165 lines
3.5 KiB
Bash
Executable File
165 lines
3.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
LOG_FILE="/var/log/perf-guard.log"
|
|
LOCK_FILE="/var/run/perf-guard.lock"
|
|
BACKUP_DIR="/root/security-cleanup-backup/perf-guard"
|
|
|
|
mkdir -p "$(dirname "$LOG_FILE")" "$(dirname "$LOCK_FILE")" "$BACKUP_DIR"
|
|
|
|
exec 9>"$LOCK_FILE"
|
|
if ! flock -n 9; then
|
|
exit 0
|
|
fi
|
|
|
|
log() {
|
|
printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*" >> "$LOG_FILE"
|
|
}
|
|
|
|
backup_file() {
|
|
local path="$1"
|
|
if [ -f "$path" ]; then
|
|
local ts
|
|
ts=$(date '+%Y%m%d%H%M%S')
|
|
cp -a "$path" "$BACKUP_DIR/$(basename "$path").${ts}.bak" 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
sanitize_file() {
|
|
local file="$1"
|
|
local pattern="$2"
|
|
|
|
[ -f "$file" ] || return 0
|
|
|
|
if grep -Eq "$pattern" "$file"; then
|
|
backup_file "$file"
|
|
sed -i -E "/$pattern/d" "$file" || true
|
|
log "sanitized $file"
|
|
fi
|
|
}
|
|
|
|
kill_suspicious_processes() {
|
|
local changed=0
|
|
|
|
# Exact process names from known miner families.
|
|
local names=(kinsing kdevtmpfsi uhavenobotsxd perfcc perfctl pctl)
|
|
for p in "${names[@]}"; do
|
|
if pkill -9 -x "$p" 2>/dev/null; then
|
|
changed=1
|
|
log "killed process name=$p"
|
|
fi
|
|
done
|
|
|
|
# Command line paths used by persistent variants.
|
|
local patterns=(
|
|
'/tmp/.perf.c/'
|
|
'/root/.config/cron/perfcc'
|
|
'/bin/perfcc'
|
|
'/usr/bin/perfcc'
|
|
'/etc/data/kinsing'
|
|
'/tmp/kdevtmpfsi'
|
|
'/tmp/fwb.sh'
|
|
'uhavenobotsxd'
|
|
'\.system3d'
|
|
)
|
|
|
|
for pat in "${patterns[@]}"; do
|
|
if pkill -9 -f "$pat" 2>/dev/null; then
|
|
changed=1
|
|
log "killed process pattern=$pat"
|
|
fi
|
|
done
|
|
|
|
if [ "$changed" -eq 1 ]; then
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
cleanup_paths() {
|
|
local changed=0
|
|
local targets=(
|
|
'/tmp/.perf.c'
|
|
'/bin/.local'
|
|
'/bin/perfcc'
|
|
'/usr/bin/perfcc'
|
|
'/root/.config/cron/perfcc'
|
|
'/tmp/kdevtmpfsi'
|
|
'/tmp/fwb.sh'
|
|
'/etc/data/kinsing'
|
|
'/etc/sudoers.d/.systemd-resolved'
|
|
'/etc/cron.d/perfclean'
|
|
)
|
|
|
|
for path in "${targets[@]}"; do
|
|
if [ -e "$path" ]; then
|
|
backup_file "$path"
|
|
rm -rf "$path" || true
|
|
changed=1
|
|
log "removed $path"
|
|
fi
|
|
done
|
|
|
|
find /tmp -maxdepth 1 -name '*.uhavenobotsxd' -type f -delete 2>/dev/null || true
|
|
|
|
if [ "$changed" -eq 1 ]; then
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
cleanup_cron() {
|
|
local changed=0
|
|
local pattern='perfcc|perfctl|/tmp/\.perf\.c|/bin/perfcc|/usr/bin/perfcc|kinsing|kdevtmpfsi|\.system3d|uhavenobotsxd'
|
|
|
|
if [ -f /var/spool/cron/root ] && grep -Eq "$pattern" /var/spool/cron/root; then
|
|
backup_file /var/spool/cron/root
|
|
sed -i -E "/$pattern/d" /var/spool/cron/root || true
|
|
chmod 600 /var/spool/cron/root || true
|
|
changed=1
|
|
log 'cleaned /var/spool/cron/root'
|
|
fi
|
|
|
|
local startup_files=(/root/.bash_profile /root/.bashrc /root/.profile /etc/profile /etc/bashrc)
|
|
local startup_pattern='perfcc|perfctl|/tmp/\.perf\.c|/bin/\.local/bin|/opt/\.X11-unix/profile\.sh|kinsing|kdevtmpfsi|\.system3d|uhavenobotsxd'
|
|
|
|
for f in "${startup_files[@]}"; do
|
|
if [ -f "$f" ] && grep -Eq "$startup_pattern" "$f"; then
|
|
sanitize_file "$f" "$startup_pattern"
|
|
changed=1
|
|
fi
|
|
done
|
|
|
|
if [ "$changed" -eq 1 ]; then
|
|
return 0
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
lock_suspicious_user() {
|
|
if id sysupdate >/dev/null 2>&1; then
|
|
usermod -L -s /sbin/nologin sysupdate >/dev/null 2>&1 || true
|
|
log 'locked user sysupdate'
|
|
fi
|
|
}
|
|
|
|
changed_any=0
|
|
|
|
if kill_suspicious_processes; then
|
|
changed_any=1
|
|
fi
|
|
|
|
if cleanup_paths; then
|
|
changed_any=1
|
|
fi
|
|
|
|
if cleanup_cron; then
|
|
changed_any=1
|
|
fi
|
|
|
|
lock_suspicious_user
|
|
|
|
if [ "$changed_any" -eq 1 ]; then
|
|
log 'cleanup applied'
|
|
fi
|