Python Web Server Left Exposed by Phishing Operation, Enabling Lateral Movement
Disable: stop the Python HTTP server, remove directory listing, delete .bash_history, and audit for other exposed services.
Disable: stop the Python HTTP server, remove directory listing, delete .bash_history, and audit for other exposed services.
Summary
An attacker operating a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing enabled. The command used was python3 -m http.server 8080, which remained in the operator's .bash_history. The exposed server allowed directory listing, revealing sensitive files to anyone who accessed the port. The attacker leveraged this foothold to pivot to two additional systems, as reported by the French security firm Lexfo.
The incident demonstrates the risks of leaving development tools running in production environments. No patch is required, but immediate remediation is necessary to close the exposed service. Security teams should disable directory listing and remove the .bash_history entry. Regular audits of running services can prevent similar oversights.
Key changes
- Attacker ran python3 -m http.server 8080 with directory listing enabled
- Command remained in .bash_history
- Exposed server allowed directory listing, revealing sensitive files
- Attacker pivoted to two additional systems
- No patch required but immediate remediation needed
- Security teams should disable directory listing
- Remove .bash_history entry
- Regular audits of running services can prevent similar oversights