全球主机交流论坛

标题: EasyRealM脚本莫名奇妙多了一个名称叫1的进程是啥 [打印本页]
作者: gupo    时间: 2023-5-10 23:35
标题: EasyRealM脚本莫名奇妙多了一个名称叫1的进程是啥
项目地址：
https://github.com/seal0207/EasyRealM
我就git clone了下，也没用它安装realm，今天突然发现多了一个叫1的进程，监听了我的2019端口，目录里面也多了一个名称为1的可执行文件，如下图：



尝试运行了一下那个文件：

佬们知道这是什么鬼嘛？二进制文件已上传(本人域名已被墙)：
https://yun.vpsxb.net/download/1
作者: HOH    时间: 2023-5-10 23:39
目测这个1就是realm，如果是几MB的话那肯定就是了，GO屙出来的东西又臃又肿
作者: gupo    时间: 2023-5-10 23:40
HOH 发表于 2023-5-10 23:39
目测这个1就是realm

可是我没运行过这个脚本，只是clone了一下项目
作者: sebaobao1205    时间: 2023-5-10 23:47
realm都绿了你告诉我没动过
作者: gupo    时间: 2023-5-10 23:47
HOH 发表于 2023-5-10 23:39
目测这个1就是realm，如果是几MB的话那肯定就是了，GO屙出来的东西又臃又肿

12M
作者: gupo    时间: 2023-5-10 23:49
sebaobao1205 发表于 2023-5-10 23:47
realm都绿了你告诉我没动过

那个realm.sh，是我刚刚加的执行权限，想看一下，我有没有用它安装过realm，
作者: gupo    时间: 2023-5-10 23:50
sebaobao1205 发表于 2023-5-10 23:47
realm都绿了你告诉我没动过

运行那个脚本后是这样：

而且这个脚本是加了密的……看不到具体啥内容……
作者: 言和    时间: 2023-5-10 23:51
cat ~/.bash_history
作者: gupo    时间: 2023-5-11 00:00
言和 发表于 2023-5-10 23:51
cat ~/.bash_history

好像也没看到啥奇怪的命令……
作者: gupo    时间: 2023-5-11 00:38
找到日志了：
  1. 2023/05/08 15:48:24 [SERVER]--Started, c: 5, m: 40, client #: 5, ip: 10.0.4.1/29, web: http://10.0.4.2:80, mode: web
  2. 2023/05/08 15:55:28 [SERVER]--New client leased IP 10.0.4.4/29
  3. 2023/05/08 15:55:28 [STREAM]--Client 4,#32 started
  4. 2023/05/08 15:55:28 [STREAM]--Client 4,#40 started
  5. 2023/05/08 15:55:28 [STREAM]--Client 4,#2 started
  6. 2023/05/08 15:55:28 [STREAM]--Client 4,#18 started
  7. 2023/05/08 15:55:28 [STREAM]--Client 4,#26 started
  8. 2023/05/08 15:55:29 [STREAM]--Client 4,#0 started
  9. 2023/05/08 15:55:29 [STREAM]--Client 4,#4 started
  10. 2023/05/08 15:55:29 [STREAM]--Client 4,#20 started
  11. 2023/05/08 15:55:30 [STREAM]--Client 4,#34 started
  12. 2023/05/08 15:55:33 [STREAM]--Client 4,#36 started
  13. 2023/05/08 15:55:33 [STREAM]--Client 4,#33 started
  14. 2023/05/08 15:55:33 [STREAM]--Client 4,#12 started
  15. 2023/05/08 15:55:34 [STREAM]--Client 4,#8 started
  16. 2023/05/08 15:55:34 [STREAM]--Client 4,#24 started
  17. 2023/05/08 15:55:38 [STREAM]--Client 4,#22 started
  18. 2023/05/08 15:55:39 [STREAM]--Client 4,#28 started
  19. 2023/05/08 15:55:40 [STREAM]--Client 4,#10 started
  20. 2023/05/08 15:55:48 [STREAM]--Client 4,#32 exited: rpc error: code = Unknown desc = inactivity
  21. 2023/05/08 15:55:48 [STREAM]--Client 4,#2 exited: rpc error: code = Unknown desc = inactivity
  22. 2023/05/08 15:55:48 [STREAM]--Client 4,#18 exited: rpc error: code = Unknown desc = inactivity
  23. 2023/05/08 15:55:48 [STREAM]--Client 4,#26 exited: rpc error: code = Unknown desc = inactivity
  24. 2023/05/08 15:55:49 [STREAM]--Client 4,#0 exited: rpc error: code = Unknown desc = inactivity
  25. 2023/05/08 15:55:49 [STREAM]--Client 4,#4 exited: rpc error: code = Unknown desc = inactivity
  26. 2023/05/08 15:55:49 [STREAM]--Client 4,#20 exited: rpc error: code = Unknown desc = inactivity
  27. 2023/05/08 15:55:49 [STREAM]--Client 4,#14 started
  28. 2023/05/08 15:55:49 [STREAM]--Client 4,#30 started
  29. 2023/05/08 15:55:49 [STREAM]--Client 4,#32 started
  30. 2023/05/08 15:55:49 [STREAM]--Client 4,#4 started
  31. 2023/05/08 15:55:50 [STREAM]--Client 4,#34 exited: rpc error: code = Unknown desc = inactivity
  32. 2023/05/08 15:55:50 [STREAM]--Client 4,#0 started
  33. 2023/05/08 15:55:53 [STREAM]--Client 4,#36 exited: rpc error: code = Unknown desc = inactivity
  34. 2023/05/08 15:55:53 [STREAM]--Client 4,#33 exited: rpc error: code = Unknown desc = inactivity
  35. 2023/05/08 15:55:53 [STREAM]--Client 4,#2 started
  36. 2023/05/08 15:55:53 [STREAM]--Client 4,#12 exited: rpc error: code = Unknown desc = inactivity
  37. 2023/05/08 15:55:53 [STREAM]--Client 4,#18 started
  38. 2023/05/08 15:55:54 [STREAM]--Client 4,#8 exited: rpc error: code = Unknown desc = inactivity
  39. 2023/05/08 15:55:54 [STREAM]--Client 4,#24 exited: rpc error: code = Unknown desc = inactivity
  40. 2023/05/08 15:55:54 [STREAM]--Client 4,#26 started
  41. 2023/05/08 15:55:54 [STREAM]--Client 4,#12 started
  42. 2023/05/08 15:55:54 [STREAM]--Client 4,#6 started
  43. 2023/05/08 15:55:55 [STREAM]--Client 4,#24 started
  44. 2023/05/08 15:55:57 [STREAM]--Client 4,#8 started
  45. 2023/05/08 15:55:58 [STREAM]--Client 4,#22 exited: rpc error: code = Unknown desc = inactivity
  46. 2023/05/08 15:55:58 [STREAM]--Client 4,#20 started
  47. 2023/05/08 15:55:59 [STREAM]--Client 4,#28 exited: rpc error: code = Unknown desc = inactivity
  48. 2023/05/08 15:55:59 [STREAM]--Client 4,#38 started
  49. 2023/05/08 15:56:00 [STREAM]--Client 4,#10 exited: rpc error: code = Unknown desc = inactivity
  50. 2023/05/08 15:56:00 [STREAM]--Client 4,#28 started
  51. 2023/05/08 15:56:03 [STREAM]--Client 4,#22 started
  52. 2023/05/08 15:56:04 [STREAM]--Client 4,#16 started
  53. 2023/05/08 15:56:04 [STREAM]--Client 4,#36 started
  54. 2023/05/08 15:56:08 [STREAM]--Client 4,#10 started
  55. 2023/05/08 15:56:09 [STREAM]--Client 4,#14 exited: rpc error: code = Unknown desc = inactivity
  56. 2023/05/08 15:56:09 [STREAM]--Client 4,#30 exited: rpc error: code = Unknown desc = inactivity
  57. 2023/05/08 15:56:09 [STREAM]--Client 4,#32 exited: rpc error: code = Unknown desc = inactivity
  58. 2023/05/08 15:56:09 [STREAM]--Client 4,#4 exited: rpc error: code = Unknown desc = inactivity
  59. 2023/05/08 15:56:10 [STREAM]--Client 4,#14 started
  60. 2023/05/08 15:56:10 [STREAM]--Client 4,#0 exited: rpc error: code = Unknown desc = inactivity
  61. 2023/05/08 15:56:10 [STREAM]--Client 4,#30 started
复制代码
作者: gupo    时间: 2023-5-11 08:26
破案了，跟脚本没关系，ssh被爆破了…
作者: tomcb    时间: 2023-5-11 08:39
这东西的配置那么简单，照说明复制粘贴就好了，用这些加密的脚本干嘛呢？
作者: gupo    时间: 2023-5-11 09:24
tomcb 发表于 2023-5-11 08:39
这东西的配置那么简单，照说明复制粘贴就好了，用这些加密的脚本干嘛呢？ ...

我是好久之前写的首次开机教程，clone了几个常见的脚本仓库。应该不是脚本的问题，是我机器被爆破了，小丑是我自己



欢迎光临 全球主机交流论坛 (https://loc.888543.xyz/) Powered by Discuz! X3.4