2. NodeSeek
  3. 哪吒探针被黑，小鸡都被被扎针了

哪吒探针被黑，小鸡都被被扎针了

Lzq2190 2026-06-18 16:29 1

不要有侥幸心理，该操作系统就重装 。我的小鸡没被挖矿什么的，但被扎针了，不重装说不定什么时候就鸡瘟了。被扎针的主控http://129.153.102.77:8008/ 来认领一下小鸡，还在线400台


检测程序：


bash <(curl -s https://raw.githubusercontent.com/clarencejh/Nezha-cleaner/main/nezha-agent-cleaner.sh)

结果：


哪吒探针漏洞 - 后门检测与清理脚本 v3

时间: Thu Jun 18 05:52:21 UTC 2026

主机: instance-20260519-1923

模式: 扫描+清理



========== 网络连接扫描 ==========

[!!!] 可疑网络连接:

tcp   ESTAB     0      0             10.0.169.192:46502        104.18.29.7:443   users:(("nezha-agent",pid=1714839,fd=9))                                                                                                           

tcp   ESTAB     0      0             10.0.169.192:56200     129.153.102.77:8008  users:(("nezha-agent",pid=1714839,fd=7))                                                                                                           

tcp   ESTAB     0      0             10.0.169.192:52768     101.37.214.222:8008  users:(("nezha-agent",pid=1715723,fd=7))                                                                                                           

[!!!] lsof 可疑连接:

nezha-age 1714839            root    7u  IPv4 27072377      0t0  TCP 10.0.169.192:56200->129.153.102.77:8008 (ESTABLISHED)

nezha-age 1714839            root    9u  IPv4 28034940      0t0  TCP 10.0.169.192:46502->104.18.29.7:443 (ESTABLISHED)

nezha-age 1715723            root    7u  IPv4 27510864      0t0  TCP 10.0.169.192:52768->101.37.214.222:8008 (ESTABLISHED)



========== 哪吒 Agent 扫描 ==========

[MALICIOUS] /etc/systemd/system/nezha-agent.service (名称+内容均匹配哪吒)

  内容: [Unit]

Description=哪吒监控 Agent

ConditionFileIsExecutable=/opt/nezha/agent/nezha-agent

[MALICIOUS] /etc/systemd/system/nezha-agent2.service (名称+内容均匹配哪吒)

  内容: [Unit]

Description=Nezha Agent 2

After=network.target



[Service]

[MALICIOUS] /etc/systemd/system/nezha-agent-0473f72.service (名称+内容均匹配哪吒)

  内容: [Unit]

Description=哪吒监控 Agent

ConditionFileIsExecutable=/opt/nezha/agent/nezha-agent

[!!!] 哪吒进程: root     1501153  0.0  0.0 1277492 21676 ?       Ssl  Jun13   2:15 /opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config-r85v7.yml

[!!!] 哪吒进程: root     1714839  0.6  0.0 1277492 24048 ?       Ssl  Jun16  16:49 /opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config2.yml

[!!!] 哪吒进程: root     1715723  0.2  0.0 1277236 24148 ?       Ssl  Jun16   5:51 /opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config.yml

[!!!] 发现: /opt/nezha

[!!!] 发现: /tmp/nezha-agent



========== SSH 后门公钥扫描 ==========

[!!!] /root/.ssh/authorized_keys:2 ssh-ed25519 gary@gary (匹配 gary@gary) fp=SHA256:x4/EbEklG9YGlm1hP1DGwoUt6Wy1W7/YqTveyuCPQAE

[audit] /root/.ssh/authorized_keys:3 ssh-ed25519 test fp=SHA256:JfUkBNTLQgu+LM2ya/ZHxEGuH2Qq1UY3/0OkzT0/WPo



========== memfd 内存马 / 伪装 kworker 扫描 ==========

[MALICIOUS] PID=1501153 PPID=1 USER=0 COMM=nezha-agent

  EXE=/opt/nezha/agent/.nezha-agent.old (deleted)

  CMD=/opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config-r85v7.yml 

  原因: exe 已删除 (非常见系统进程), 有外连

[MALICIOUS] PID=1714839 PPID=1 USER=0 COMM=nezha-agent

  EXE=/opt/nezha/agent/.nezha-agent.old (deleted)

  CMD=/opt/nezha/agent/nezha-agent -c /opt/nezha/agent/config2.yml 

  原因: exe 已删除 (非常见系统进程), 有外连

[SUSPICIOUS] PID=259160 PPID=1 USER=0 COMM=systemd

  EXE=/usr/lib/systemd/systemd (deleted)

  CMD=/lib/systemd/systemd --user 

  原因: exe 已删除 (非常见系统进程)



========== SystemLoger 持久化扫描 ==========

[ok]  未发现 SystemLoger 持久化



========== 用户和 sudoers 审计 ==========

[!!!] 可疑 sudoers: /etc/sudoers.d/100-oracle-cloud-agent-users

  53:snap_daemon ALL=(root) NOPASSWD:  SETENV: DMSETUP, ISCSIADM, MULTIPATH_INSTALL, \033[0m

最近登录记录:

  root     pts/0        Thu Jun 18 05:52   still logged in    39.158.51.148

  root     pts/0        Wed Jun 17 14:14 - 19:12  (04:58)     39.158.51.169

  root     pts/2        Tue Jun 16 13:00 - 15:18  (02:18)     2.27.109.64

  root     pts/0        Tue Jun 16 13:00 - 15:18  (02:18)     2.27.109.64

  root     pts/1        Tue Jun 16 10:28 - 13:16  (02:48)     39.158.51.169

  root     pts/0        Tue Jun 16 09:12 - 12:27  (03:14)     39.158.51.169

  root     pts/1        Mon Jun 15 16:17 - 16:46  (00:29)     184.22.111.204

  root     pts/0        Mon Jun 15 16:17 - 16:46  (00:29)     184.22.111.204

  root     pts/1        Mon Jun 15 13:15 - 14:49  (01:33)     2.27.109.64

  root     pts/0        Mon Jun 15 13:15 - 14:49  (01:33)     2.27.109.64

  root     pts/1        Mon Jun 15 13:12 - 13:14  (00:01)     23.19.231.242

  root     pts/0        Mon Jun 15 13:12 - 13:14  (00:01)     23.19.231.242

  root     pts/1        Fri Jun 12 13:01 - 13:17  (00:16)     23.19.231.242

  root     pts/0        Fri Jun 12 13:00 - 13:17  (00:16)     23.19.231.242

  root     pts/1        Fri Jun 12 09:51 - 12:07  (02:15)     23.19.231.242

  root     pts/0        Fri Jun 12 09:51 - 12:07  (02:15)     23.19.231.242

  root     pts/1        Fri Jun 12 02:10 - 02:20  (00:09)     23.19.231.242

  root     pts/0        Fri Jun 12 02:10 - 02:20  (00:09)     23.19.231.242

  root     pts/1        Wed Jun 10 08:28 - 08:46  (00:17)     129.146.3.22

  root     pts/0        Wed Jun 10 08:28 - 08:46  (00:17)     129.146.3.22

当前在线:

   05:52:31 up 29 days, 18:27,  1 user,  load average: 0.40, 0.14, 0.08

  USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT

  root     pts/0    39.158.51.148    05:52   12.00s  2.20s  0.00s w



========== Docker 持久化扫描 ==========

所有 Docker 容器:

5f5ad675780a pensive_darwin hisatri/lrcapi:latest Up 40 hours

4c34e8f42373 angry_mccarthy xhongc/music_tag_web:latest Up 28 hours

6ca928f82d3a qbittorrent lscr.io/linuxserver/qbittorrent:latest Up 2 days

54e6a990ab67 navidrome_yhr6-navidrome_yHr6-1 deluan/navidrome:latest Up 2 days

88f7c1510e13 debian_xm68-debian_Xm68-1 debian:latest Up 2 days



========== 执行清理 ==========



将执行的清理操作:

--- Level 1: 明确恶意 (将自动清理) ---

  [L1] systemd: nezha-agent.service

  [L1] systemd: nezha-agent2.service

  [L1] systemd: nezha-agent-0473f72.service

  [L1] 删除 /root/.ssh/authorized_keys:2 gary@gary 公钥

  [L1] kill PID 1501153 (nezha-agent)

  [L1] kill PID 1714839 (nezha-agent)

--- Level 2: 高度可疑 (需确认) ---

  [L2] kill PID 259160 (systemd, 需确认)



备份到: /root/incident-backup-20260618-055221

[清理] systemd: nezha-agent.service

[清理] systemd: nezha-agent2.service

[清理] systemd: nezha-agent-0473f72.service

[清理] 删除 /root/.ssh/authorized_keys:2 gary@gary 公钥

[清理] kill PID 1501153 (nezha-agent)

[清理] kill PID 1714839 (nezha-agent)

[清理] kill PID 259160 (systemd, 需确认)



========== 扫描总结 ==========

明确恶意 (Level 1): 6

高度可疑 (Level 2): 6

仅报告   (Level 3): 1

已清理操作数: 7



安全建议:

  1. 建议重装系统或重建云实例

  2. 轮换所有 SSH 密钥对

  3. 更改所有用户密码

  4. 检查云平台密钥对，删除可疑公钥

  5. 检查防火墙规则，封禁 207.58.173.192

  6. 考虑使用 fail2ban 加固 SSH



日志文件: /root/nezha-cleaner-20260618-055221.log

备份目录: /root/incident-backup-20260618-055221

root@instance-20260519-1923:~# ^C
最新回复 (20)
  • 拉布拉多了不拉 06-18 16:32
    1楼

    你这是找到 黑客儿 的主控了把

  • Lzq2190 楼主 06-18 16:34
    2楼

    @拉布拉多了不拉 #1 扫描多了俩个哪吒agent配置文件，打开不就知道主控了

  • taotaoer 06-18 16:40
    3楼

    有点乱杀 直接干掉了我的php。。。


    备份到: /root/incident-backup-20260618-163511

    [清理] systemd: php-fpm-82.service

    [清理] systemd: php-fpm-82.service

  • liangmin 06-18 16:41
    4楼

    ^-^

  • acaiplus 06-18 16:43
    5楼

    这脚本把我的cloudflared tunnel隧道给删了，我晕。

  • codeqihan 06-18 16:44
    6楼

    看起来是个乌龟壳，发abuse吧 ^-^

  • wlhsssss 06-18 16:45
    7楼

    ^-^ 震惊

  • treasureu 06-18 16:48
    8楼

    找到黑客家了

  • kivenrock 06-18 16:52
    9楼

    我所有机器都是，没有执行脚本之前，都执行了sudo rm -rf /opt/nezha/，但是执行脚本还是提示我有东西

  • 8690533 06-18 16:57
    10楼

    找到窝了，给他来个以彼之道还施彼身啊 ^-^

  • soshow 06-18 16:57
    11楼

    卧槽兄dei ，这么多小鸡鸡

  • Lzq2190 楼主 06-18 16:59
    12楼

    @kivenrock #9 加个密匙都是轻的，可能会被注入什么后门，排查文件太麻烦，杀毒软件扫描全盘都要半小时，还不一定有用，被黑建议重装

  • kivenrock 06-18 17:07
    13楼

    @Lzq2190 #12 我发现问题了，你停掉了nezha-agent还有删除nezha-agent之后，哪怕没有重启也会标红，重启就好了

  • sudoerx 06-18 17:13
    14楼

    @kivenrock #9 想起很久前也有这样偷鸡的

  • kivenrock 06-18 17:14
    15楼

    8fae1f03cc08 wg-easy ghcr.io/wg-easy/wg-easy:15 Up 14 seconds (health: starting)

    [!!!] 可疑容器 8fae1f03cc08: wg-easy

    可以加一个白名单什么的

  • 心疼的抱住胖胖的自己 06-18 17:20
    16楼

    谢谢楼主分享！

  • akito 06-18 17:34
    17楼

    不要加--clean --yes 这个会误杀

    可以试试另一个脚本 https://github.com/everett7623/Nezha-cleaner/blob/main/nezha-agent-cleaner.sh

  • zasdwerttt 06-18 17:38
    18楼

    这是找到匪窝了

  • 知秋 06-18 18:50
    19楼

    这脚本太垃圾，乱删

  • 欧巴 06-18 22:45
    20楼

    我的arm也中了 重新dd了。。。真的烦

* 帖子来源NodeSeek
附近帖子
返回
飞读
随机推荐