记录一次服务器被pnscan病毒攻击的处理理财

本文链接：https://blog.csdn.net/qq_34814794/article/details/124540888

记录一次服务器被pnscan病毒攻击的处理理财

起始

凌晨收到腾讯云的安全告警短信大概意思：我的服务器恶意对外攻击。

第一反应就是被挟持了，这个服务器只是用来测试学习用的，所以并不慌。

初步处理

刚开始想无非就是黑客通过开放端口攻击我的服务器然后攻击别人的服务器。

登录服务器查看

netstat -antp

tcp        0      1 10.0.20.9:46146         154.236.210.203:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:42522         154.236.211.7:6379      SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:51640         154.236.209.202:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:39260         154.236.210.228:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:51790         154.236.208.110:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:40884         154.236.208.180:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:41620         154.236.209.132:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:34002         154.236.208.78:6379     SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:48168         154.236.211.204:6379    SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:49848         154.236.211.41:6379     SYN_SENT    6494/pnscan         
tcp        0      1 10.0.20.9:48114         154.236.209.181:6379    SYN_SENT    6494/pnscan

全部是攻击其他服务器Redis端口的连接，所以说大家Redis最好还是要设置密码的。

为啥会被攻击？突然想起来昨天测试为了方便防火墙开放了所有tcp端口。二话不说赶紧将所有端口禁用。

重启服务器，依然不好使。

排查

因为没有被pnscan攻击过，没有经验。一直以为是docker被攻击了。关闭docker，依然不好使。

通过PID定位进程，由于进程一直在变，很难定位到。

锁定目标

file /proc/$PID/exe

终于定位到了恶意程序的文件位置，pnscan网上一搜，哦豁竟然是个Redis木马。先删为敬吧。

问题解决

netstat -antp

tcp        0     15 10.0.20.9:37840         154.201.31.115:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:59182         154.201.19.168:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:36256         154.201.18.78:6379      FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:54160         154.201.18.110:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:49734         154.201.25.232:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:41130         154.201.31.22:6379      FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:51344         154.201.31.78:6379      FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:50258         154.201.25.212:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:50154         154.201.21.108:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:57212         154.201.17.42:6379      FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:38138         154.201.16.173:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:37086         154.201.31.11:6379      FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:42400         154.201.16.108:6379     FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:58452         154.201.20.6:6379       FIN_WAIT1   -                   
tcp        0     15 10.0.20.9:44898         154.201.19.70:6379      FIN_WAIT1   -

全部憋死了，大快人心

[root@VM-20-9-centos bin]# netstat -antp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      9454/sshd           
tcp        0     28 10.0.20.9:22            119.123.176.171:64406   ESTABLISHED 10169/sshd: root@pt 
tcp        0      0 10.0.20.9:56920         194.36.190.30:1414      TIME_WAIT   -                   
tcp        0      0 10.0.20.9:56922         194.36.190.30:1414      ESTABLISHED 23497/[ddns]        
tcp        0      0 10.0.20.9:59830         169.254.0.138:8086      ESTABLISHED 19948/tat_agent     
[root@VM-20-9-centos bin]# netstat -antp