protocol.be

User Tools

Site Tools

Trace:
proxmox

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
proxmox [2024/09/01 11:00] – protocolproxmox [2026/08/31 23:49] (current) – protocol
Line 1: Line 1:
 +===== Limpar backdoor =====
 +<code>
 +
 +# remover backdoor e minerador de cripto (XMrig/monero)
 +# encontrei eles nas librarias para mexer nos comandos comuns, classico..
 +unset LD_PRELOAD
 +export LD_PRELOAD=""
 +
 +chattr -ia /etc/ld.so.preload
 +echo "" > /etc/ld.so.preload
 +rm -f /etc/ld.so.preload
 +
 +# matar os processos de mineraçao e persistencia
 +pkill -9 -f PVE-1
 +pkill -f PVE-1-maintain
 +pkill -f PVE-1-update
 +pkill -f ld-svc
 +
 +# boa tentativa deles, mais classico tambem..
 +chattr -ia /etc/systemd/system/ld-svc.service
 +chattr -ia /lib/systemd/system/ld-svc.service
 +chattr -ia /etc/systemd/system/PVE-1-update.*
 +chattr -ia /lib/systemd/system/PVE-1-update.*
 +chattr -ia /usr/libexec/PVE-1-maintain
 +chattr -ia /usr/libexec/PVE-1-update
 +chattr -ia /var/lib/systemd/ld-svc
 +chattr -ia /var/lib/systemd/PVE-1
 +
 +systemctl stop PVE-1-update.timer 2>/dev/null || true
 +systemctl disable PVE-1-update.timer 2>/dev/null || true
 +systemctl stop ld-svc.timer 2>/dev/null || true
 +systemctl disable ld-svc.timer 2>/dev/null || true
 +
 +chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +
 +chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 +rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 +rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
 +rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
 +rm -f /usr/libexec/PVE-1-maintain /usr/libexec/PVE-1-update
 +rm -f /var/lib/systemd/ld-svc
 +rm -rf /var/lib/systemd/PVE-1
 +rm -rf /var/lib/systemd/.cache
 +rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
 +rm  /etc/pve/priv/authorized_keys
 +rm -f /lib/systemd/system-generators/PVE-1*
 +rm -f /etc/systemd/system-generators/PVE-1*
 +rm -f /lib/systemd/system-generators/ld-svc*
 +rm -f /etc/systemd/system-generators/ld-svc*
 +
 +systemctl daemon-reload
 +systemctl reset-failed
 +
 +
 +# listar as VM e disk ID
 +cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0"
 +
 +# extrair as VM (preferencia em disco externo ou remoto)
 +dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress
 +
 +Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..
 +
 +uma chave ssh deles em /etc/pve/priv/authorized_keys:
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
 +CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
 +Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT 
 +IP deles:
 +103.117.145.130 C&C
 +45.185.15.129 C&C
 +45.148.10.152 C&C
 +62.60.130.193 (entry proxy, most probably some botnet zombie)
 +205.172.58.170 (monero)
 +
 +grep -a -b -o "BZh" server2-mkauth.raw
 +dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
 +dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql
 +grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
 +grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
 +grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
 +grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
 +grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
 +grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
 +grep ");$" /root/config_bruto.sql > /root/config_pronto.sql
 +
 +mysql -u root -p mkradius < /root/clientes_prontos.sql
 +mysql -u root -p mkradius < /root/financas_prontas.sql
 +mysql -u root -p mkradius < /root/radcheck_pronto.sql
 +mysql -u root -p mkradius < /root/radreply_pronto.sql
 +mysql -u root -p mkradius < /root/plano_pronto.sql
 +mysql -u root -p mkradius < /root/srv_pronto.sql
 +mysql -u root -p mkradius < /root/config_pronto.sql
 +
 +
 +</code>
 +
 +
 ===== mount proxmox virtual disk ===== ===== mount proxmox virtual disk =====
 <code C [enable_keyword_links="false"]> <code C [enable_keyword_links="false"]>
 mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1 mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1
 +</code>
 +
 +===== Add user from CLI =====
 +<code>
 +
 +pveum useradd manuel@pam
 +
 +
 +pveum acl modify / --roles PVEAdmin --users manuel@pam
 +
 </code> </code>
  
Line 26: Line 149:
  
  
-=== repositories ===+===== repositories =====
  
 old <8 old <8
Line 48: Line 171:
 </code> </code>
  
-=== remove nag screen ===+===== remove nag screen ===== 
 <code> <code>
 sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service
 </code> </code>
 +
  
 ===== links to sort ===== ===== links to sort =====
 +Deactivate the volume group:
 +
 +# vgchange -a n my_volume_group
 +        
 +
 +Now you actually remove the volume group:
 +
 +# vgremove my_volume_group
 +        
 +
 +https://pve.proxmox.com/wiki/Passthrough_Physical_Disk_to_Virtual_Machine_(VM)
  
 https://github.com/Jamesits/pve-fake-subscription https://github.com/Jamesits/pve-fake-subscription
proxmox.1725199215.txt.gz · Last modified: by protocol