5ep9lzv 发表于 2024-8-22 14:50:58

一次服务器被黑的全过程排查和思考——挖矿病毒


    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">发掘</span>网站竟然打不开了。</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D54lMUyduBiaDAuHcyA9xutfwLRSHrKlBIt6WPo8JOPDF7H4uEicRqrRKA/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">1、排查日志</span></strong></span></h2>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">服务器竟然<span style="color: black;">没法</span>登录了！</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5TzyOoxDkeUiba91ErWHmXD6kP9FWvNBsv7MGp1yIpaX8xJpZCZWhNFg/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">1）</span><span style="color: black;">VNC</span><span style="color: black;">登录服务器</span></span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">应该是<span style="color: black;">秘码</span>登录被禁用了。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">运用</span>VNC登录。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">没法</span><span style="color: black;">经过</span>客户端SSH远程登录时，<span style="color: black;">能够</span><span style="color: black;">经过</span>VNC登录来登录服务器.</span></p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">2）查看sshd_config文件</span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">查看了/etc/ssh/sshd_config 文件后，<span style="color: black;">发掘</span>果然是被修改了：</span></p><span style="color: black;"><span style="color: black;"># cat /etc/ssh/sshd_config|grep -Ev ^#|^$</span></span><span style="color: black;"><span style="color: black;">HostKey /etc/ssh/ssh_host_rsa_key</span></span><span style="color: black;"><span style="color: black;">HostKey /etc/ssh/ssh_host_ecdsa_key</span></span><span style="color: black;"><span style="color: black;">HostKey /etc/ssh/ssh_host_ed25519_key</span></span><span style="color: black;"><span style="color: black;">SyslogFacility AUTHPRIV</span></span><span style="color: black;"><span style="color: black;">AuthorizedKeysFile .ssh/authorized_keys</span></span><span style="color: black;"><span style="color: black;">PasswordAuthentication no #<span style="color: black;">暗示</span>不<span style="color: black;">准许</span><span style="color: black;">秘码</span>登录</span></span><span style="color: black;"><span style="color: black;">ChallengeResponseAuthentication no</span></span><span style="color: black;"><span style="color: black;">GSSAPIAuthentication yes</span></span><span style="color: black;"><span style="color: black;">GSSAPICleanupCredentials no</span></span><span style="color: black;"><span style="color: black;">UsePAM yes</span></span><span style="color: black;"><span style="color: black;">X11Forwarding yes</span></span><span style="color: black;"><span style="color: black;">AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES</span></span><span style="color: black;"><span style="color: black;">AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT</span></span><span style="color: black;"><span style="color: black;">AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE</span></span><span style="color: black;"><span style="color: black;">AcceptEnv XMODIFIERS</span></span><span style="color: black;"><span style="color: black;">Subsystem sftp /usr/libexec/openssh/sftp-server</span></span><span style="color: black;"><span style="color: black;">PasswordAuthentication no #<span style="color: black;">暗示</span>不<span style="color: black;">准许</span><span style="color: black;">秘码</span>登录</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">禁用了<span style="color: black;">秘码</span>登录，那应该<span style="color: black;">便是</span>用被<span style="color: black;">运用</span>私钥登录了。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">先改成yes，<span style="color: black;">而后</span>重启sshd</span></p><span style="color: black;"><span style="color: black;">systemctl restart sshd</span></span>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">3）<span style="color: black;">运用</span>终端重新登录</span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">修改完之后，再本地<span style="color: black;">运用</span>终端工具重新登录。</span><span style="color: black;"><span style="color: black;">发掘</span><span style="color: black;">能够</span>登录了。</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5OnDAl4VGjD3ReiaqCSIT4qAfWdbtpn6fgFibc3jpUBo31wwhiazp2YLIA/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">查看&nbsp;authorized_keys&nbsp;文件</span></p><span style="color: black;"><span style="color: black;"> vi /root/.ssh/authorized_keys</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">服务器加了秘钥对了：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5NZK3NgQ0sgAjk9texk1jkgibZwfCTRk2F3aWLpMcTnLfZN6h4zykayQ/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">4）查看登录日志</span></strong></span></h3><span style="color: black;"><span style="color: black;"><span style="color: black;">运用</span> last 和 history 命令 查看一下登录日志和操作日志</span></span><span style="color: black;"><span style="color: black;">last #查看所有登录的ip</span></span><span style="color: black;"><span style="color: black;">history #查看操作的命令记录</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5eCBOUHwrckcphbcrLEhSOpWp3tFT8ANEbDmtdqgUuBp7AYLciaqVqRw/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">发掘</span>并没有<span style="color: black;">反常</span>的IP，这倒是不奇怪，假如真的被登录了，登录日志被删除的可能性<span style="color: black;">亦</span>是很大的。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">再用 lastb 命令查看一下:</span></p><span style="color: black;"><span style="color: black;">lastb #用于列出登入系统失败的用户<span style="color: black;">关联</span>信息</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5TjFuFcIj9khh3evOQfg6AHgcTQzs0ib2IOwpxxBrc7cvreYKQetmyvw/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5YWlThjzQaQDrL6WqNMbBCicRvVZdTXTHNicVGCElwffBbpIHkkv2JYhw/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">lastb结果解释：</span></p><span style="color: black;"><span style="color: black;"><span style="color: black;">第1</span>列：用户名</span></span><span style="color: black;"><span style="color: black;">第二列：终端位置</span></span><span style="color: black;"><span style="color: black;">第三列：登录ip<span style="color: black;">或</span>内核</span></span><span style="color: black;"><span style="color: black;">第四列：<span style="color: black;">起始</span>时间</span></span><span style="color: black;"><span style="color: black;">第五列：结束时间（still login in 还未退出 down 直到正常关机 crash 直到强制关机）</span></span><span style="color: black;"><span style="color: black;">第六列：<span style="color: black;">连续</span>时间</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">以上结果<span style="color: black;">暗示</span>，服务器被暴力</span><span style="color: black;">撞库</span><span style="color: black;">了。</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">IP应该是<span style="color: black;">经过</span>代理的，第二张图对方直接<span style="color: black;">运用</span>root<span style="color: black;">做为</span>用户名<span style="color: black;">持续</span>的去撞库，看来是找对了用户名，最后真的是登录了<span style="color: black;">而后</span>修改了我的秘钥对。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">查一下IP：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5RPUtr76Dn2sB526KiaQcoG9JBRPr9JSZqPFvxuRpYiaqFn5uCsNZMpkg/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5lFJUn648xx11bLJSKju2LX6K7XedEibiaAOFxWwGpiaFl8DYtTxSXCvCg/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">IP是国外的，很难查到位置，<span style="color: black;">亦</span>有可能是代理IP。</span></p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">2、找到木马文件</span></strong></span></h2>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">1）<span style="color: black;">运用</span>top命令看一下</span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">普通的top命令<span style="color: black;">基本</span><span style="color: black;">没法</span><span style="color: black;">表示</span>木马进程，看起来像是很正常的样子，<span style="color: black;">由于</span>top命令很可能<span style="color: black;">已然</span>被入侵者修改：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D51Oibm4YeRQhJDhwJLCQHZ6LRzFTZ3ng0O64Aic3JiaLHyNNziaQCp9tQKQ/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">2）</span><span style="color: black;">busybox</span><span style="color: black;">&nbsp;命令</span></span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">运行&nbsp;busybox top<span style="color: black;">能够</span>看到<span style="color: black;">隐匿</span>的占用CPU的进程，原始的top<span style="color: black;">已然</span>被修改，<span style="color: black;">不可</span><span style="color: black;">表示</span>病毒的进程，必须在busybox中执行</span></p><span style="color: black;"><span style="color: black;">#&nbsp;&nbsp;wget&nbsp;https://tao-1257166515.cos.ap-chengdu.myqcloud.com/busybox</span></span><span style="color: black;"><span style="color: black;">--2020-12-14 15:12:59-- https://tao-1257166515.cos.ap-chengdu.myqcloud.com/busybox</span></span><span style="color: black;"><span style="color: black;">Resolving tao-1257166515.cos.ap-chengdu.myqcloud.com (tao-1257166515.cos.ap-chengdu.myqcloud.com)... 132.232.176.6, 132.232.176.7, 139.155.60.205, ...</span></span><span style="color: black;"><span style="color: black;">Connecting to tao-1257166515.cos.ap-chengdu.myqcloud.com (tao-1257166515.cos.ap-chengdu.myqcloud.com)|132.232.176.6|:443... connected.</span></span><span style="color: black;"><span style="color: black;">HTTP request sent, awaiting response... 200 OK</span></span><span style="color: black;"><span style="color: black;">Length: 1001112 (978K) </span></span><span style="color: black;"><span style="color: black;">Saving to: ‘busybox.1’</span></span><span style="color: black;"><span style="color: black;">100%[======================================&gt;] 1,001,112 1.36MB/s in 0.7s</span></span><span style="color: black;"><span style="color: black;">#&nbsp;cp&nbsp;busybox&nbsp;/usr/bin/</span></span><span style="color: black;"><span style="color: black;">#&nbsp;busybox&nbsp;top</span></span><span style="color: black;"><span style="color: black;">-bash: /usr/bin/busybox: Permission denied</span></span><span style="color: black;"><span style="color: black;">#&nbsp;cd&nbsp;/usr/bin/</span></span><span style="color: black;"><span style="color: black;"># chmod 777 /usr/bin/busybox</span></span><span style="color: black;"><span style="color: black;"># busybox top</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">抓到了木马文件：</span></strong></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5iawvGFcIWoxnGj9Mr0nAH1nzbMxd7ibgmOqOF0IUtrA2ibg5baoVprt4A/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">以上看到CPU占用率达到了近100%，挖矿无疑了。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">最后和腾讯云的技术<span style="color: black;">一块</span>排查了大半天，<span style="color: black;">最终</span>揪出了以下几个木马文件，目录：</span></p><span style="color: black;"><span style="color: black;">/tmp/.X25-unix/.rsync/c/tsm64</span></span><span style="color: black;"><span style="color: black;">/tmp/.X25-unix/.rsync/c/tsm32</span></span><span style="color: black;"><span style="color: black;">/tmp/.X25-unix/.rsync/a/kswapd0</span></span><span style="color: black;"><span style="color: black;">/usr/bin/systemd-network</span></span><span style="color: black;"><span style="color: black;">/usr/bin/kswaped</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5s6jiafczAeODZCtTqyia9CNrbWibfH0FweEMpKiaqeTgLFBWGz9EIGdxVA/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">最后锁定这个挖矿进程名<span style="color: black;">叫作</span>是pamdicks，接下来把木马进程杀掉，<span style="color: black;">而后</span>把木马文件删除，应该就<span style="color: black;">能够</span>了。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">倘若</span>不输入全<span style="color: black;">叫作</span>，ls、ll、lsattr 文件查看命令是<span style="color: black;">基本</span>不会<span style="color: black;">表示</span>这个木马文件的：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D53PCDiaNN6E2U6bo2MyVcxolUnQCpoB7UptSR0crIc51Yrysp0BwIcnw/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">删除前<span style="color: black;">瞧瞧</span>这个挖矿的进程<span style="color: black;">到底</span>是啥：</span></p><span style="color: black;"><span style="color: black;">ls -lh /proc/5445/fd</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5Zw59Sbq0mnW0Nx3sbslxBzUA6icsDF56CgpwibtXIoKmvjiaJyzo3KyuQ/640?wx_fmt=png&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><span style="color: black;">top -H -p 5445</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">这个pamdicks进程有6个子线程：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5Fbfh944b6PZnBgeXmsxutGdT98644HwUvPyFFhtWpRzbLOGVW8xNZQ/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">最后<span style="color: black;">跟踪</span>到是个二进制文件，触及到知识范围了，<span style="color: black;">没法</span>打开，就直接删除吧。</span></p>
    <h2 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">3、删除木马文件</span></strong></span></h2>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">1）修改authorized_keys</span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">先把authorized_keys 文件的公钥删除。当我执行 rm 命令的时候，入侵者把我的 authorized_keys 文件加了&nbsp;+i 锁，不<span style="color: black;">准许</span>删除，so sad：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D553YzyHib7gRaPabkV5kXDmouE7ic8iafzB3868yEiaSoIdiafTIBBPxMCgg/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><span style="color: black;">chattr +i /etc/authorized_keys </span></span><span style="color: black;"><span style="color: black;"><span style="color: black;">暗示</span>文件<span style="color: black;">不可</span>删除，<span style="color: black;">不可</span>更改，<span style="color: black;">不可</span>移动</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">把服务器的chattr命令<span style="color: black;">亦</span>删除了，服务器被黑，删chattr命令是<span style="color: black;">平常</span>的操作。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">果真找不到chattr命令了：</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5lSibRVlKkjzZV9ellqdibYwpHaBbDmewiaZHCzXRs6CpFfaibTNbTp65ibg/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5WQCBtTnMdicdn6oLUES3n2ehZGPEbkrePESXQlYYP3O0h0DQoTyOPTA/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">&nbsp;只能手动把chattr 装回来，centos安装过程：</p>
    <span style="color: black;"><span style="color: black;">yum install e2fsprogs</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D5nc56VgaiaFWwXzibiaPCpqR4Ku0GhAQqjxLmQbMK8BMOkHF2CYV98U8aQ/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">安装成功：</span></p><span style="color: black;"><span style="color: black;"># which chattr</span></span><span style="color: black;"><span style="color: black;">/usr/bin/chattr</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">清空authorized_keys 文件：</span></p><span style="color: black;"><span style="color: black;"># chattr -i authorized_keys</span></span><span style="color: black;"><span style="color: black;"># echo &gt; authorized_keys</span></span><span style="color: black;"><span style="color: black;"># cat authorized_keys</span></span>
    <h3 style="color: black; text-align: left; margin-bottom: 10px;"><span style="color: black;"><strong style="color: blue;"><span style="color: black;">2）执行 rm 命令，删除木马文件</span></strong></span></h3>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">kill掉并删除<span style="color: black;">发掘</span>的木马文件：</span></p><span style="color: black;"><span style="color: black;"># kill -9 5445</span></span><span style="color: black;"><span style="color: black;"># chattr -i /usr/bin/pamdicks</span></span><span style="color: black;"><span style="color: black;"># rm /usr/bin/pamdicks</span></span><span style="color: black;"><span style="color: black;">rm: remove regular file ‘/usr/bin/pamdicks’? y</span></span><span style="color: black;"><span style="color: black;"># rm /tmp/.X25-unix/.rsync/c/lib/64/tsm</span></span><span style="color: black;"><span style="color: black;">rm: remove regular file ‘/tmp/.X25-unix/.rsync/c/lib/64/tsm’? y</span></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">删除之后</span><span style="color: black;">CPU<span style="color: black;">运用</span>率</span><span style="color: black;">就降下来了：</span></span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/G7WSQyicBkgjkkBvuV7tzqD0yfvgvO8D54lvhGlqSzQsHIPPmLTBJMAmkpDYueiaibmEjahBzPP2VjibeysXV0JOrw/640?wx_fmt=other&amp;from=appmsg&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1&amp;tp=webp" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;">木马文件清理完毕，最后把服务器禁用<span style="color: black;">秘码</span>登录，改用生成好的秘钥对登录。暂时告一段落。</span>




yunpan135 发表于 2024-9-4 20:51:24

楼主节操掉了，还不快捡起来！
页: [1]
查看完整版本: 一次服务器被黑的全过程排查和思考——挖矿病毒