>>/dev/null& fi echo $!> bash.pid
这个核心文件就是读出操作系统的硬件架构,如果是i386就执行32位的h32和md32,猜测h32是用于让系统显示的进程名称,md32才是真正的挖矿程序。执行完成了就把进程id写入bash.pid中。

6. 过程总结

找系统漏洞->获取权限->创建目录->上传文件->执行x,执行a->a启动crontab执行upd,生成upd并赋权->upd去执行run->run去执行真正的挖矿程序。

清除挖矿程序

1. kill 掉可疑进程,删除程序目录

# kill -9 19078 && rm -rf /tmp/.n && rm -rf /tmp/.a

2. 修改 vmuser 用户密码

注意到挖矿程序都是 vmuser 用户,所以修改 vmuser 用户密码

# passwd vmuser

入侵检测

不放心,使用 rkhunter 检测一下

1. 下载安装

# wget https://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.4/rkhunter-1.4.4.tar.gz # tar zxvf rkhunter-1.4.4.tar.gz&& tar zxvf rkhunter-1.4.4.tar.gz&& cd rkhunter-1.4.4 #./install.sh--install

2. 入侵检测

# rkhunter-c-sk System checks summary ===================== File properties checks... Required commands check failed Files checked:136 Suspect files:5 Rootkit checks... Rootkits checked:481 Possible rootkits:0 Applications checks... All checks skipped The system checks took:7 minutes and22 seconds All results have been written to the log file:/var/log/rkhunter.log One or more warnings have been foundwhile checking the system. Please check the logfile(/var/log/rkhunter.log)
Suspect files 的警告和正常服务器上的一致,这里忽略

3. 卸载 rkhunter

# cd rkhunter-1.4.4 && ./install.sh --remove