Linux服务器被攻击用来挖矿了

服务器CPU占用100%，一看进程名为bash的占用的。几个相同密码的虚拟机都遭了。

查了下，是被用来挖矿了，囧。

[root@localhost ~]# cat /tmp/.bash/bash
#!/bin/bash
cd -- /tmp/.bash
mkdir -- .bash
cp -f -- x86_64 .bash/bash
./.bash/bash  -c
rm -rf .bash

发现就是这个脚本在不停的执行

From root@localhost.localdomain  Sun Nov 15 21:32:02 2020
Return-Path: <root@localhost.localdomain>
X-Original-To: root
Delivered-To: root@localhost.localdomain
Received: by localhost.localdomain (Postfix, from userid 0)
        id 86AB4404DBE9; Sun, 15 Nov 2020 21:32:02 +0800 (CST)
From: "(Cron Daemon)" <root@localhost.localdomain>
To: root@localhost.localdomain
Subject: Cron <root@localhost> /tmp/.bash/bash
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
Precedence: bulk
X-Cron-Env: <XDG_SESSION_ID=1498>
X-Cron-Env: <XDG_RUNTIME_DIR=/run/user/0>
X-Cron-Env: <LANG=zh_CN.UTF-8>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/root>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>
Message-Id: <20201115133202.86AB4404DBE9@localhost.localdomain>
Date: Sun, 15 Nov 2020 21:32:02 +0800 (CST)

||  ERROR  || already running...

删除/tmp/.bash文件夹过后，发现email还在发 　　

ls /tmp/.bash/
bash    i686    x86_64 
rm -rf /tmp/.bash

查看计划任务

[root@localhost ~]# crontab -l
* * * * * /tmp/.bash/bash

[root@localhost ~]# crontab -e
* * * * * /tmp/.bash/bash         ##删除

先把它干掉。

 

删除以下文件：

rm -rf /tmp/.xm/stak/ld-linux-x86-64.so.2
rm -rf /sbin/upd
rm -rf /sbin/initct1
rm -rf /sbin/mke3fs
rm -rf /sbin/s1n
rm -rf /sbin/ld-linux-x86-64.so.2
rm -rf /sbin/libpthread.so.1

　　

修改密码，最好改下SSH端口。