记一次飞牛fnOS持久化后门事件：系统更新被阻断的幕后黑手

# 检查启动脚本是否被篡改
grep -E "wget|curl|151.240|43.198" /usr/trim/bin/system_startup.sh

# 检查是否有被锁定的文件
lsattr /var/tmp/trim-update 2>/dev/null | grep "i"
lsattr /usr/trim/bin/system_startup.sh 2>/dev/null | grep "i"

# 检查异常进程
ps aux | grep -E "turmp|151.240|43.198"

#!/bin/bash
# fnOS 持久化后门检测脚本

echo "=== fnOS 持久化后门检测 ==="
echo ""

# 检查启动脚本
echo "[1] 检查启动脚本..."
if grep -qE "wget|curl|151.240|43.198" /usr/trim/bin/system_startup.sh 2>/dev/null; then
    echo "    ⚠️  警告: 启动脚本包含可疑命令!"
    grep -E "wget|curl|151.240|43.198" /usr/trim/bin/system_startup.sh
else
    echo "    ✅ 启动脚本正常"
fi

# 检查immutable文件
echo ""
echo "[2] 检查被锁定的文件..."
locked_files=$(find /var/tmp /usr/trim -type f -exec lsattr {} \; 2>/dev/null | grep "^....i" | awk '{print $2}')
if [ -n "$locked_files" ]; then
    echo "    ⚠️  警告: 发现被锁定的文件:"
    echo "$locked_files" | while read f; do echo "       - $f"; done
else
    echo "    ✅ 未发现异常锁定的文件"
fi

# 检查恶意进程
echo ""
echo "[3] 检查恶意进程..."
malicious_procs=$(ps aux | grep -E "turmp|151.240|43.198" | grep -v grep)
if [ -n "$malicious_procs" ]; then
    echo "    ⚠️  警告: 发现可疑进程:"
    echo "$malicious_procs"
else
    echo "    ✅ 未发现恶意进程"
fi

# 检查更新目录
echo ""
echo "[4] 检查更新目录..."
if [ -d "/var/tmp/trim-update" ]; then
    update_attr=$(lsattr -d /var/tmp/trim-update 2>/dev/null)
    if echo "$update_attr" | grep -q "i"; then
        echo "    ⚠️  警告: 更新目录被锁定!"
    else
        echo "    ✅ 更新目录正常"
    fi
else
    echo "    ✅ 更新目录不存在（正常）"
fi

echo ""
echo "=== 检测完成 ==="

#!/bin/bash
# fnOS 持久化后门修复脚本
# 警告：请先备份重要数据！

echo "=== fnOS 持久化后门修复脚本 ==="
echo "警告：此脚本会修改系统配置"
read -p "确认继续？(yes/no): " confirm
if [ "$confirm" != "yes" ]; then
    echo "已取消"
    exit 1
fi

# 1. 终止恶意进程
echo "[1/5] 终止恶意进程..."
pkill -9 -f "151.240.13.91" 2>/dev/null
pkill -9 -f "43.198.11.122" 2>/dev/null
pkill -9 -f "turmp" 2>/dev/null
rm -f /tmp/turmp 2>/dev/null
echo "    完成"

# 2. 解除immutable属性
echo "[2/5] 解除文件锁定..."
chattr -i /var/tmp/trim-update 2>/dev/null
chattr -i /var/tmp/trim-update/* 2>/dev/null
chattr -i /usr/trim/bin/system_startup.sh 2>/dev/null
chattr -i /usr/trim/etc/machine_id 2>/dev/null
echo "    完成"

# 3. 清理更新目录
echo "[3/5] 清理更新目录..."
rm -rf /var/tmp/trim-update
mkdir -p /var/tmp/trim-update
chmod 700 /var/tmp/trim-update
echo "    完成"

# 4. 清理启动脚本
echo "[4/5] 清理启动脚本..."
if grep -qE "wget|curl|151.240|43.198|turmp" /usr/trim/bin/system_startup.sh; then
    # 备份原文件
    cp /usr/trim/bin/system_startup.sh /usr/trim/bin/system_startup.sh.infected

    # 创建干净的脚本
    cat > /usr/trim/bin/system_startup.sh << 'EOF'
#!/bin/bash

STATUS="/var/lib/dpkg/status"
BACKUP="/var/lib/dpkg/status.original"

if [ ! -f "$BACKUP" ]; then
    if [ -f "$STATUS" ]; then
        cp "$STATUS" "$BACKUP"
    fi
fi

if [ ! -f "$STATUS" ]; then
    if [ -f "$BACKUP" ]; then
        cp "$BACKUP" "$STATUS"
    fi
fi
EOF
    chmod 755 /usr/trim/bin/system_startup.sh
    echo "    已清理（原文件备份为 .infected）"
else
    echo "    脚本未被感染，跳过"
fi

# 5. 重启服务
echo "[5/5] 重启服务..."
systemctl restart trim_main.service
systemctl restart trim_nginx.service
echo "    完成"

echo ""
echo "=== 修复完成 ==="
echo ""
echo "建议后续操作："
echo "  1. 尝试在Web界面更新系统"
echo "  2. 运行安全扫描工具确认无残留"
echo "  3. 修改所有密码"
echo "  4. 检查其他可能被篡改的配置"

# 这些规则救了我
iptables -A OUTPUT -d 151.240.13.91 -j DROP
iptables -A OUTPUT -d 43.198.11.122 -j DROP