{"uuid": "1b37f8e3-c561-4754-9ead-24a3b8573bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/112353", "content": "Black Hat Ethical Hacking\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer Network\n\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA sophisticated and rapidly spreading malware, known as P2PInfect, is currently on the prowl, targeting vulnerable instances of SSH and Redis open-source data store. This malicious worm, developed in Rust, has versions compatible with both Windows and Linux, making it a cross-platform menace. P2PInfect methods of gaining footholdP2PInfect leverages two main methods to gain a foothold on its targets. Firstly, it exploits a critical vulnerability, CVE-2022-0543, which was disclosed and patched last year. This vulnerability is specific to Debian and allows remote code execution with a severity score of 10 out of 10. Secondly, the malware capitalizes on Redis\u2019 replication feature, which enables the creation of exact replicas of the main database for high availability and failover scenarios.\n\nSecurity researchers from Palo Alto Networks\u2019 Unit 42 initially documented P2PInfect and found it exploiting the CVE-2022-0543 vulnerability. Once a vulnerable Redis instance is compromised, P2PInfect downloads OS-specific scripts and malicious binaries, incorporating the server into its list of infected systems. The malware then establishes a peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nA sample of P2PInfect analyzed by Cado Security also revealed its compatibility with both Windows (PE binaries) and Linux (ELF binaries). The malware demonstrates a level of sophistication that poses a serious challenge for security experts.\n\nhttps://www.bleepstatic.com/images/news/u/1100723/P2PInfect_Redis_replica.jpg P2PInfect taking control via Redis replication feature\nsource: Cado Security\n\nAfter execution, P2PInfect\u2019s primary payload, an ELF binary written in a combination of C and Rust, updates the SSH configuration on the host, allowing the attacker to connect via SSH and enable password authentication. The malware further takes steps to hinder incident responders and evade detection by renaming critical binaries like wget and curl. Additionally, it installs necessary utilities, such as iptables and awk, to execute its actions.\n\nCado Security researchers discovered that P2PInfect treats each compromised Redis server as a node, effectively transforming the network into a decentralized, peer-to-peer botnet. This approach eliminates the need for a centralized command and control (C2) server, making it more resilient and difficult to track.\n\nCommunication between the peer-to-peer network occurs through a simple HTTP server over random ports, while botnet coordination is conducted over HTTPS using a hardcoded certificate. The campaign appears to have started on or after June 29th, as indicated by the certificate.\nTrending: The Difference between Internal and External Pentesting Trending: Offensive Security Tool: Nucleimonst3r P2PInfect\u2019s method of finding vulnerable servers involves scanning for exposed SSH and Redis instances, using a list of passwords for brute-force attempts on weakly protected hosts. Researchers estimate that there are over 307,000 Redis instances reachable over the public internet, making it a massive pool of potential targets.\n\nAs of now, the purpose of P2PInfect remains unclear. The presence of a binary called \u201cminer\u201d initially raised suspicions of cryptocurrency mining [...]", "creation_timestamp": "2026-09-05T01:00:32.610878Z"}