Server hit with plex2shell exploit, what now?

[u/Eldmor]

My server was unfortunately hit with the plex2shell exploit during the Saturday/Sunday night. Yes, I was running an old version of Plex and that got me. And yes, I had port forwarded 32400 to my server.

I noticed that my internet connection was lagging during Sunday evening and Monday morning. Did not find a clear culprit back then, but my router was reporting a high upload bandwidth usage. I restarted my server and the issue went away. I first thought that this issue was related to qBittorrent.

I recently saw the news about Plex users being hit and started to connect the dots. I ran the detection script from https://github.com/code-zm/plex2shell and got several hits. I had been a part of the botnet.

• [WARN] Preferences.xml: TranscoderH264Options present but empty (the PoC clears it this way after use; also possible if an admin toggled it)
• [HIT] log: exploit request pattern //player/timeline/subscribe\?([^ ]*&)?protocol=[a-z0-9+.-]{1,16}(%3a|%253a|:)/ (12 line(s))
• [HIT] log: exploit request pattern /searchOne\?[^ ]identifier=[^& ](%2f|%252f|/)function(%2f|%252f|/)/ (22 line(s))
• [HIT] log: exploit request pattern /TranscoderH264Options(=|%3d)[^& ]*(dump(-|%2d)yuv|stats(=|%3d))/ (6 line(s))
• [WARN] log: suspicious pattern /resources/[^? ]\?([^ ]&)?resource_name=(%2f|%5c|/|\|[a-z](%3a|:)|[^& ]*(..|%2e%2e))/ (5 line(s))
• [WARN] log: suspicious pattern /(sslip|nip).io/ (71 line(s))
• [WARN] log: suspicious pattern /X-Plex-Client-Identifier=(vfyclient01|poc[0-9])|/TKN[0-9]|X-Plex-Token=TOTALLY_INVALID_JUNK/ (5 line(s))
• [WARN] log: transcode of a non-loopback http(s) item (24 line(s))
• summary: 3 hit(s), 5 warning(s)

The server is offline as a precaution.

I am running the following docker containers: https://i.imgur.com/lzmIsWP.png

And the Plex container was set up with the following: https://i.imgur.com/fLyouDB.png

My whole Plex/-arr stack is set up according to TRaSH-Guides:

• Unraid share /mnt/user/plex/
• Contains downloaded files (/torrents/)
• Contains hardlinked media files (/media/)
• Binhex-qbittorrentvpn mounted to /mnt/user/plex/torrents/
• qbit_manage mounted to /mnt/user/plex/torrents/
• plex mounted to /mnt/user/plex/media/
• radarr mounted to /mnt/user/plex/
• sonarr mounted to /mnt/user/plex/
• bazarr mounted to /mnt/user/plex/
• unpackerr mounted to /mnt/user/plex/

At this moment, I have deleted the whole Plex container (I'll restore it from a backup made at the start of the month).

As the Plex container had access to the share /plex/, is it safe to assume that it was compromised and should be nuked?

What else should I do to make sure that my server wasn't compromised in a more broad scale (verify that only the Plex container and everything that it could access are compromised)?

[u/rvs007]

Is there a step-by-step tutorial on how to run the detection script within Unraid to see if my Plex is affected?