Linux木马查杀辅助脚本

最新推荐文章于 2024-08-22 10:37:38 发布
最新推荐文章于 2024-08-22 10:37:38 发布
阅读量752 收藏 2
点赞数 1
分类专栏： Linux 文章标签： Linux 木马
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Jaskzon/article/details/90449808
版权 
#/bin/sh
#
#
# Linux information Collection
#
#
#  by  thecastle <https://github.com/IIComing> 
#
# . ############################################################

clear
echo
echo "############################################################"
echo '|                                                           |'
echo "|    Linux Information Collection  			              |"
echo "|                                                           |"
echo "|       by thecastle <https://github.com/IIComing>          |"
echo "############################################################"
echo
echo
echo "STARTING >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
echo
echo "Running Time: `date |awk '{print $6" "$2" "$3" "$4}'`"
echo
echo "############################################################"
echo

echo -n "Step 1."
echo "  Hi, are you root?"

if [ -f /usr/bin/id ]; then
  /usr/bin/id |grep "uid=0" >/dev/null 2>&1
  if [ $? -eq 0 ] ; then
     echo "         yes, I am root."
  else
     echo "         Please su root first."
     exit
  fi
else 
	echo "Check for /usr/bin/id........"
	exit
fi

######

echo
echo -n "Step 2."
echo "  Backup PATH variable......"

if [ -f "/tmp/PATH" ] ; then
   echo $PATH >/tmp/PATH
else
   touch /tmp/PATH
   echo $PATH >/tmp/PATH
fi

######

echo
echo -n "Step 3."
echo "  Please change to /tmp directory to see the Gather."

RUNTIME=`date |awk '{print $6" "$2" "$3" "$4}'`
GATHERMAINDIR=/tmp/
GATHERFILE=$GATHERMAINDIR/Gather.`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $2}' |head -n 1`.`date |awk '{print $6"."$2"."$3"."$4}'`

if [ -d $GATHERMAINDIR ] ; then
   echo "         Gathermaindir OK"
else
   echo -n "         Make Gathermaindir..."
   mkdir $GATHERMAINDIR
   chmod 775 $GATHERMAINDIR
   echo "    [ OK ]"
fi

######

echo
echo -n "Step 4."
echo "  Information gathering..."
echo

echo " ____________________________________________________________________ " >>$GATHERFILE
echo "|                                                                    |" >>$GATHERFILE
echo "|                  Linux information Collection                      |" >>$GATHERFILE
echo "|                                                                    |" >>$GATHERFILE
echo "|       		 by thecastle <https://github.com/IIComing>            |" >>$GATHERFILE
echo "|____________________________________________________________________|" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Generate Time: $RUNTIME" >>$GATHERFILE
echo "" >>$GATHERFILE

######

HOSTNAME=`hostname`
DOMAINNAME=`domainname`
OSTYEP=`uname -s`" "`uname -p`" "`uname -r`
UPTIME=`uptime`
MAINIPADD=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $2}' |head -n 1`
MAINNETMASK=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $4}' |head -n 1`
MAINBROADCAST=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $6}' |head -n 1`
ROUTETABLE=`netstat -nr`
DNSADDR=`cat /etc/resolv.conf | sed -e '/^#/d' -e /^$/d |grep nameserver | awk '{ print $2 }'`

######

echo '################################################################' >>$GATHERFILE
echo "|                  -= Basic Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

######

echo -n "Checking hostname..."
echo "HostName: $HOSTNAME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking domainname..."
echo "DomainName: $DOMAINNAME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking ostype..."
echo "OsType: $OSTYEP" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking uptime..."
echo "Uptime: $UPTIME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking hostmainip..."
echo "HostMainIP: $MAINIPADD" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking mainnetmask..."
echo "MainNetMask: $MAINNETMASK" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking all Ethernet card mode..."
echo "Mode: `ifconfig -a|grep UP`" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking mainbroadcast..."
echo "MainBroadCast: $MAINBROADCAST" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking othernetinfo..."
ifconfig -a |grep inet |grep -v "127.0.0.1" |grep -v $MAINIPADD >/dev/null 2>&1
if [ $? -ne 0 ];then 
echo "OtherNetInfo = NONE" >>$GATHERFILE
else
echo "OtherNetInfo :" >>$GATHERFILE
OTHERNETINFO=`ifconfig -a |grep inet |grep -v "127.0.0.1" |grep -v $MAINIPADD 2>/dev/null`
echo $OTHERNETINFO >>$GATHERFILE
fi
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking route table..."
echo "RouteTable: $ROUTETABLE" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking DNS address..."
echo "DNSAddress: $DNSADDR" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking syspath variable..."
echo "Syspath:`cat /tmp/PATH`" >>$GATHERFILE 2>/dev/null
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo '################################################################' >>$GATHERFILE
echo "|             -= Key command file information =-                |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking File size..."
echo "................................................................." >>$GATHERFILE
echo "File size                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -ahl `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr`>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking File type ..."
echo "................................................................." >>$GATHERFILE
echo "File type                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
file `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr` >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking File md5 ..."
echo "................................................................." >>$GATHERFILE
echo "File md5                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -ahl `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr` | awk '{print $9}' | xargs md5sum >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|              -= Accounts Password Information =-             |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking umask..."
echo "................................................................." >>$GATHERFILE
echo "Umask Current Value   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Umask = `umask 2>/dev/null`" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

echo -n "Checking account password information..."
echo "................................................................." >>$GATHERFILE
echo "Account password information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
join -t ':' /etc/passwd /etc/shadow | grep -v "\!" | grep -v "\*" |sed -e '/^#/d' -e /^$/d >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/login.defs file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/login.defs File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/login.defs ];then
cat /etc/login.defs| sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/login.defs file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/profile file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/profile File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/profile ];then
cat /etc/profile |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/profile file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking Current logged in user ..."
echo "................................................................." >>$GATHERFILE
echo "Current logged in user    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
w >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/securetty file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/securetty File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/securetty ];then
cat /etc/securetty | sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/securetty file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Rc*.d Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/rc*.d start file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc*.d directory start file "  >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -gld /etc/rc0.d/* | grep -v -E "K[0-9]" | grep  -v README >>$GATHERFILE
ls -gld /etc/rc1.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc2.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -adl /etc/rc3.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc4.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc5.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc6.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/rc*.d file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc*.d file List "  >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
a0=`find /etc/rc0.d -type f | grep -v README 2>/dev/null`
a1=`find /etc/rc1.d -type f | grep -v README 2>/dev/null`
a2=`find /etc/rc2.d -type f | grep -v README 2>/dev/null`
a3=`find /etc/rc3.d -type f | grep -v README 2>/dev/null`
a4=`find /etc/rc4.d -type f | grep -v README 2>/dev/null`
a5=`find /etc/rc5.d -type f | grep -v README 2>/dev/null`
a6=`find /etc/rc6.d -type f | grep -v README 2>/dev/null`
for i in $a0 $a1 $a2 $a3 $a4 $a5 $a6; do
echo -n "Checking $i file..."
echo "................................................................." >>$GATHERFILE
echo "$i File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat $i |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"
done
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Process Information =-                    |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking process status information..."
echo "................................................................." >>$GATHERFILE
echo "Process Status Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ps -axu >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking process tree information..."
echo "................................................................." >>$GATHERFILE
echo "Process Tree Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
pstree -p>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking modules information..."
echo "................................................................." >>$GATHERFILE
echo "Modules Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /sbin/lsmod ];then
lsmod >>$GATHERFILE
else
echo "no modules information" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Network Information =-                    |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking /etc/init.d/ directory..."
echo "................................................................." >>$GATHERFILE
echo "/etc/init.d/ directory " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -al /etc/init.d/* >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking chkconfig information..."
echo "................................................................." >>$GATHERFILE
echo "Chkconfig Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f '/sbin/chkconfig' ];then
chkconfig --list >>$GATHERFILE 2>/dev/null
else
echo "no chkconfig information" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking sockets information..."
echo "................................................................." >>$GATHERFILE
echo "Sockets Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ss -p >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking listening server ports information..."
echo "................................................................." >>$GATHERFILE
echo "Listening Server Ports Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -ant | grep LISTEN >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking listening services information..."
echo "................................................................." >>$GATHERFILE
echo "Listening Services Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -at | grep LISTEN >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking program processes active connections information..."
echo "................................................................." >>$GATHERFILE
echo "Program Processes Active Connections Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -pt >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking lsof Information..."
echo "................................................................." >>$GATHERFILE
echo "lsof Information " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
lsof -i >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

#####

echo '################################################################' >>$GATHERFILE
echo "|                 -= Syslog Information =-                     |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/syslog.conf file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/syslog.conf File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/syslog.conf ];then
cat /etc/syslog.conf |sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/syslog.conf file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                   -= DNS Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking /etc/resolv.conf file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/resolv.conf File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/resolv.conf ];then
cat /etc/resolv.conf |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/resolv.conf file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/hosts file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/hosts File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/hosts ];then
cat /etc/hosts|sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/hosts file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                   -= Cron Information =-                     |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking crontab Information..."
echo "................................................................." >>$GATHERFILE
echo "crontab Information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /usr/bin/crontab ];then
crontab -l >>$GATHERFILE
else
echo "no /usr/bin/crontab file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/crontab file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/crontab File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/crontab ];then
cat /etc/crontab | sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/crontab file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

if [ -d /var/spool/cron ];then
c=`find /var/spool/cron -type f 2>/dev/null`
for i in $c;do
echo -n "Checking $i file..."
echo "................................................................." >>$GATHERFILE
echo "$i File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat $i |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"
done
fi 
echo "" >>$GATHERFILE

######

echo '################################################################' >>$GATHERFILE
echo "|                -= Special Files Information =-               |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/rc.local file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc.local content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat /etc/rc.local | sed -e '/^#/d' -e /^$/d>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking SUID file..."
echo "................................................................." >>$GATHERFILE
echo "SUID File List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking iptables..."
echo "................................................................." >>$GATHERFILE
echo "Iptables information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
iptables -L >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking abnormity & hide file..."
echo "................................................................." >>$GATHERFILE
echo "Abnormity & Hide File List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -name "..*" >>$GATHERFILE 2>/dev/null
find / -name ".*" | cat -v >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking nouser file or directory..."
echo "................................................................." >>$GATHERFILE
echo "Nouser File or Directory List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -nouser -exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking nogroup file or directory..."
echo "................................................................." >>$GATHERFILE
echo "Nogroup File or Directory List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -nogroup -exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|              -= Packages/Patches Information =-              |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking packages installed information..."
echo "................................................................." >>$GATHERFILE
echo "Packages Installed Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
rpm -a >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

# >>>>> ###################################################################

echo
echo -n "Step 5."
echo "  ALL Done."

echo "######################################################################" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Information collection is complete." >>$GATHERFILE
echo "" >>$GATHERFILE
echo "######################################################################" >>$GATHERFILE

echo "######################################################################"
echo "Information collection is complete."
echo "Please read Gather $GATHERFILE for more details."
echo "######################################################################"
echo


exit 0
Jaskzon
关注
专栏目录
网络安全从入门到精通（特别篇I）：Linux安全事件应急响应之Linux应急响应基础必备技能
HACKONE的博客
04-10 205
awk 首先将每条日志中的IP抓出来，如日志格式被自定义过，可以 -F 定义分隔符和 print指定列；
运维知识点-linux操作系统-linux命令行-BashShell
aming小老弟
11-17 699
Yum（全称为 Yellow dog Updater, Modified）是一个在Fedora和RedHat以及CentOS中的Shell前端软件包管理器。基于RPM包管理，能够从指定的1、显示已经安装的软件包2、查找可以安装的软件包 （以 tomcat 为例）3、安装软件包 （以 tomcat 为例）4、卸载软件包 （以 tomcat 为例）5、列出软件包的依赖 （以 tomcat 为例）6、-y 自动应答yes我们可以用 -y 来应答所有的 yes , 比如我们安装 tomcat 的时候，
Linux下查杀webshell木马的工具.zip
01-05
Linux下查杀webshell木马的工具.zip
Linux下手动查杀木马
菜鸟、上路
08-25 6984
一、 模拟木马程序病原体并让木马程序自动运行 黑客让脚本自动执行的三种方法： 计划任务，crontab；开机启动；系统命令被替换，使用命令后被触发。 1、 生成木马程序病原体 [root@xuegod120 ~]# vim /usr/bin/fregonnzkq #!/bin/bash touch /tmp/aaa.txt while true do echo date >> /tmp...
6 款最佳 Linux 系统防病毒软件！
最新发布
民工哥的博客
08-22 1616
戳下方名片，关注并星标！回复“1024”获取2TB学习资源！????体系化学习：运维工程师打怪升级进阶之路 4.0— 特色专栏—MySQL/PostgreSQL/MongoDBElasticSearch/Hadoop/RedisKubernetes/Docker/DevOpsKafka/RabbitMQ/Zookeeper监控平台/应用与服务/集群管理N...
linux版杀木马软件,linux下的木马软件
weixin_42298032的博客
05-10 161
Rootkit出现于二十世纪90年代初，在1994年2月的一篇安全咨询报告中首先使用了rootkit这个名词。这篇安全咨询就是CERT-CC的CA-1994-01，题目是Ongoing Network Monitoring Attacks，最新的修订时间是1997年9月19日。从出现至今，rootkit的技术发展非常迅速，应用越来越广泛，检测难度也越来越大。其中针对SunOS和Linux两种操作系...
linux下木马查杀工具,网站木马后门查杀工具Linux系统专用
weixin_39564605的博客
05-11 503
#!/usr/bin/python# -*- coding: utf-8 -*-#blog:www.sinesafe.comimportosimportsysimportrerulelist =['(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))','(_decode\([\'"][\w\+/=]{200,...
linux-宝塔Linux面板简单好用的服务器运维面板
08-13
5. **安全防护**：内置防火墙规则配置，可以设置端口开放、禁止IP访问，以及进行木马查杀，增强服务器安全性。 6. **性能监控**：实时显示服务器资源使用情况，包括CPU、内存、磁盘I/O、网络流量等，帮助用户了解...
kali linux 支持什么编程语言_渗透过程中可能要用到的Kali工具小总结
weixin_39576066的博客
10-24 2767
渗透过程中可能要用到的Kali工具小总结写在最前面最近在搞渗透的时候，发现过程中有一些kali工具还是很适合使用的所以写一个渗透过程中可能用到的kali渗透工具的小小总结写的不对 多多包涵 各位大佬轻喷 :DKali用得好 牢饭准管饱渗透不规范 亲人两行泪先来了解一下Kali(From Wikipdeia)Kali Linux是基于Debian的Linux发行版， 设计用于数字取证操作系统。由Of...
Linux安全体系的ClamAV病毒扫描程序[转]
wdbfz的专栏
12-01 5778
<br />摘自：http://www.shangshuwu.cn/index.php/Linux安全体系的ClamAV病毒扫描程序<br /> <br /> <br /> <br />ClamAV是使用广泛且基于GPL License的开放源代码的典型杀毒软件，它支持广泛的平台，如：Windows、Linux、Unix等操作系统，并被广泛用于其他应用程序，如：邮件客户端及服务器、HTTP病毒扫描代理等。ClamAV源代码可从http://www.clamav.net 下载。 <br />本章分析了C
Linux下python版后门智能查杀脚本
11-13
这款查杀程序采用插件化实现，可以对新型的web后门添加自定义的查杀插件，现有的10余款插件已经能够查杀目前常见的大部分web后门，不过要注意的是现有的插件大多数都是查杀PHP后门的，asp及aspx不在覆盖范围，jsp的插件较少，因为当初写这个程序是为了解决linux下的webshell查杀问题。
Linux 下使用杀毒软件clamav扫描木马病毒
热门推荐
飞空静渡
08-31 1万+
软件安装： sudo apt-get install clamav 然后在控制台下运行：clamscan /home 会报错： LibClamAV Error: cli_loaddb(): No supported database files found in /var/lib/clamav/ ERROR: Can't open file or directory
linux监控脚本的作用,五个常用的Linux监控脚本
weixin_32296621的博客
04-30 239
为大家提供五个常用linux监控脚本(查看主机网卡流量、系统状况监控、监控主机的磁盘空间,当使用空间超过90％就通过发mail来发警告、监控CPU和内存的使用情况、全方位监控主机)，有需要的朋友不妨看看哦。1、查看主机网卡流量复制代码 代码如下:#!/bin/bash#network#Mike.Xuwhile : ; dotime='date +%m"-"%d" "%k":"%M'day='dat...
linux 查杀sh脚本
xbcsu的博客
04-20 1051
Linux查找脚本的进程号
linux病毒脚本分析
dzlyxzy的博客
01-21 1678
树莓派/opt下多个几个莫名其妙的脚本，并且给添加到了rc.local中开机自动执行。请大神们帮忙分析一下吧。其中suck***是调试程序的时候用到的，大家可以无视。感觉关键部分是最后sshpass -praspberry开始的几段。#!/bin/bash echo "Suck dick .......................................................
Ubuntu 系统安装和使用杀毒软件ClamAV
科研学习笔记！
09-20 6959
Ubuntu 系统安装和使用杀毒软件ClamAV
Linux十字病毒查杀处理
ycb1689的专栏
02-12 709
https://blog.51cto.com/ixdba/2163018 一、现象 接到客户的电话，说自己的云服务器被提供商禁止访问了，原因是监测到网络流量暴满，服务器不停的向外发包，在确认客户没有业务量突增的情况下，初步判断可能服务器遭受了流量攻&击（DDOS），不过按照常理来说，客户的业务系统就是一个小的web系统，平时流量不大，影响力也一般，不至于遭受DDOs，带着这些疑问...
linux系统shell脚本实现 恶意扫描服务器密码 自动屏蔽
无锋剑
12-06 352
    最近在香港和台湾各买了一台VPS服务器，在调试过程中发现，琢磨这两台服务器的 小黑 太多了，各种密码探测 扫描，他大爷的真是闲的蛋疼的人很多啊。我就先装了一个denyhost顶住，就几天的时间，收了不少报警邮件，发现denyhost没能吧哪些恶意IP地址加到/etc/hosts.deny里面，后面调试了一下能加进去了，发现屏蔽无效，后来排查了一下，发现是openssh编译安装时有些模块没添...
Linux木马查杀与防护技术详解
"这篇资料主要介绍了在Linux系统中如何手动进行木马查杀的过程，包括木马程序的自我监测、防止删除以及隐藏等技术。内容来源于www.eimhe.com美河学习在线，对于理解Linux安全管理和木马查杀具有一定的参考价值。" ...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值