高手对决 -- 博客服务器被黑的故事

100 packets transmitted, 40 received, 60% packet loss, time 10015ms

Your Linode, linode202373, has exceeded the notification threshold (5) for outbound traffic rate by averaging 138.14 Mb/s for the last 2 hours
(你的梯子, 已经在连续两个小时内, 以超过 138.14 Mb/s 的平均速度, 连续发包)

ssh [email protected]

# who
root pts/2 2015-01-20 3:00 (xx.xx.xx.xx)

# last
root     pts/2        li657-42.members Tue Jan 20 03:03 - 03:41  (00:38)
root     pts/1        183.37.59.101    Tue Jan 20 02:54 - 05:12  (02:18)
root     pts/0        li657-42.members Tue Jan 20 02:45 - 04:51  (02:05)
reboot   system boot  3.18.1-x86_64-li Tue Jan 20 02:45 - 20:30  (17:45)
ruby     pts/0        119.139.89.32    Sat Jan 17 01:03 - 01:03  (00:00)
ruby     pts/0        119.139.88.22    Mon Jan 12 17:05 - 19:30  (02:24)
ruby     pts/0        183.39.218.147   Sat Jan 10 16:31 - 16:33  (00:02)
ruby     pts/0        183.39.218.147   Sat Jan 10 16:29 - 16:29  (00:00)
reboot   system boot  3.18.1-x86_64-li Sat Jan 10 16:26 - 02:44 (9+10:17)

wtmp begins Sat Jan 10 16:26:21 2015

# grep 'sshd' /var/log/auth.log
Jan 18 18:56:42 localhost sshd[16157]: Failed password for invalid user user from 180.150.177.103 port 39118 ssh2
Jan 18 18:56:42 localhost sshd[16157]: Received disconnect from 180.150.177.103: 11: Bye Bye [preauth]
Jan 18 18:59:05 localhost sshd[16194]: Connection closed by 180.150.177.103 [preauth]
Jan 18 19:01:26 localhost sshd[16219]: Invalid user user from 180.150.177.103
Jan 18 19:01:26 localhost sshd[16219]: input_userauth_request: invalid user user [preauth]
Jan 18 19:01:26 localhost sshd[16219]: pam_unix(sshd:auth): check pass; user unknown
Jan 18 19:01:26 localhost sshd[16219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.150.177.103
Jan 18 19:01:28 localhost sshd[16219]: Failed password for invalid user user from 180.150.177.103 port 45735 ssh2
Jan 18 19:01:29 localhost sshd[16219]: Received disconnect from 180.150.177.103: 11: Bye Bye [preauth]
Jan 18 19:03:52 localhost sshd[16248]: Invalid user user from 180.150.177.103
Jan 18 19:03:52 localhost sshd[16248]: input_userauth_request: invalid user user [preauth]
Jan 18 19:03:52 localhost sshd[16248]: pam_unix(sshd:auth): check pass; user unknown
Jan 18 19:03:52 localhost sshd[16248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh r
...( 省略几万行 )

iftop -nP

ps aux

ruby      5162  0.0  5.0 286128 102200 ?       Sl   02:58   2:20 /usr/sbin/httpd -c ./init -d /home/ruby/lib/2
111      3033  0.0  5.0  1  2017 ?       Sl   02:58   2:20 /tmp/freeBSD /tmp/freeBSD 1

# tree
.
├── 2
│   └── muhrc
├── config
├── cron.d
├── dir
├── f
├── h
├── h.c
├── init
├── inst
├── ips
├── log
├── mess
├── muhrc
├── restart
├── run
├── run2
├── servers
└── y

# cat y
#!/bin/sh
if test -r /home/ruby/lib/pid; then
pid=$(cat /home/ruby/lib/pid)
if $(kill -CHLD $pid >/dev/null 2>&1)
then
exit 0
fi
fi
cd /home/ruby/lib
killall -9 atd
./run &>/dev/null

# cat muhrc
nickname = "Dan";
altnickname = "Dan";
username = "xxx";
realname = "dan e pe linode :)";
password = "xxx";
listenport = 41000;
awayreason = "mie";
servers {
      "Tampa.FL.US.Undernet.org":6667,
      "budapest.hu.eu.undernet.org":6667,
};
logging = false;
channels = "#olimpia";
connectcmd = "PRIVMSG [email protected] : login ";
away = "mie";
norestricted = true

psf -- Process Stack Faker (a.k.a. Fucker)
Coded by Stas; (C)opyLeft by SysD Destructive Labs, 1997-2003

Tested on: FreeBSD 4.3, Linux 2.4, NetBSD 1.5, Solaris 2.7

Compile with:
# gcc -O2 -o h h.c
# strip h

int main(int argc, char *argv[])

int execv( const char *path, char *const argv[])

# 检查用户信息是否正常
cat /etc/passwd
# 检查系统文件是否被替换
find / -user 122 | xargs ls -l

# ufw status
Status: inactive

PING myblog.me (xx.xx.xx.xx): 56 data bytes
64 bytes from xx.xx.xx.xx: icmp_seq=0 ttl=52 time=84.207 ms
64 bytes from xx.xx.xx.xx: icmp_seq=1 ttl=52 time=80.165 ms
64 bytes from xx.xx.xx.xx: icmp_seq=2 ttl=52 time=83.242 ms
64 bytes from xx.xx.xx.xx: icmp_seq=3 ttl=52 time=86.241 ms
64 bytes from xx.xx.xx.xx: icmp_seq=4 ttl=52 time=86.799 ms
......

64 bytes from xx.xx.xx.xx: icmp_seq=4 ttl=52 time=86.799 ms
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
......