docker镜像openspug/spug-service 挂马希望注意安全

bravelib commented 8 months ago

1、配置文件

version: "3.3"
services:
  db:
    image: mariadb:10.8.2
    container_name: spug-db
    restart: always
    command: --port 3306 --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    volumes:
      - /www/server/spug/mysql:/var/lib/mysql
    environment:
      - MYSQL_DATABASE=spug
      - MYSQL_USER=admin
      - MYSQL_PASSWORD=1
      - MYSQL_ROOT_PASSWORD=1
  spug:
    image: openspug/spug-service
    container_name: spug
    privileged: true
    restart: always
    volumes:
      - /www/server/spug/service:/data/spug
      - /www/server/spug/repos:/data/repos
    ports:
      # 如果80端口被占用可替换为其他端口，例如: - "8000:80"
      - "8080:80"
    environment:
      - MYSQL_DATABASE=spug
      - MYSQL_USER=admin
      - MYSQL_PASSWORD=1
      - MYSQL_HOST=db
      - MYSQL_PORT=3306
    depends_on:
      - db```
2、执行命令
`docker compose up -d`

3、这个镜像开始在宿主机上这个镜像操作牛逼了
![1705308839114](https://github.com/openspug/spug/assets/5875864/0945552b-733d-44fc-9879-59c7609781fe)

```bash
[root@ip-172-31-17-150 spug]# ps -ef |grep supervi
root      2954     1 15  2023 ?        36-21:14:10 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf
root     16344 16320  0  2023 ?        00:24:27 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf
[root@ip-172-31-17-150 spug]# ps -ef |grep 16320
root     16320     1  0  2023 ?        00:07:01 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 02ebadd4d838f7b5f845e6793806cf8d1ffeaeedb7d9820c8b0aba87a7d924a3 -address /run/containerd/containerd.sock
root     16344 16320  0  2023 ?        00:24:27 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf

[root@ip-172-31-17-150 spug]# docker ps
CONTAINER ID   IMAGE                   COMMAND                  CREATED        STATUS        PORTS                                   NAMES
02ebadd4d838   openspug/spug-service   "/entrypoint.sh"         2 months ago   Up 8 weeks    0.0.0.0:8080->80/tcp, :::8080->80/tcp   spug
591849de478b   mariadb:10.8.2          "docker-entrypoint.s…"   2 months ago   Up 2 months   3306/tcp                                spug-db
[root@ip-172-31-17-150 spug]# ps -ef |grep 16344
root     16344 16320  0  2023 ?        00:24:27 /usr/bin/python /usr/bin/supervisord -c /etc/supervisord.conf
root     16559 16344  0  2023 ?        01:56:05 redis-server 127.0.0.1:6379
[root@ip-172-31-17-150 spug]#

然后通过redis高权限漏洞，编写一个可执行脚本拉取下面的sh文件本地执行。

会下载这个文件夺取服务器root权限 http://en2an.top/cleanfda/init.sh 还会下载很多sh文件，这里不想列出来了没意思有图有真相希望大家注意服务器安全呵忒

LOVECHEN commented 8 months ago

miner_url="http://en2an.top/cleanfda/zzh" miner_url_backup="http://45.83.123.29/cleanfda/zzh" miner_size="2654112" sh_url="http://en2an.top/cleanfda/newinit.sh" sh_url_backup="http://45.83.123.29/cleanfda/newinit.sh" chattr_size="8000"

666