systems and potentially facilitate further lateral movement within the network. The presence of Suo5 on affected servers indicates a compromise that may lead to data exfiltration or additional malicious activities.

No official patch or fix is indicated. Mitigation focuses on detection and prevention measures: monitor web request patterns for repeated POST requests and abnormal User-Agent headers; watch for unauthorized URI access and file modifications in web application directories; restrict script execution capabilities on web servers; and implement network segmentation controls to limit internal network access from compromised hosts.