[{"data":1,"prerenderedAt":336},["ShallowReactive",2],{"site-data":3,"article-108":143,"article-show-hot-108":172,"article-show-new-108":260},{"settings":4,"categorys":35,"tree":97,"models":118,"search_model_select":128,"nav_list":130},{"changefreq":5,"changyan_app_id":6,"changyan_app_key":6,"copy":7,"description":8,"editor":9,"file":6,"guest_feedback":10,"head_html":6,"icp":11,"index_banner":12,"index_banner_bg":13,"is_excel":14,"is_watermark":10,"keywords":15,"links":16,"logo":17,"lzcms_banner":6,"lzcms_banner_link":18,"member_register_enabled":14,"qq_app_id":6,"qq_app_key":6,"qr_code":6,"search_model":19,"site_closedreason":6,"site_idea":6,"site_idea1":20,"site_idea2":21,"site_idea3":22,"site_name":23,"site_statistice":6,"site_status":14,"site_url":18,"sitemap_model":19,"stationmaster_motto":24,"stationmaster_name":25,"stationmaster_occupation":26,"stationmaster_qq":27,"stationmaster_qqnet":28,"stationmaster_qqnet_code":29,"threshold":14,"title_add":30,"watermark":6,"watermark_alpha":31,"watermark_height":32,"watermark_locate":33,"watermark_width":34},"weekly","","版权所有 © \u003Ca class=\"site_url\" href=\"https://zhl123.com\">2026 zhl123.com\u003C/a>","linux、Python、mysql、docker、k8s技术交流","layedit","0","粤ICP备15054664号-1","/uploads/images/20181109/7a86191de8b8bb60e9c6b54d8b27c5cc.jpg","#xe604","1","linux、Python、mysql、docker、k8s","{\"1\":{\"id\":\"1\",\"link_url\":\"https://linux.org\",\"logo\":\"\",\"name\":\"linux\",\"sort\":\"0\",\"status\":\"1\"}}","/uploads/images/20181109/e7305012448aed257176dd591846f50a.png","https://zhl123.com","2","学无止境\n学习，探索，研究，从不了解到了解，从无知到掌握，到灵活运用，在不断的学习中加深认识。由浅入深，由表及里。","业精于勤\n“业精于勤荒于嬉”，精深的业技靠的是勤学、刻苦努力，靠的是争分夺秒的勤学苦练才会有精深的技术。得在认真，失在随便。","工匠精神\n精益求精，注重细节，追求完美和极致，不惜花费时间精力，孜孜不倦，反复改进产品，把99%提高到99.99%。","linux","业精于勤、学无止境、工匠精神","廖地金","高级Linux运维工程师","1256636645","592958303","\u003Ca target=\"_blank\" href=\"//shang.qq.com/wpa/qunwpa?idkey=09be7d1a682073783fd636102e666393169b8a8aac8f3393da1de57bcaa821a0\">\u003Cimg border=\"0\" src=\"//pub.idqqimg.com/wpa/images/group.png\" alt=\"Linux技术\" title=\"Linux技术\">\u003C/a>"," | Python | mysql | docker | k8s 技术交流","100","300","9","500",{"0":36,"17":51,"18":60,"19":63,"20":67,"21":71,"22":76,"25":80,"26":83,"27":89,"29":94},{"children":37},{"0":38,"25":43,"26":48},[39,40,41,42],25,21,22,26,[44,45,46,47],17,18,19,20,[49,50],27,29,{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},"index",1,"list","article",2,"文章模型","show","/article/lists?category_id=17",{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},"python","/article/lists?category_id=18",{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},"容器技术",3,"/article/lists?category_id=19",{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},"负载均衡",4,"/article/lists?category_id=20",{"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},"分享无价",0,5,"/article/lists?category_id=21",{"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},"随笔",6,"/article/lists?category_id=22",{"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},"学无止境","/article/lists?category_id=25",{"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},"picture","图集模型","关于",8,"/picture/lists?category_id=26",{"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},"page","单页模型","关于博主","/page/27",{"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},"留言","/feedback",[98,108,110,112],{"children":99,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[100,102,104,106],{"children":101,"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},[],{"children":103,"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},[],{"children":105,"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},[],{"children":107,"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},[],{"children":109,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":111,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":113,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[114,116],{"children":115,"create_time":6,"description":6,"id":49,"image_url":6,"index_template":52,"is_cover":53,"is_menu":73,"keywords":6,"list_template":54,"model_code":90,"model_id":53,"model_name":91,"name":92,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":93},[],{"children":117,"create_time":6,"description":6,"id":50,"image_url":6,"index_template":52,"is_cover":73,"is_menu":73,"keywords":6,"list_template":54,"model_id":73,"name":95,"parent_id":42,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":47,"subtitle":6,"update_time":6,"url":96},[],{"1":119,"2":120,"3":121,"4":122,"5":125},{"id":53,"index_template":52,"list_template":54,"name":91,"show_template":58,"status":73,"tablename":90},{"id":56,"index_template":52,"list_template":54,"name":57,"show_template":58,"status":73,"tablename":55},{"id":65,"index_template":52,"list_template":54,"name":85,"show_template":58,"status":73,"tablename":84},{"id":69,"index_template":52,"list_template":54,"name":123,"show_template":58,"status":73,"tablename":124},"链接模型","link",{"id":74,"index_template":52,"list_template":54,"name":126,"show_template":58,"status":73,"tablename":127},"下载模型","download",[129],{"id":56,"name":57,"tablename":55},[131,137,139,141],{"children":132,"create_time":6,"description":6,"id":39,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":81,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":73,"subtitle":6,"update_time":6,"url":82},[133,134,135,136],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"children":138,"create_time":6,"description":6,"id":40,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":72,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":74,"subtitle":6,"update_time":6,"url":75},[],{"children":140,"create_time":6,"description":6,"id":41,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":77,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":78,"subtitle":6,"update_time":6,"url":79},[],{"children":142,"create_time":6,"description":6,"id":42,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":84,"model_id":65,"model_name":85,"name":86,"parent_id":73,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":87,"subtitle":6,"update_time":6,"url":88},[],{"article":144,"breadcrumb":155,"category":159,"next":160,"prev":163,"second_categorys":166,"seo":171},{"id":145,"category_id":44,"title":146,"keywords":147,"description":148,"image_url":6,"content":149,"content_md":150,"url":151,"hits":152,"is_recommend":73,"is_top":73,"create_time":153,"update_time":154},108,"挖矿木马自助清理手册","木马,自助,清理,手册","一、什么是挖矿木马挖矿木马会占用CPU进行超频运算，从而占用主机大量的CPU资源，严重影响服务器上的其他应用的正常运行。黑客为了得到更多的算力资源，一般都会对全网进行无差别扫描，同时利用SSH爆破和漏洞利用等手段攻击主机。部分挖矿木马还具备蠕虫化的特点，在主机被成功入侵之后，挖矿木马还会向内网渗透，并在被入侵的服务器上持久化驻留以获取最大收益。挖矿木马的整体攻击流程大致如下图所示：二、挖矿木马中招特征挖矿木马会在用户不知情的情况下利用主机的算力进行挖矿，最明显的特征就是主机的CPU被大量消耗，查","\u003Csection data-mpa-template=\"t\" mpa-from-tpl=\"t\" style=\"text-align: justify;\">\u003Csection mpa-from-tpl=\"t\" style=\"text-align: center;\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Cp>\u003Cspan>\u003Cem>\u003Cstrong mpa-from-tpl=\"t\" mpa-is-content=\"t\">一、什么是挖矿木马\u003C/strong>\u003C/em>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Cspan>   挖矿木马会占用CPU进行超频运算，从而占用主机大量的CPU资源，严重影响服务器上的其他应用的正常运行。黑客为了得到更多的算力资源，一般都会对全网进行无差别扫描，同时利用SSH爆破和漏洞利用等手段攻击主机。\u003C/span>\u003Cbr>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>部分挖矿木马还具备蠕虫化的特点，在主机被成功入侵之后，挖矿木马还会向内网渗透，并在被入侵的服务器上持久化驻留以获取最大收益。\u003Cbr>\u003Cbr>\u003C/span>\u003C/p>\u003Cp>\u003Cspan>挖矿木马的整体攻击流程大致如下图所示：\u003C/span>\u003C/p>\u003Cp>\u003Cimg src=\"/uploads/layedit/20211110/73a83cf25324be000806d35145752664.jpg\" alt=\"1.jpg\" style=\"text-align: center;\">\u003C/p>\u003Cp>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"24938\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Cp>\u003Cbr mpa-from-tpl=\"t\">\u003C/p>\u003Csection data-mpa-template=\"t\" mpa-from-tpl=\"t\">\u003Cp>\u003Cbr>\u003C/p>\u003Csection mpa-from-tpl=\"t\" style=\"text-align: center;\">\u003Cp>\u003Cbr>\u003C/p>\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Cp>\u003Cspan>\u003Cem>\u003Cstrong mpa-from-tpl=\"t\" mpa-is-content=\"t\">二、挖矿木马中招特征\u003C/strong>\u003C/em>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>挖矿木马会在用户不知情的情况下利用主机的算力进行挖矿，最明显的特征就是主机的CPU被大量消耗，查看云主机CPU占用率的方法有两种：\u003C/span>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cstrong>控制台实例监控\u003C/strong>\u003C/p>\u003Cp>\u003Cstrong>\u003Cimg src=\"/uploads/layedit/20211110/d68438c0482915789a8059a78e24cf78.jpg\" alt=\"2.jpg\">\u003Cbr>\u003C/strong>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cstrong>主机执行TOP命令\u003C/strong>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>如下图所示，通过执行top命令，即可在返回结果中看到当时系统的CPU占用率。\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">top\u003C/span> -c\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/ab5fcddaf033a9836e9043cc42854e2c.jpg\" alt=\"3 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>如果云主机CPU占用率居高不下，那么主机很有可能已经被植入了挖矿木马，会影响服务器上的其他应用的正常运行，需要立刻上机排查。\u003C/span>\u003C/p>\u003Csection data-mpa-template=\"t\" mpa-from-tpl=\"t\" style=\"text-align: justify;\">\u003Csection mpa-from-tpl=\"t\" style=\"text-align: center;\">\u003Cp>\u003Cbr>\u003C/p>\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Cp>\u003Cspan>\u003Cem>\u003Cstrong mpa-from-tpl=\"t\" mpa-is-content=\"t\">三、清理挖矿木马\u003C/strong>\u003C/em>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection data-form=\"0\" data-num=\"1\" style=\"text-align: center;\">\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cstrong>1、及时隔离主机\u003C/strong>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>部分带有蠕虫功能的挖矿木马在取得主机的控制权后，会继续对公网的其他主机，或者以当前主机作为跳板机对同一局域网内的其他主机进行横向渗透，所以在发现主机被植入挖矿木马后，在不影响业务正常运行的前提下，应该及时隔离受感染的主机，然后进行下一步分析和清除工作。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>腾讯云主机可以通过设置安全组隔离主机，具体参考如下链接：\u003C/span>\u003Cspan>\u003Cem>https://cloud.tencent.com/document/product/215/20089\u003C/em>\u003C/span>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Csection>\u003Csection>\u003Cstrong>\u003Cspan>2、阻断异常网络通信\u003C/span>\u003C/strong>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>挖矿木马不仅会连接矿池，还有可能会连接黑客的C2服务器，接收并执行C2指令、投递其他恶意木马，所以需要及时进行网络阻断。\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>（1）检查主机防火墙当前生效的iptables规则中是否存在业务范围之外的可疑地址和端口，它们可能是挖矿木马的矿池或C2地址\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">iptables\u003C/span> -L -n\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>（2）从iptables规则中清除可疑地址和端口\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">vi\u003C/span> /etc/sysconfig/iptables\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>（3）阻断挖矿木马的网络通信\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003Cbr>\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"sql\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">iptables -A INPUT -s 可疑地址 -j \u003Cspan class=\"code-snippet__keyword\">DROP\u003C/span>\u003C/span>\u003C/code>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">iptables -A \u003Cspan class=\"code-snippet__keyword\">OUTPUT\u003C/span> -d 可疑地址 -j \u003Cspan class=\"code-snippet__keyword\">DROP\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cspan>\u003Cstrong>3、清除计划任务\u003C/strong>\u003C/span>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>大部分挖矿木马会通过在受感染主机中写入计划任务实现持久化，如果仅仅只是清除挖矿进程，无法将其根除，到了预设的时间点，系统会通过计划任务从黑客的C2服务器重新下载并执行挖矿木马。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>挖矿木马常见的计划任务通常是下载并执行sh脚本，如下图所示:\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>\u003Cimg src=\"/uploads/layedit/20211110/0c2e3c4bc6a62c916a6e21967b68a725.png\" alt=\"4.png\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>可以通过执行如下命令查看是否存在可疑定时任务，若有，则先保存相关记录用于后续分析，再进行删除：\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>查看系统当前用户的计划任务：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">crontab\u003C/span> -l\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>查看系统特定用户的计划任务：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">crontab\u003C/span> -u username -l\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>查看其他计划任务文件：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/crontab\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/var/spool/cron\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/anacrontab\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/cron.d/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/cron.daily/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/cron.hourly/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/cron.weekly/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc/cron.monthly/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cat\u003C/span> \u003Cspan class=\"code-snippet__string\">/var/spool/cron/\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003Cstrong>4、清除启动项\u003C/strong>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>除了计划任务，挖矿木马通过添加启动项同样能实现持久化。可以使用如下命令查看开机启动项中是否有异常的启动服务。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>CentOS7以下版本：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"cpp\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">chkconfig –\u003Cspan class=\"code-snippet__built_in\">list\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>CentOS7及以上版本：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"cpp\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">systemctl \u003Cspan class=\"code-snippet__built_in\">list\u003C/span>-unit-files\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>如果发现有恶意启动项，可以通过如下命令进行关闭：\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>CentOS7以下版本：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">chkconfig\u003C/span> 服务名 \u003Cspan class=\"code-snippet__literal\">off\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>CentOS7及以上版本：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"bash\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">systemctl \u003Cspan class=\"code-snippet__built_in\">disable\u003C/span> 服务名\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>另外，还需要仔细排查以下目录及文件，及时删除可疑的启动项：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003Cbr>\u003C/li>\u003C/ul>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">/usr/lib/systemd/system\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">/usr/lib/systemd/system/multi-user.target.wants\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">/etc/rc.local\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">/etc/inittab\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">/etc/rc0.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc1.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc2.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc3.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc4.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc5.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc6.d/\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>rc.d/\u003C/span>\u003C/code>\u003C/p>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>排查的时候，可以按照文件修改时间来排序，重点排查近期被创建服务项。如下图所示，系统近期被创建了一个名为bot.service的服务，该服务在系统启动时会启动/etc/kinsing这个木马文件，需要关闭bot服务，并删除/etc/kinsing文件。\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/3cd9e620ab95ebe7de5ca4753f69c5e5.jpg\" alt=\"5.jpg\">\u003Cbr>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cimg src=\"/uploads/layedit/20211110/1fbc612b14c0914856f326a2537f279c.jpg\" alt=\"6 (2).jpg\">\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003Csection>\u003Csection>\u003Cspan>\u003Cstrong>5、清除预加载so\u003C/strong>\u003C/span>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Cspan>通\u003C/span>\u003Cspan>\u003C/span>\u003Cspan>过配置/etc/ld.so.preload，可以自定义程序运行前优先加载的动态链接库，部分木马通过修改该文\u003C/span>\u003Cspan>件，添加恶意so文件，从而实现挖矿进程的隐藏等恶意功能。\u003Cbr>\u003C/span>\u003Cp>\u003Cspan>检查/etc/ld.so.preload（该文件默认为空），清除异常的动态链接库。可以执行`> /etc/ld.so.preload`命令进行清除。\u003C/span>\u003C/p>\u003Cp>\u003Cspan>\u003Cimg src=\"/uploads/layedit/20211110/58655aa5bbb2e5b77eb4d4fc24df6ccf.jpg\" alt=\"7 (2).jpg\">\u003Cbr>\u003C/span>\u003C/p>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection data-form=\"0\" data-num=\"1\" style=\"text-align: center;\">\u003Cbr>\u003C/section>\u003C/section>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cstrong>6、清除SSH公钥\u003C/strong>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp>\u003Cbr>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>挖矿木马通常还会在~/.ssh/authoruzed_keys文件中写入黑客的SSH公钥，这样子就算用户将挖矿木马清除得一干二净，黑客还是可以免密登陆该主机，这也是常见的保持服务器控制权的手段。\u003Cbr>\u003C/span>\u003Cspan>\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>排查~/.ssh/authorized_keys文件，如果发现可疑的SSH公钥，直接删除。\u003C/span>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cstrong>7、清除挖矿木马\u003C/strong>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cstrong>\u003Cspan>（1）清除挖矿进程\u003C/span>\u003C/strong>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>挖矿木马最大的特点就是会在用户不知情的情况下，利用主机的算力进行挖矿，从而消耗主机大量的CPU资源，所以，通过执行如下命令排查系统中占用大量CPU资源的进程。\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003Cbr>\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"properties\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">top\u003C/span> \u003Cspan class=\"code-snippet__string\">-c\u003C/span>\u003C/span>\u003C/code>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">ps\u003C/span> \u003Cspan class=\"code-snippet__string\">-ef\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/6aa247d8242572deda75a4e080895c92.jpg\" alt=\"8 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>确认相关进程为挖矿进程后，按照如下步骤将其清除：\u003Cbr>获取并记录挖矿进程的文件路径：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">ls\u003C/span> -l /proc/\u003Cspan class=\"code-snippet__variable\">$PID\u003C/span>/exe\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>杀死挖矿进程：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"bash\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__built_in\">kill\u003C/span> -9 \u003Cspan class=\"code-snippet__variable\">$PID\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>删除挖矿进程对应的文件\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/2c0d016376dd6e9726aa9610bab964e2.jpg\" alt=\"9 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cstrong>\u003Cspan>（2）清除其它相关恶意进程\u003C/span>\u003C/strong>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>恶意进程与外部的C2服务器进行通信时，往往会开启端口进行监听。执行如下命令，查看服务器是否有未被授权的端口被监听。\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">netstat\u003C/span> -antp\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/67e15d39d20688f80b8f9ec64675a72e.jpg\" alt=\"10 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>若有未授权进程，按照如下步骤将其清除：\u003Cbr>获取并记录未授权进程的文件路径：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">ls\u003C/span> -l /proc/\u003Cspan class=\"code-snippet__variable\">$PID\u003C/span>/exe\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>杀死未授权进程：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"bash\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__built_in\">kill\u003C/span> -9 \u003Cspan class=\"code-snippet__variable\">$PID\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Csection style=\"text-align: justify;\">\u003Cspan>删除未授权进程对应的文件\u003C/span>\u003C/section>\u003Cp style=\"text-align: center;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/bb4b8bf875dba967d673db9555955b71.jpg\" alt=\"11 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>还可以通过如下命令排查近期新增的文件，清除相关木马\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003Cbr>\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"properties\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\"> \u003Cspan class=\"code-snippet__attr\">find\u003C/span> \u003Cspan class=\"code-snippet__string\">/etc -ctime -2 （这里指定目录为/etc，获取近2天内的新增文件）\u003C/span>\u003C/span>\u003C/code>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\"> \u003Cspan class=\"code-snippet__attr\">lsof\u003C/span> \u003Cspan class=\"code-snippet__string\">-c kinsing （这里要查看文件名为kinsing的相关进程信息）\u003C/span>\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: center;\">\u003Cbr>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cp>\u003Cimg src=\"/uploads/layedit/20211110/bf50043d9165f8cdde46d34e4a5c6542.jpg\" alt=\"12 (2).jpg\">\u003Cbr>\u003C/p>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003Cstrong>8、风险排查、安全加固\u003C/strong>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>对系统进行风险排查和安全加固，避免挖矿木马卷土重来，详情可参考如下链接：\u003C/span>\u003Cspan>https://cloud.tencent.com/document/product/296/9604\u003C/span>\u003C/p>\u003Csection data-mpa-template=\"t\" mpa-from-tpl=\"t\" style=\"text-align: justify;\">\u003Csection mpa-from-tpl=\"t\" style=\"text-align: center;\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Csection mpa-from-tpl=\"t\">\u003Cp>\u003Cspan>\u003Cem>\u003Cstrong mpa-from-tpl=\"t\" mpa-is-content=\"t\">四. 常见问题\u003C/strong>\u003C/em>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003Cstrong>1、明明刚刚清理了挖矿木马，没过多久就又卷土重来？\u003C/strong>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>很多用户会反馈挖矿木马老是清理不干净，明明已经Kill了进程，删除了木马文件，没过多久，CPU占用率又上来了。究其根本，还是因为清除得不够彻底。大部分用户都只是Kill掉挖矿进程和对应文件，却没有清理计划任务和守护进程。\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>一般建议先清除计划任务、启动项、守护进程，再清除挖矿进程和其他恶意进程。\u003C/span>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cimg src=\"/uploads/layedit/20211110/ad765c9d5aa7922c53096f9aab27c5f5.jpg\" alt=\"13 (2).jpg\">\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003Cstrong>2、如何判定可疑进程是否为恶意进程？\u003C/strong>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cspan>如下图所示，未知进程kinsing监听本地31458端口，非常可疑，可通过如下方\u003C/span>\u003Cspan>法判定：\u003Cbr>（1）执行`ls -al /proc/$PID/exe`确认可疑进程对应的文件；\u003Cbr>（2）若文件未被删除，则直接上传文件到Virustotal进行检测，或者计算出文件对应的md5，使用md5去Virustotal进行查询；若文件已被删除，可执行`cat /proc/$PID/exe > /tmp/t.bin`将进程dump到特定目录，再上传文件到Virustotal或者计算dump文件对应的md5到Virustotal进行查询。如果有多款杀毒引擎同时检出，那基本可以判定该进程为恶意进程。\u003C/span>\u003C/p>\u003Cp style=\"text-align: center;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/b179d99705c06e8726998fd62e9b3670.jpg\" alt=\"14 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/f28add191d146aa286aeebec4ef0a2ec.jpg\" alt=\"15 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>Virustotal地址：\u003C/span>\u003Cspan>\u003Cem>https://www.virustotal.com/gui/s\u003Cbr>\u003C/em>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>\u003C/span>\u003Cbr>\u003C/p>\u003Csection data-support=\"96编辑器\" data-style-id=\"26041\" style=\"text-align: justify;\">\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Csection>\u003Cbr>\u003C/section>\u003Csection data-form=\"0\" data-num=\"1\" style=\"text-align: center;\">\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003Csection>\u003Cbr>\u003C/section>\u003C/section>\u003Cp>\u003Cspan>\u003Cstrong>3、为什么系统CPU占用率接近100%，却看不到是哪个进程导致的？\u003C/strong>\u003C/span>\u003C/p>\u003C/section>\u003C/section>\u003C/section>\u003C/section>\u003Csection style=\"text-align: justify;\">\u003Cspan>\u003C/span>\u003Cspan>如下图所示，系统CPU占用率接近100%，却看不到是哪个进程导致的，这种情况一般是因为系统命令被木马篡改了，从而隐藏了木马进程的踪迹，让用户无法进行溯源分析。\u003C/span>\u003Cbr>\u003C/section>\u003Cp style=\"text-align: center;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/7ac92285edf0293e5cd2a20b6ca69948.jpg\" alt=\"16 (2).jpg\">\u003Cbr>\u003C/p>\u003Csection style=\"text-align: justify;\">\u003Cspan>命令篡改有多种方式，分别如下：\u003Cbr>（1）top源文件被篡改，恶意进程信息被过滤后返回\u003C/span>\u003C/section>\u003Cp style=\"text-align: center;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cimg src=\"/uploads/layedit/20211110/74024922668ffb4b0ebda2b3e07fc430.jpg\" alt=\"17 (2).jpg\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>通过执行如下命令即可复原：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"nginx\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attribute\">rm\u003C/span> -rf /usr/bin/top && mv /usr/bin/top.original /usr/bin/top\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>【相关文章】\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>\u003C/span>\u003Cspan>\u003Cem>https://blog.csdn.net/chenmozhe22/article/details/112578057\u003C/em>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>（2）篡改预加载so文件，ls、top、ps等命令已经被木马的动态链接库劫持，无法获得木马进程相关的信息\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>\u003Cimg src=\"/uploads/layedit/20211110/a4b38ef8492bf89b0d7f1940eb74e2aa.jpg\" alt=\"18 (2).jpg\">\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>通过执行如下命令即可复原：\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cpre class=\"code-snippet__js\" data-lang=\"javascript\">\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">> \u003Cspan class=\"code-snippet__regexp\">/etc/\u003C/span>ld.so.preload && rm -rf 恶意so文件路径\u003C/span>\u003C/code>\u003C/pre>\u003C/section>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>（3）通过其他未知手段篡改系统命令\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>可分别尝试如下两种方案解决：\u003Cbr>i.从其他相同版本系统中拷贝命令源文件到当前系统中进行覆盖；可使用uname -a命令查看当前系统版本；\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cbr>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>ii.或者安装busybox来对系统进行排查。\u003Cbr>\u003C/span>\u003C/p>\u003Cp style=\"text-align: justify;\">\u003Cspan>busybox是一个集成了300多个最常用Linux命令和工具的软件，可以使用busybox替代系统命令对系统进行排查；\u003C/span>\u003C/p>\u003Csection class=\"code-snippet__fix code-snippet__js\" style=\"text-align: justify;\">\u003Cul class=\"code-snippet__line-index code-snippet__js\">\u003Cli style=\"text-align: right;\">\u003C/li>\u003C/ul>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">yum\u003C/span> \u003Cspan class=\"code-snippet__string\">-y install wget make gcc perl glibc-static ncurses-devel libgcrypt-devel\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">wget\u003C/span> \u003Cspan class=\"code-snippet__string\">http://busybox.net/downloads/busybox-1.33.0.tar.bz2\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">tar\u003C/span> \u003Cspan class=\"code-snippet__string\">-jxvf busybox-1.33.0.tar.bz2\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003Cp>\u003Ccode style=\"text-align: left;\">\u003Cspan class=\"code-snippet_outer\">\u003Cspan class=\"code-snippet__attr\">cd\u003C/span> \u003Cspan class=\"code-snippet__string\">busybox-1.33.0 && make && make install\u003C/span>\u003C/span>\u003C/code>\u003C/p>\u003C/section>\u003Cp>\u003Cspan>【相关文章】\u003C/span>\u003C/p>\u003Cp>\u003Cspan>\u003Cem>https://www.cnblogs.com/angryprogrammer/p/13456681.html\u003C/em>\u003C/span>\u003C/p>","***一、什么是挖矿木马***\n\n   挖矿木马会占用CPU进行超频运算，从而占用主机大量的CPU资源，严重影响服务器上的其他应用的正常运行。黑客为了得到更多的算力资源，一般都会对全网进行无差别扫描，同时利用SSH爆破和漏洞利用等手段攻击主机。\n\n部分挖矿木马还具备蠕虫化的特点，在主机被成功入侵之后，挖矿木马还会向内网渗透，并在被入侵的服务器上持久化驻留以获取最大收益。\n\n挖矿木马的整体攻击流程大致如下图所示：\n\n![1.jpg](/uploads/layedit/20211110/73a83cf25324be000806d35145752664.jpg)\n\n***二、挖矿木马中招特征***\n\n挖矿木马会在用户不知情的情况下利用主机的算力进行挖矿，最明显的特征就是主机的CPU被大量消耗，查看云主机CPU占用率的方法有两种：\n\n**控制台实例监控**\n\n**![2.jpg](/uploads/layedit/20211110/d68438c0482915789a8059a78e24cf78.jpg)\n**\n\n**主机执行TOP命令**\n\n如下图所示，通过执行top命令，即可在返回结果中看到当时系统的CPU占用率。\n\n-\n\n```\ntop -c\n```\n\n![3 (2).jpg](/uploads/layedit/20211110/ab5fcddaf033a9836e9043cc42854e2c.jpg)\n\n如果云主机CPU占用率居高不下，那么主机很有可能已经被植入了挖矿木马，会影响服务器上的其他应用的正常运行，需要立刻上机排查。\n\n***三、清理挖矿木马***\n\n**1、及时隔离主机**\n\n部分带有蠕虫功能的挖矿木马在取得主机的控制权后，会继续对公网的其他主机，或者以当前主机作为跳板机对同一局域网内的其他主机进行横向渗透，所以在发现主机被植入挖矿木马后，在不影响业务正常运行的前提下，应该及时隔离受感染的主机，然后进行下一步分析和清除工作。\n\n腾讯云主机可以通过设置安全组隔离主机，具体参考如下链接：\n\n*https://cloud.tencent.com/document/product/215/20089*\n\n**\n2、阻断异常网络通信\n**\n\n挖矿木马不仅会连接矿池，还有可能会连接黑客的C2服务器，接收并执行C2指令、投递其他恶意木马，所以需要及时进行网络阻断。\n\n（1）检查主机防火墙当前生效的iptables规则中是否存在业务范围之外的可疑地址和端口，它们可能是挖矿木马的矿池或C2地址\n\n-\n\n```\niptables -L -n\n```\n\n（2）从iptables规则中清除可疑地址和端口\n\n-\n\n```\nvi /etc/sysconfig/iptables\n```\n\n（3）阻断挖矿木马的网络通信\n\n-\n\n```\niptables -A INPUT -s 可疑地址 -j DROPiptables -A OUTPUT -d 可疑地址 -j DROP\n```\n\n**3、清除计划任务**\n\n大部分挖矿木马会通过在受感染主机中写入计划任务实现持久化，如果仅仅只是清除挖矿进程，无法将其根除，到了预设的时间点，系统会通过计划任务从黑客的C2服务器重新下载并执行挖矿木马。\n\n挖矿木马常见的计划任务通常是下载并执行sh脚本，如下图所示:\n\n![4.png](/uploads/layedit/20211110/0c2e3c4bc6a62c916a6e21967b68a725.png)\n\n可以通过执行如下命令查看是否存在可疑定时任务，若有，则先保存相关记录用于后续分析，再进行删除：\n\n查看系统当前用户的计划任务：\n\n-\n\n```\ncrontab -l\n```\n\n查看系统特定用户的计划任务：\n\n-\n\n```\ncrontab -u username -l\n```\n\n查看其他计划任务文件：\n\n-\n\n`\n\ncat\n\n/etc/crontab\n\n`\n\n`\n\ncat\n\n/var/spool/cron\n\n`\n\n`\n\ncat\n\n/etc/anacrontab\n\n`\n\n`\n\ncat\n\n/etc/cron.d/\n\n`\n\n`\n\ncat\n\n/etc/cron.daily/\n\n`\n\n`\n\ncat\n\n/etc/cron.hourly/\n\n`\n\n`\n\ncat\n\n/etc/cron.weekly/\n\n`\n\n`\n\ncat\n\n/etc/cron.monthly/\n\n`\n\n`\n\ncat\n\n/var/spool/cron/\n\n`\n\n**4、清除启动项**\n\n除了计划任务，挖矿木马通过添加启动项同样能实现持久化。可以使用如下命令查看开机启动项中是否有异常的启动服务。\n\nCentOS7以下版本：\n\n-\n\n```\nchkconfig –list\n```\n\nCentOS7及以上版本：\n\n-\n\n```\nsystemctl list-unit-files\n```\n\n如果发现有恶意启动项，可以通过如下命令进行关闭：\n\nCentOS7以下版本：\n\n-\n\n```\nchkconfig 服务名 off\n```\n\nCentOS7及以上版本：\n\n-\n\n```\nsystemctl disable 服务名\n```\n\n另外，还需要仔细排查以下目录及文件，及时删除可疑的启动项：\n\n-\n\n`\n/usr/lib/systemd/system\n`\n\n`\n/usr/lib/systemd/system/multi-user.target.wants\n`\n\n`\n/etc/rc.local\n`\n\n`\n/etc/inittab\n`\n\n`\n/etc/rc0.d/\n`\n\n`\n\n/etc/\nrc1.d/\n`\n\n`\n\n/etc/\nrc2.d/\n`\n\n`\n\n/etc/\nrc3.d/\n`\n\n`\n\n/etc/\nrc4.d/\n`\n\n`\n\n/etc/\nrc5.d/\n`\n\n`\n\n/etc/\nrc6.d/\n`\n\n`\n\n/etc/\nrc.d/\n`\n\n排查的时候，可以按照文件修改时间来排序，重点排查近期被创建服务项。如下图所示，系统近期被创建了一个名为bot.service的服务，该服务在系统启动时会启动/etc/kinsing这个木马文件，需要关闭bot服务，并删除/etc/kinsing文件。\n\n![5.jpg](/uploads/layedit/20211110/3cd9e620ab95ebe7de5ca4753f69c5e5.jpg)\n\n![6 (2).jpg](/uploads/layedit/20211110/1fbc612b14c0914856f326a2537f279c.jpg)\n\n**5、清除预加载so**\n\n通\n\n过配置/etc/ld.so.preload，可以自定义程序运行前优先加载的动态链接库，部分木马通过修改该文\n\n件，添加恶意so文件，从而实现挖矿进程的隐藏等恶意功能。\n\n检查/etc/ld.so.preload（该文件默认为空），清除异常的动态链接库。可以执行`> /etc/ld.so.preload`命令进行清除。\n\n![7 (2).jpg](/uploads/layedit/20211110/58655aa5bbb2e5b77eb4d4fc24df6ccf.jpg)\n\n**6、清除SSH公钥**\n\n挖矿木马通常还会在~/.ssh/authoruzed_keys文件中写入黑客的SSH公钥，这样子就算用户将挖矿木马清除得一干二净，黑客还是可以免密登陆该主机，这也是常见的保持服务器控制权的手段。\n\n排查~/.ssh/authorized_keys文件，如果发现可疑的SSH公钥，直接删除。\n\n**7、清除挖矿木马**\n\n**\n（1）清除挖矿进程\n**\n\n挖矿木马最大的特点就是会在用户不知情的情况下，利用主机的算力进行挖矿，从而消耗主机大量的CPU资源，所以，通过执行如下命令排查系统中占用大量CPU资源的进程。\n\n-\n\n```\ntop -cps -ef\n```\n\n![8 (2).jpg](/uploads/layedit/20211110/6aa247d8242572deda75a4e080895c92.jpg)\n\n确认相关进程为挖矿进程后，按照如下步骤将其清除：\n获取并记录挖矿进程的文件路径：\n\n-\n\n```\nls -l /proc/$PID/exe\n```\n\n杀死挖矿进程：\n\n-\n\n```\nkill -9 $PID\n```\n\n删除挖矿进程对应的文件\n\n![9 (2).jpg](/uploads/layedit/20211110/2c0d016376dd6e9726aa9610bab964e2.jpg)\n\n**\n（2）清除其它相关恶意进程\n**\n\n恶意进程与外部的C2服务器进行通信时，往往会开启端口进行监听。执行如下命令，查看服务器是否有未被授权的端口被监听。\n\n-\n\n```\nnetstat -antp\n```\n\n![10 (2).jpg](/uploads/layedit/20211110/67e15d39d20688f80b8f9ec64675a72e.jpg)\n\n若有未授权进程，按照如下步骤将其清除：\n获取并记录未授权进程的文件路径：\n\n-\n\n```\nls -l /proc/$PID/exe\n```\n\n杀死未授权进程：\n\n-\n\n```\nkill -9 $PID\n```\n\n删除未授权进程对应的文件\n\n![11 (2).jpg](/uploads/layedit/20211110/bb4b8bf875dba967d673db9555955b71.jpg)\n\n还可以通过如下命令排查近期新增的文件，清除相关木马\n\n-\n\n```\nfind /etc -ctime -2 （这里指定目录为/etc，获取近2天内的新增文件） lsof -c kinsing （这里要查看文件名为kinsing的相关进程信息）\n```\n\n![12 (2).jpg](/uploads/layedit/20211110/bf50043d9165f8cdde46d34e4a5c6542.jpg)\n\n**8、风险排查、安全加固**\n\n对系统进行风险排查和安全加固，避免挖矿木马卷土重来，详情可参考如下链接：\n\nhttps://cloud.tencent.com/document/product/296/9604\n\n***四. 常见问题***\n\n**1、明明刚刚清理了挖矿木马，没过多久就又卷土重来？**\n\n很多用户会反馈挖矿木马老是清理不干净，明明已经Kill了进程，删除了木马文件，没过多久，CPU占用率又上来了。究其根本，还是因为清除得不够彻底。大部分用户都只是Kill掉挖矿进程和对应文件，却没有清理计划任务和守护进程。\n\n一般建议先清除计划任务、启动项、守护进程，再清除挖矿进程和其他恶意进程。\n\n![13 (2).jpg](/uploads/layedit/20211110/ad765c9d5aa7922c53096f9aab27c5f5.jpg)\n\n**2、如何判定可疑进程是否为恶意进程？**\n\n如下图所示，未知进程kinsing监听本地31458端口，非常可疑，可通过如下方\n\n法判定：\n（1）执行`ls -al /proc/$PID/exe`确认可疑进程对应的文件；\n（2）若文件未被删除，则直接上传文件到Virustotal进行检测，或者计算出文件对应的md5，使用md5去Virustotal进行查询；若文件已被删除，可执行`cat /proc/$PID/exe > /tmp/t.bin`将进程dump到特定目录，再上传文件到Virustotal或者计算dump文件对应的md5到Virustotal进行查询。如果有多款杀毒引擎同时检出，那基本可以判定该进程为恶意进程。\n\n![14 (2).jpg](/uploads/layedit/20211110/b179d99705c06e8726998fd62e9b3670.jpg)\n\n![15 (2).jpg](/uploads/layedit/20211110/f28add191d146aa286aeebec4ef0a2ec.jpg)\n\nVirustotal地址：\n\n*https://www.virustotal.com/gui/s\n*\n\n**3、为什么系统CPU占用率接近100%，却看不到是哪个进程导致的？**\n\n如下图所示，系统CPU占用率接近100%，却看不到是哪个进程导致的，这种情况一般是因为系统命令被木马篡改了，从而隐藏了木马进程的踪迹，让用户无法进行溯源分析。\n\n![16 (2).jpg](/uploads/layedit/20211110/7ac92285edf0293e5cd2a20b6ca69948.jpg)\n\n命令篡改有多种方式，分别如下：\n（1）top源文件被篡改，恶意进程信息被过滤后返回\n\n![17 (2).jpg](/uploads/layedit/20211110/74024922668ffb4b0ebda2b3e07fc430.jpg)\n\n通过执行如下命令即可复原：\n\n-\n\n```\nrm -rf /usr/bin/top && mv /usr/bin/top.original /usr/bin/top\n```\n\n【相关文章】\n\n*https://blog.csdn.net/chenmozhe22/article/details/112578057*\n\n（2）篡改预加载so文件，ls、top、ps等命令已经被木马的动态链接库劫持，无法获得木马进程相关的信息\n\n![18 (2).jpg](/uploads/layedit/20211110/a4b38ef8492bf89b0d7f1940eb74e2aa.jpg)\n\n通过执行如下命令即可复原：\n\n-\n\n```\n> /etc/ld.so.preload && rm -rf 恶意so文件路径\n```\n\n（3）通过其他未知手段篡改系统命令\n\n可分别尝试如下两种方案解决：\ni.从其他相同版本系统中拷贝命令源文件到当前系统中进行覆盖；可使用uname -a命令查看当前系统版本；\n\nii.或者安装busybox来对系统进行排查。\n\nbusybox是一个集成了300多个最常用Linux命令和工具的软件，可以使用busybox替代系统命令对系统进行排查；\n\n-\n\n`\n\nyum\n\n-y install wget make gcc perl glibc-static ncurses-devel libgcrypt-devel\n\n`\n\n`\n\nwget\n\nhttp://busybox.net/downloads/busybox-1.33.0.tar.bz2\n\n`\n\n`\n\ntar\n\n-jxvf busybox-1.33.0.tar.bz2\n\n`\n\n`\n\ncd\n\nbusybox-1.33.0 && make && make install\n\n`\n\n【相关文章】\n\n*https://www.cnblogs.com/angryprogrammer/p/13456681.html*","/article/108",5333,"2021-11-10 12:06:10","2021-11-10 12:41:03",[156,157,158],{"id":39,"name":81,"url":82},{"id":44,"name":23,"url":59},{"id":145,"name":146,"url":151},{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"title":161,"url":162},"CentOS7 开启 NSCD 缓存服务减少DNS集群请求压力","/article/109",{"title":164,"url":165},"Acme.sh 给 SSL 证书自动续期失败的解决方法","/article/107",[167,168,169,170],{"create_time":6,"description":6,"id":44,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":23,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":53,"subtitle":6,"update_time":6,"url":59},{"create_time":6,"description":6,"id":45,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":61,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":56,"subtitle":6,"update_time":6,"url":62},{"create_time":6,"description":6,"id":46,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":64,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":65,"subtitle":6,"update_time":6,"url":66},{"create_time":6,"description":6,"id":47,"image_url":6,"index_template":52,"is_cover":53,"is_menu":53,"keywords":6,"list_template":54,"model_code":55,"model_id":56,"model_name":57,"name":68,"parent_id":39,"seo_description":6,"seo_keywords":6,"seo_title":6,"show_template":58,"sort":69,"subtitle":6,"update_time":6,"url":70},{"description":148,"keywords":147,"title":146},[173,182,191,200,209,218,225,234,243,251],{"id":174,"category_id":44,"title":175,"keywords":176,"description":177,"image_url":6,"url":178,"hits":179,"is_recommend":73,"is_top":73,"create_time":180,"update_time":181},101,"开启 HTTPS 并获得 ssllabs 满分的过程","开启,获得,满分,过程","准备工作确保你要申请证书的域名都解析到了这台服务器上，且能直接通过域名访问。使用官网推荐的CertBot获取证书。在CertBot官网选择一下环境(比如我选Nginx on Ubuntu 17.04)就可以看到入门教程了。安装CertBot12345apt-get updateapt-get install software-properties-commonadd-apt-repository ppa:certbot/certbotapt-get updateapt-get","/article/101",18546,"2019-11-26 16:12:11","2019-11-26 16:23:16",{"id":183,"category_id":44,"title":184,"keywords":185,"description":186,"image_url":6,"url":187,"hits":188,"is_recommend":73,"is_top":73,"create_time":189,"update_time":190},113,"在CentOS 7中添加命令自动补全功能","命令自动补全,centos","在CentOS 7中，默认情况下并不会安装命令补全包，需要手动安装才能使用命令补全功能。以下是在CentOS 7中安装命令补全包的方法：1. bash-completion：这是一个针对Bash shell的命令补全软件包，可以提供对系统命令、用户自定义命令和文件路径的自动补全功能。可以通过以下命令安装：```sudo yum install bash-completion```安装完成后，需要在/etc/profile配置文件中添加以下内容：```if [ -f /etc/bash_compl","/article/113",14948,"2023-05-16 10:54:01","2023-05-16 10:57:28",{"id":192,"category_id":44,"title":193,"keywords":194,"description":195,"image_url":6,"url":196,"hits":197,"is_recommend":53,"is_top":73,"create_time":198,"update_time":199},94,"Centos7 安装 openvas ","openvas,开放式漏洞评估系统，installing openvas centos-7","一、描述OpenVAS，即开放式漏洞评估系统，是一个用于评估目标漏洞的杰出框架。功能十分强大，最重要的是，它是“开源”的——就是免费的意思啦～它与著名的Nessus“本是同根生”，在Nessus商业化之后仍然坚持开源，号称“当前最好用的开源漏洞扫描工具”。最新版的Kali Linux(kali 3.0)不再自带OpenVAS了，所以我们要自己部署OpenVAS漏洞检测系统。其核心部件是一个服务器，包括一套网络漏洞测试程序，可以检测远程系统和应用程序中的安全问题。但是它的最常用用途是检测目标网络或","/article/94",14690,"2019-01-14 17:43:42","2019-01-14 18:16:36",{"id":201,"category_id":44,"title":202,"keywords":203,"description":204,"image_url":6,"url":205,"hits":206,"is_recommend":73,"is_top":73,"create_time":207,"update_time":208},99,"Centos7 利用iptables防止nmap工具防端口扫描","iptables","一、Nmap介绍       Nmap（NetworkMapper）是一款开放源代码的网络探测和安全审核工具。它用于快速扫描一个网络和一台主机开放的端口，还能使用TCP/IP协议栈特征探测远程主机的操作系统类型。nmap支持很多扫描技术，例如：UDP、TCPconnect()、TCPSYN(半开扫描)、ftp代理(bounce攻击)、反向标志、ICMP、FIN、ACK扫描、圣诞树(XmasTree)、SYN扫描和null扫描。Nmap最初是用于Unix系统","/article/99",14415,"2019-07-09 21:27:00","2019-07-09 21:57:53",{"id":210,"category_id":46,"title":211,"keywords":212,"description":213,"image_url":6,"url":214,"hits":215,"is_recommend":73,"is_top":73,"create_time":216,"update_time":217},61,"Docker 推荐的启动方式","推荐,启动,方式","# cat DockerfileFROM openjdk:8-alpineWORKDIR /ADD ./target/*.jar app.jarEXPOSE 9999COPY docker-entrypoint.sh /RUN chmod +x /docker-entrypoint.shENTRYPOINT [“/docker-entrypoint.sh”]CMD [“java”,”-server”,”-Duser.timezone=GMT+08″,”-jar”,”/app.jar”]# cat","/article/61",14347,"2018-10-22 13:55:47","2018-10-22 13:56:10",{"id":219,"category_id":44,"title":164,"keywords":220,"description":221,"image_url":6,"url":165,"hits":222,"is_recommend":73,"is_top":73,"create_time":223,"update_time":224},107,"HTTP/1.1 200 OK,Server: Bayou Tech Web Srv 1.0,Content-Encoding: none,Content-Length: 5,Content-Type","一、Acme.sh 自动续期失败的症状问题描述如下，续期的时候，提示如下错误：root@dc:~# \"/data/acme.sh\"/acme.sh --cron --home \"/data/acme.sh\" > /dev/null[Sun Nov 10 23:52:17 CST 2020] Error, can not get domain token entry example.com[Sun Nov 10 23:52:17 CST 2020] Please check log file",12618,"2021-09-03 10:44:18","2021-09-03 10:46:23",{"id":226,"category_id":44,"title":227,"keywords":228,"description":229,"image_url":6,"url":230,"hits":231,"is_recommend":53,"is_top":73,"create_time":232,"update_time":233},93,"ELK+Filebeat+Kafka+ZooKeeper 构建海量日志分析平台","Filebeat,Kafka","一、说明1.Filebeat是一个日志文件托运工具，在你的服务器上安装客户端后，filebeat会监控日志目录或者指定的日志文件，追踪读取这些文件（追踪文件的变化，不停的读）2.Kafka是一种高吞吐量的分布式发布订阅消息系统，它可以处理消费者规模的网站中的所有动作流数据3.Logstash是一根具备实时数据传输能力的管道，负责将数据信息从管道的输入端传输到管道的输出端；与此同时这根管道还可以让你根据自己的需求在中间加上滤网，Logstash提供里很多功能强大的滤网以满足你的各种应用场景4.El","/article/93",12190,"2018-12-24 16:40:08","2018-12-26 11:53:38",{"id":235,"category_id":46,"title":236,"keywords":237,"description":238,"image_url":6,"url":239,"hits":240,"is_recommend":53,"is_top":73,"create_time":241,"update_time":242},81,"kubernetes 1.12.1 高可用安装之部署Dashboard","安装Dashboard","创建Dashboard需要CoreDNS部署成功之后再安装Dashboard。[root@master01 ~]# wget https://zhl123.com/download/k8s/Dashboard.tgz[root@master01 ~]# tar xf Dashboard.tgz[root@master01 ~]# kubectl create -f Dashboard/[root@master01 Dashboard]# kubectl get svc -n kube-syste","/article/81",12037,"2018-10-26 09:54:41","2018-10-26 16:59:19",{"id":244,"category_id":44,"title":245,"keywords":6,"description":246,"image_url":6,"url":247,"hits":248,"is_recommend":73,"is_top":73,"create_time":249,"update_time":250},100,"用 Nginx 给 Cookie 增加 Secure 和 HttpOnly","在 nginx 的 location 中配置12# 只支持 proxy 模式下设置，SameSite 不需要可删除，如果想更安全可以把 SameSite 设置为 Strictproxy_cookie_path / \"/; httponly; secure; SameSite=Lax\";示例1234567891011121314151617181920212223242526server {    listen 443 ssl http2;    server_name www.zhl123.cn","/article/100",11848,"2019-11-26 16:10:57","2019-11-26 16:23:45",{"id":252,"category_id":44,"title":253,"keywords":254,"description":255,"image_url":6,"url":256,"hits":257,"is_recommend":73,"is_top":73,"create_time":258,"update_time":259},41,"Tomcat 安全配置与性能优化","tomcat，性能优化","1. JVM 1.1. 使用 Server JRE 替代JDK。 服务器上不要安装JDK，请使用 Server JRE. 服务器上根本不需要编译器，代码应该在Release服务器上完成编译打包工作。 理由：一旦服务器被控制，可以防止在其服务器上编译其他恶意代码并植入到你的程序中。 1.2. JAVA_OPTS export JAVA_OPTS=\"-server -Xms512m -Xmx4096m  -XX:PermSize=64M -","/article/41",11623,"2016-09-01 17:06:36","2018-10-18 17:06:58",[261,269,277,285,293,301,309,317,326,335],{"id":262,"category_id":40,"title":263,"keywords":6,"description":264,"image_url":6,"url":265,"hits":266,"is_recommend":73,"is_top":73,"create_time":267,"update_time":268},123,"Agent Skill 精选集：最值得收藏的 Agent Skills Top 10","如果你正在用 Claude Code 或 Codex，一定对 Agent Skills 不陌生。通过安装 Agent Skills，你可以让这些 AI 助手变得更强——不用每次都解释你的需求，它们直接就知道该怎么做。最近有人在 GitHub 上做了一个采样调查，统计了哪些 Skills 的质量最佳和最受欢迎。我整理了这份 Top 10 榜单，加上使用场景和适合人群，帮你快速找到最有用的那几个。Top 10 最受欢迎的 Agent Skills1. Skil","/article/123",270,"2026-01-19 18:49:12","2026-01-19 18:52:01",{"id":270,"category_id":44,"title":271,"keywords":6,"description":272,"image_url":6,"url":273,"hits":274,"is_recommend":73,"is_top":73,"create_time":275,"update_time":276},122,"Nginx性能调优18条黄金法则：支撑10万并发的配置模板","一、概述1.1 背景介绍说实话，Nginx调优这事儿我踩过无数坑。记得2019年双11，我们电商平台流量暴涨，Nginx直接扛不住了，QPS从平时的2万飙升到8万，响应时间从50ms飙到了2秒，最后还是靠临时加机器扛过去的。那次事故之后，我花了大半年时间专门研究Nginx的性能极限，总结出了这20条黄金法则。Nginx作为目前最流行的Web服务器和反向代理，官方数据显示单机可以轻松处理10万+的并发连接。但实际生产环境中，很多同学拿到默认配置就直接上了，结果发现连1万并发都扛不住。问题不在Ngi","/article/122",337,"2026-01-12 11:11:50","2026-01-12 11:12:28",{"id":278,"category_id":46,"title":279,"keywords":6,"description":280,"image_url":6,"url":281,"hits":282,"is_recommend":73,"is_top":73,"create_time":283,"update_time":284},121,"Docker 镜像优化与安全扫描：将镜像体积压缩 70%","1. 适用场景 & 前置条件项目要求适用场景容器化应用镜像体积过大（> 500MB），构建时间长（> 10分钟），存在安全漏洞（CVE高危）OSRHEL/CentOS 7.9+ 或 Ubuntu 20.04+内核Linux Kernel 3.10+软件版本Docker 20.10+ 或 Podman 3.0+，Trivy 0.40+（安全扫描工具）资源规格2C4G（最小）/ 4C8G（推荐），磁盘 50GB+（存储镜像与缓存）网络可访问 Docker Hub/阿里云镜像仓库（","/article/121",309,"2026-01-06 11:54:35","2026-01-06 12:01:59",{"id":286,"category_id":44,"title":287,"keywords":6,"description":288,"image_url":6,"url":289,"hits":290,"is_recommend":73,"is_top":73,"create_time":291,"update_time":292},120,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(二)","五、故障排查和监控5.1 故障排查◆ 5.1.1 日志查看# 查看 Prometheus 日志中的规则评估错误journalctl -u prometheus | grep -i \"rule\" | tail -50# 查看规则评估耗时curl -s http://localhost:9090/api/v1/rules | jq '.data.groups[].rules[] | select(.health != \"ok\")'# Kubernet","/article/120",282,"2026-01-06 11:53:50","2026-01-06 11:54:33",{"id":294,"category_id":44,"title":295,"keywords":6,"description":296,"image_url":6,"url":297,"hits":298,"is_recommend":73,"is_top":73,"create_time":299,"update_time":300},119,"用 Prometheus Recording Rules 把告警噪声砍掉 70%(一)","一、概述1.1 背景介绍在大规模微服务架构下，Prometheus 告警系统往往会陷入一个尴尬的境地：告警太多，运维团队开始选择性忽略；告警太少，真正的故障又可能漏掉。我在某电商平台负责监控体系建设时，团队每天要处理超过 2000 条告警，其中 70% 以上是重复的、关联的或者短暂抖动产生的噪声。Recording Rules 是 Prometheus 提供的预计算机制，可以将复杂的查询表达式预先计算并存储为新的时间序列。通过合理设计 Recording Rules，我们不仅能显著降低 Prom","/article/119",301,"2026-01-06 11:51:58","2026-01-06 11:53:45",{"id":302,"category_id":44,"title":303,"keywords":6,"description":304,"image_url":6,"url":305,"hits":306,"is_recommend":73,"is_top":73,"create_time":307,"update_time":308},118,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(二)","四、最佳实践和注意事项4.1 最佳实践4.1.1 性能优化优化点一：减少 Git 轮询频率# argocd-cm ConfigMapapiVersion: v1kind: ConfigMapmetadata:  name: argocd-cm  namespace: argocddata:  timeout.reconciliation: 300s  # 默认 180","/article/118",305,"2026-01-06 11:49:00","2026-01-06 11:49:34",{"id":310,"category_id":44,"title":311,"keywords":6,"description":312,"image_url":6,"url":313,"hits":314,"is_recommend":73,"is_top":73,"create_time":315,"update_time":316},117,"GitOps 落地实践：ArgoCD + Kustomize 实现声明式基础设施管理(一)","一、概述1.1 背景介绍GitOps 作为云原生时代的运维范式，将 Git 作为基础设施和应用配置的单一事实来源，通过声明式配置和自动化同步机制，实现了配置管理的版本控制、审计追溯和快速回滚。ArgoCD 作为 CNCF 毕业项目，提供了完整的 GitOps 工作流，支持多集群管理、RBAC 权限控制、SSO 集成等企业级特性。结合 Kustomize 的配置管理能力，能够优雅地解决多环境配置差异、敏感信息管理、配置复用等问题。在传统的 CI/CD 流程中，往往由 CI 工具直接执行 kubec","/article/117",310,"2026-01-06 11:45:03","2026-01-06 11:48:56",{"id":318,"category_id":40,"title":319,"keywords":320,"description":321,"image_url":6,"url":322,"hits":323,"is_recommend":73,"is_top":73,"create_time":324,"update_time":325},116,"运维部门年度2025工作总结与2026工作规划应该如何写？","运维部门年度2025工作总结,2026工作规划","2025年，运维部在公司“数字化转型深化”战略引领下，以“稳定为基、效率为纲、安全为盾、创新为翼”为核心导向，全面支撑核心业务系统运行、推动技术架构迭代、强化团队能力建设。 全年实现核心业务系统可用性99.985%，较2024年提升0.02个百分点；故障平均恢复时间（MTTR）从42分钟压缩至29分钟，下降31%；云资源成本同比降低16.8%，自动化运维覆盖率从65%提升至83%，未发生重大生产安全事故，圆满完成年度目标。现将全年工作及2026年规划汇报如下：2025年核心工作成果（数","/article/116",297,"2026-01-06 11:20:58","2026-01-06 11:44:04",{"id":327,"category_id":40,"title":328,"keywords":329,"description":330,"image_url":6,"url":331,"hits":332,"is_recommend":73,"is_top":73,"create_time":333,"update_time":334},115,"Kubernetes 100个常用命令","100 个 Kubectl 命令","这篇文章是关于使用 Kubectl 进行 Kubernetes 诊断的指南。列出了 100 个 Kubectl 命令，这些命令对于诊断 Kubernetes 集群中的问题非常有用。这些问题包括但不限于：• 集群信息• Pod 诊断• 服务诊断• 部署诊断• 网络诊断• 持久卷和持久卷声明诊断• 资源使用情况• 安全和授权• 节点故障排除• 其他诊断命令：文章还提到了许多其他命令，如资源扩展和自动扩","/article/115",3642,"2023-11-02 14:09:30","2023-11-02 14:10:05",{"id":183,"category_id":44,"title":184,"keywords":185,"description":186,"image_url":6,"url":187,"hits":188,"is_recommend":73,"is_top":73,"create_time":189,"update_time":190},1784716028653]