记一次飞牛fnOS内核级Rootkit入侵事件：从发现到清除的完整过程

# 检查恶意内核模块
lsmod | grep -E "snd_pcap|async_memcpys"

# 检查恶意文件
ls -la /sbin/gots /usr/bin/dockers /usr/bin/nginx 2>/dev/null

# 检查/etc/modules
cat /etc/modules | grep -E "snd_pcap|async_memcpys"

# 检查/etc/rc.local
cat /etc/rc.local | grep gots

# 检查chattr是否存在
which chattr

#!/bin/bash
# fnOS Rootkit清理脚本
# 警告：请先备份重要数据！

echo "=== fnOS Rootkit 清理脚本 ==="
echo "警告：此脚本会修改系统配置，请确保你了解每一步操作"
read -p "确认继续？(yes/no): " confirm
if [ "$confirm" != "yes" ]; then
    echo "已取消"
    exit 1
fi

# 1. 恢复chattr（如果被删除）
if ! command -v chattr &> /dev/null; then
    echo "[1/8] 恢复chattr工具..."
    cd /tmp
    wget -q https://mirrors.ustc.edu.cn/debian/pool/main/e/e2fsprogs/e2fsprogs_1.47.0-2+b2_amd64.deb
    dpkg-deb -x e2fsprogs_1.47.0-2+b2_amd64.deb e2fsprogs_extract
    sudo cp e2fsprogs_extract/usr/bin/chattr /usr/bin/chattr
    sudo chmod 755 /usr/bin/chattr
    rm -rf e2fsprogs_extract e2fsprogs_1.47.0-2+b2_amd64.deb
else
    echo "[1/8] chattr工具存在，跳过"
fi

# 2. 移除immutable属性
echo "[2/8] 移除immutable属性..."
sudo chattr -i /sbin/gots 2>/dev/null
sudo chattr -i /etc/rc.local 2>/dev/null

# 3. 卸载恶意内核模块
echo "[3/8] 卸载恶意内核模块..."
sudo modprobe -r async_memcpys 2>/dev/null
sudo modprobe -r snd_pcap 2>/dev/null

# 4. 删除恶意文件
echo "[4/8] 删除恶意文件..."
sudo rm -f /lib/modules/*/async_memcpys.ko
sudo rm -f /lib/modules/*/snd_pcap.ko
sudo rm -f /sbin/gots
sudo rm -f /usr/bin/dockers
sudo rm -f /usr/bin/4Va
sudo rm -f /usr/bin/mNxc
sudo rm -f /usr/bin/reMYUBLt
sudo rm -f /usr/bin/nginx  # 如果是恶意的

# 5. 清理/etc/modules
echo "[5/8] 清理/etc/modules..."
sudo sed -i '/async_memcpys/d' /etc/modules
sudo sed -i '/snd_pcap/d' /etc/modules

# 6. 清理/etc/rc.local
echo "[6/8] 清理/etc/rc.local..."
sudo sed -i '/gots/d' /etc/rc.local

# 7. 封锁C2服务器
echo "[7/8] 封锁C2服务器..."
for ip in 43.198.11.122 151.240.13.91 20.89.168.131 45.95.212.102; do
    sudo iptables -A INPUT -s $ip -j DROP
    sudo iptables -A OUTPUT -d $ip -j DROP
done

# 保存iptables规则
sudo mkdir -p /etc/iptables
sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null

# 8. 重建系统配置
echo "[8/8] 重建系统配置..."
sudo depmod -a
sudo update-initramfs -u -k $(uname -r)

echo ""
echo "=== 清理完成 ==="
echo "请重启系统并验证："
echo "  1. lsmod | grep -E 'snd_pcap|async_memcpys'"
echo "  2. ls -la /sbin/gots"
echo "  3. top (检查CPU使用率)"
echo ""
echo "建议：重启后修改所有密码！"