记录一次网站被投毒！

被投毒

我的站点一直跳转足球网站，我排查了CDN还有服务器都没有任何问题，但是我试了一下重新安装nginx是有效但是过一天还是会跳转，发现治标不治本根本没有任何作用，到最后排查到里面发现一个下载文件也就是https://pull.969a.xyz/ngxd.lua，这个也就是主动下载跳转病毒的源头，我排查了几天才找到，之前去闲鱼有人说要1000块钱以上解决说很耗时，这边无偿分享了，亲测解决了问题。转载请保留原创！谢谢！

投毒原理

解决办法

TS=$(date +%F_%H%M%S)
BAK="/root/nginx_backdoor_clean_$TS"
mkdir -p "$BAK"

echo "===== 1. 备份证据 ====="
cp -a /etc/init.d/nginx "$BAK/nginx.initd.bak" 2>/dev/null || true
cp -a /www/server/nginx/conf/nginx.conf "$BAK/nginx.conf.bak" 2>/dev/null || true
cp -a /www/server/nginx/lib/lua/ngxd.lua "$BAK/ngxd.lua.nginx.bak" 2>/dev/null || true
cp -a /www/server/btwaf/ngxd.lua "$BAK/ngxd.lua.btwaf.bak" 2>/dev/null || true
cp -a /www/server/btwaf/lib/ngxd.lua "$BAK/ngxd.lua.btwaflib.bak" 2>/dev/null || true

echo "备份目录：$BAK"

echo "===== 2. 阻断远程下载域名 ====="
grep -q "pull.969a.xyz" /etc/hosts || echo "127.0.0.1 pull.969a.xyz" >> /etc/hosts

echo "===== 3. 去掉恶意文件不可修改属性 ====="
chattr -i /www/server/nginx/lib/lua/ngxd.lua 2>/dev/null || true
chattr -i /www/server/btwaf/ngxd.lua 2>/dev/null || true
chattr -i /www/server/btwaf/lib/ngxd.lua 2>/dev/null || true
chattr -i /etc/init.d/nginx 2>/dev/null || true

echo "===== 4. 隔离 ngxd 后门文件 ====="
mkdir -p "$BAK/quarantine"
mv /www/server/nginx/lib/lua/ngxd.lua "$BAK/quarantine/ngxd.lua.nginx" 2>/dev/null || true
mv /www/server/btwaf/ngxd.lua "$BAK/quarantine/ngxd.lua.btwaf" 2>/dev/null || true
mv /www/server/btwaf/lib/ngxd.lua "$BAK/quarantine/ngxd.lua.btwaflib" 2>/dev/null || true

echo "===== 5. 写入无害占位模块，防止残留 require 报错 ====="
mkdir -p /www/server/nginx/lib/lua
mkdir -p /www/server/btwaf/lib

printf '%s\n' 'local _M = {}' 'function _M.handle() return false end' 'return _M' > /www/server/nginx/lib/lua/ngxd.lua
printf '%s\n' 'local _M = {}' 'function _M.handle() return false end' 'return _M' > /www/server/btwaf/ngxd.lua
printf '%s\n' 'local _M = {}' 'function _M.handle() return false end' 'return _M' > /www/server/btwaf/lib/ngxd.lua

chown root:root /www/server/nginx/lib/lua/ngxd.lua /www/server/btwaf/ngxd.lua /www/server/btwaf/lib/ngxd.lua
chmod 444 /www/server/nginx/lib/lua/ngxd.lua /www/server/btwaf/ngxd.lua /www/server/btwaf/lib/ngxd.lua

echo "===== 6. 清理 nginx 配置里的 ngxd 调用 ====="
python3 - <<'PY'
from pathlib import Path
import re, time

paths = [
    Path("/www/server/nginx/conf/nginx.conf"),
]

for p in paths:
    if not p.exists():
        continue
    s = p.read_text(errors="ignore")
    bak = p.with_name(p.name + ".before_remove_ngxd_" + time.strftime("%F_%H%M%S"))
    bak.write_text(s)

    # 删除含 ngxd 的 lua block
    s = re.sub(r'\n\s*(rewrite_by_lua_block|access_by_lua_block|content_by_lua_block)\s*\{[^{}]*ngxd[^{}]*\}\s*', '\n', s, flags=re.S)
    # 删除单行 ngxd require
    s = "\n".join(line for line in s.splitlines() if "ngxd" not in line and "pull.969a.xyz" not in line)

    p.write_text(s)
PY

echo "===== 7. 替换被投毒的 /etc/init.d/nginx 为干净启动脚本 ====="
cp -a /etc/init.d/nginx "$BAK/nginx.initd.poisoned.$TS"

cat > /etc/init.d/nginx <<'EOF'
#!/bin/bash
# chkconfig: 2345 55 25
# description: nginx service

NGINX_BIN="/www/server/nginx/sbin/nginx"
NGINX_CONF="/www/server/nginx/conf/nginx.conf"
NGINX_PID="/www/server/nginx/logs/nginx.pid"

case "$1" in
    start)
        echo "Starting nginx..."
        $NGINX_BIN -c $NGINX_CONF
        ;;
    stop)
        echo "Stopping nginx..."
        if [ -f "$NGINX_PID" ]; then
            kill -QUIT $(cat "$NGINX_PID") 2>/dev/null || true
        else
            pkill -QUIT nginx 2>/dev/null || true
        fi
        ;;
    restart)
        $0 stop
        sleep 1
        $0 start
        ;;
    reload)
        echo "Reloading nginx..."
        $NGINX_BIN -s reload
        ;;
    configtest|test)
        $NGINX_BIN -t -c $NGINX_CONF
        ;;
    status)
        if pgrep nginx >/dev/null; then
            echo "nginx is running"
        else
            echo "nginx is stopped"
        fi
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|reload|configtest|status}"
        exit 1
        ;;
esac

exit 0
EOF

chmod +x /etc/init.d/nginx

echo "===== 8. 清理临时后门文件 ====="
rm -f /tmp/tcxnig.txt /tmp/tronse.txt /tmp/timestamp.txt /tmp/.machine_id
rm -f /tmp/ngxd_payload_* /tmp/ngxd_signature_* /tmp/ngxd_public_*

echo "===== 9. 检查配置并重启 nginx ====="
nginx -t && /etc/init.d/nginx restart

echo "===== 10. 检查是否还有后门痕迹 ====="
nginx -T 2>/dev/null | grep -nEi "ngxd|pull.969a|rewrite_by_lua|access_by_lua|content_by_lua|ngx.redirect|anfdnc|fadfdsa|fsdfan" || echo "nginx 配置未发现 ngxd/赌博跳转痕迹"

echo "完成。备份目录：$BAK"

测试代码 自己改一下自己网站和ip

UA='Mozilla/5.0 (Linux; Android 16; K) AppleWebKit/537.36 Chrome/138 Mobile Safari/537.36'

curl -k -sS -D - -o /dev/null \
-A "$UA" \
--resolve www.baidu.com:443:171.80.4.5 \
https://ww.luoyew.net/__static_test.txt | grep -iE "HTTP/|Location:|Server:"

curl -k -sS -D - -o /dev/null \
-A "$UA" \
--resolve www.baidu.com:443:171.80.4.5 \
https://www.baidu.com/ | grep -iE "HTTP/|Location:|Server:"