Pfsense found docker process

[dmateos86]

@rcoleman-netgate Hi, I share the result from dmesg, the pfsense is running on a dell r240 server.

dmesg.txt

thanks

[rcoleman-netgate]

@dmateos86 I thought for sure it wasn't going to be running a bare metal... I'm a bit more concerned about the rest of the software, then. What got on it and how did it get there?

[dmateos86]

@johnpoz said in Pfsense found docker process:

Your not doing anything routing traffic over tor are you?

Hi, no I dont route any tor traffic, and the php-fpm is:

[bingo600]

Hmmm ....

That curl + chmod smells a lot too ...
Payload fetcher ??

/Bingo

[aaronouthier]

Even scarier: The ptr record for 104.244.77.92 points to nasa.gov.

I don’t know which is more disturbing: The thought that the US Feds did this, or the thought that their server might be compromised!??!

I don’t know. Can a ptr record be spoofed?

[aaronouthier]

@aaronouthier

Thinking about it some more, the ptr record is certainly spoofed. Probably attempting misdirection.

[aaronouthier]

@aaronouthier
If your box wasn’t accessible from the outside, then something inside maybe compromised, or perhaps a visitor’s device was compromised and launched an attack on your router while on your network.

[stephenw10]

Mmm, it would be very interesting to see what's in those script files.

Seeing this error log on a box with 16GB RAM:

[zone: pf states] PF states limit reached\

Implies it's moving a lot of traffic.

Steve

[Bob.Dig]

I knew it, one day docker would come to pfSense...

[johnpoz]

@bob-dig hahah

[johnpoz]

@stephenw10 Yeah I bet ;)

Other then curiosity on what it is, and how it got there being the biggest question. I would wipe this box for sure.. This is clearly not something you setup. And everything points to nefarious use.. The IPs are hosted vps, and you got some weird ass PTR setting nasa.gov - yeah ok ;)

And the one IP is a tor exit node..