protocol.be

User Tools

Site Tools

Trace:
proxmox

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
proxmox [2024/07/01 11:38] – protocolproxmox [2026/08/31 23:49] (current) – protocol
Line 1: Line 1:
-=== mount proxmox virtual disk ===+===== Limpar backdoor ===== 
 +<code> 
 + 
 +# remover backdoor e minerador de cripto (XMrig/monero) 
 +# encontrei eles nas librarias para mexer nos comandos comuns, classico.. 
 +unset LD_PRELOAD 
 +export LD_PRELOAD="" 
 + 
 +chattr -ia /etc/ld.so.preload 
 +echo "" > /etc/ld.so.preload 
 +rm -f /etc/ld.so.preload 
 + 
 +# matar os processos de mineraçao e persistencia 
 +pkill -9 -f PVE-1 
 +pkill -f PVE-1-maintain 
 +pkill -f PVE-1-update 
 +pkill -f ld-svc 
 + 
 +# boa tentativa deles, mais classico tambem.. 
 +chattr -ia /etc/systemd/system/ld-svc.service 
 +chattr -ia /lib/systemd/system/ld-svc.service 
 +chattr -ia /etc/systemd/system/PVE-1-update.* 
 +chattr -ia /lib/systemd/system/PVE-1-update.* 
 +chattr -ia /usr/libexec/PVE-1-maintain 
 +chattr -ia /usr/libexec/PVE-1-update 
 +chattr -ia /var/lib/systemd/ld-svc 
 +chattr -ia /var/lib/systemd/PVE-1 
 + 
 +systemctl stop PVE-1-update.timer 2>/dev/null || true 
 +systemctl disable PVE-1-update.timer 2>/dev/null || true 
 +systemctl stop ld-svc.timer 2>/dev/null || true 
 +systemctl disable ld-svc.timer 2>/dev/null || true 
 + 
 +chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer 
 +rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer 
 + 
 +chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer 
 +rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer 
 +rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service 
 +rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.* 
 +rm -f /usr/libexec/PVE-1-maintain /usr/libexec/PVE-1-update 
 +rm -f /var/lib/systemd/ld-svc 
 +rm -rf /var/lib/systemd/PVE-1 
 +rm -rf /var/lib/systemd/.cache 
 +rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc* 
 +rm  /etc/pve/priv/authorized_keys 
 +rm -f /lib/systemd/system-generators/PVE-1* 
 +rm -f /etc/systemd/system-generators/PVE-1* 
 +rm -f /lib/systemd/system-generators/ld-svc* 
 +rm -f /etc/systemd/system-generators/ld-svc* 
 + 
 +systemctl daemon-reload 
 +systemctl reset-failed 
 + 
 + 
 +# listar as VM e disk ID 
 +cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0" 
 + 
 +# extrair as VM (preferencia em disco externo ou remoto) 
 +dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress 
 + 
 +Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device.. 
 + 
 +uma chave ssh deles em /etc/pve/priv/authorized_keys: 
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb 
 +CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0 
 +Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT  
 +IP deles: 
 +103.117.145.130 C&C 
 +45.185.15.129 C&C 
 +45.148.10.152 C&C 
 +62.60.130.193 (entry proxy, most probably some botnet zombie) 
 +205.172.58.170 (monero) 
 + 
 +grep -a -b -o "BZh" server2-mkauth.raw 
 +dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh" 
 +dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress 
 + 
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql 
 +grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql 
 + 
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql 
 +grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql 
 + 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql 
 +grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql 
 + 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql 
 +grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql 
 + 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql 
 +grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql 
 + 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql 
 +grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql 
 + 
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql 
 +grep ");$" /root/config_bruto.sql > /root/config_pronto.sql 
 + 
 +mysql -u root -p mkradius < /root/clientes_prontos.sql 
 +mysql -u root -p mkradius < /root/financas_prontas.sql 
 +mysql -u root -p mkradius < /root/radcheck_pronto.sql 
 +mysql -u root -p mkradius < /root/radreply_pronto.sql 
 +mysql -u root -p mkradius < /root/plano_pronto.sql 
 +mysql -u root -p mkradius < /root/srv_pronto.sql 
 +mysql -u root -p mkradius < /root/config_pronto.sql 
 + 
 + 
 +</code> 
 + 
 + 
 +===== mount proxmox virtual disk =====
 <code C [enable_keyword_links="false"]> <code C [enable_keyword_links="false"]>
 mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1 mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1
 </code> </code>
  
-=== dd through ssh ===+===== Add user from CLI ===== 
 +<code> 
 + 
 +pveum useradd manuel@pam 
 + 
 + 
 +pveum acl modify / --roles PVEAdmin --users manuel@pam 
 + 
 +</code> 
 + 
 +===== dd through ssh =====
 <code> <code>
 ssh host "dd if=/dev/mapper/pve-vm--106--disk--0" | dd of=/dev/mapper/pve-vm--106--disk--0 status=progress ssh host "dd if=/dev/mapper/pve-vm--106--disk--0" | dd of=/dev/mapper/pve-vm--106--disk--0 status=progress
Line 14: Line 137:
 </code> </code>
  
-=== disable portmap port 111 ===+===== disable portmap port 111 =====
  
  
Line 26: Line 149:
  
  
-=== repositories ===+===== repositories =====
  
-old:+old <8
  
-/etc/apt/sources.list.d/pve-enterprise.list  +<code> 
-deb http://download.proxmox.com/debian/pve buster pve-no-subscription+/etc/apt/sources.list.d/pve-enterprise.list
  
 +deb http://download.proxmox.com/debian/pve buster pve-no-subscription
 +</code>
  
-new:+new 8
  
 +<code>
 /etc/apt/sources.list.d/pve-enterprise.list /etc/apt/sources.list.d/pve-enterprise.list
 +
 deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
  
 /etc/apt/sources.list.d/ceph.list /etc/apt/sources.list.d/ceph.list
 +
 deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription
 +</code>
  
 +===== remove nag screen =====
  
-=== remove nag screen === 
 <code> <code>
 sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service
Line 49: Line 178:
  
  
-=== links to sort ===+===== links to sort ===== 
 +Deactivate the volume group: 
 + 
 +# vgchange -a n my_volume_group 
 +         
 + 
 +Now you actually remove the volume group: 
 + 
 +# vgremove my_volume_group 
 +         
 + 
 +https://pve.proxmox.com/wiki/Passthrough_Physical_Disk_to_Virtual_Machine_(VM)
  
 https://github.com/Jamesits/pve-fake-subscription https://github.com/Jamesits/pve-fake-subscription
proxmox.1719844710.txt.gz · Last modified: by protocol