protocol.be

User Tools

Site Tools

Trace: • proxmox
proxmox

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
proxmox [2026/08/31 15:53] – protocolproxmox [2026/08/31 23:49] (current) – protocol
Line 2: Line 2:
 <code> <code>
  
 +# remover backdoor e minerador de cripto (XMrig/monero)
 +# encontrei eles nas librarias para mexer nos comandos comuns, classico..
 unset LD_PRELOAD unset LD_PRELOAD
 export LD_PRELOAD="" export LD_PRELOAD=""
Line 9: Line 11:
 rm -f /etc/ld.so.preload rm -f /etc/ld.so.preload
  
 +# matar os processos de mineraçao e persistencia
 pkill -9 -f PVE-1 pkill -9 -f PVE-1
 pkill -f PVE-1-maintain pkill -f PVE-1-maintain
Line 14: Line 17:
 pkill -f ld-svc pkill -f ld-svc
  
-# 1. Remove os bloqueios de escrita e deleção dos serviços e scripts maliciosos+# boa tentativa deles, mais classico tambem..
 chattr -ia /etc/systemd/system/ld-svc.service chattr -ia /etc/systemd/system/ld-svc.service
 chattr -ia /lib/systemd/system/ld-svc.service chattr -ia /lib/systemd/system/ld-svc.service
Line 24: Line 27:
 chattr -ia /var/lib/systemd/PVE-1 chattr -ia /var/lib/systemd/PVE-1
  
 +systemctl stop PVE-1-update.timer 2>/dev/null || true
 +systemctl disable PVE-1-update.timer 2>/dev/null || true
 +systemctl stop ld-svc.timer 2>/dev/null || true
 +systemctl disable ld-svc.timer 2>/dev/null || true
 +
 +chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +
 +chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 +rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
 rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.* rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
Line 31: Line 44:
 rm -rf /var/lib/systemd/.cache rm -rf /var/lib/systemd/.cache
 rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc* rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
 +rm  /etc/pve/priv/authorized_keys
 +rm -f /lib/systemd/system-generators/PVE-1*
 +rm -f /etc/systemd/system-generators/PVE-1*
 +rm -f /lib/systemd/system-generators/ld-svc*
 +rm -f /etc/systemd/system-generators/ld-svc*
 +
 +systemctl daemon-reload
 +systemctl reset-failed
 +
 +
 +# listar as VM e disk ID
 +cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0"
 +
 +# extrair as VM (preferencia em disco externo ou remoto)
 +dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress
 +
 +Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..
 +
 +uma chave ssh deles em /etc/pve/priv/authorized_keys:
 +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
 +CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
 +Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT 
 +IP deles:
 +103.117.145.130 C&C
 +45.185.15.129 C&C
 +45.148.10.152 C&C
 +62.60.130.193 (entry proxy, most probably some botnet zombie)
 +205.172.58.170 (monero)
 +
 +grep -a -b -o "BZh" server2-mkauth.raw
 +dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
 +dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql
 +grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
 +grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
 +grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
 +grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
 +grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
 +grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
 +grep ");$" /root/config_bruto.sql > /root/config_pronto.sql
 +
 +mysql -u root -p mkradius < /root/clientes_prontos.sql
 +mysql -u root -p mkradius < /root/financas_prontas.sql
 +mysql -u root -p mkradius < /root/radcheck_pronto.sql
 +mysql -u root -p mkradius < /root/radreply_pronto.sql
 +mysql -u root -p mkradius < /root/plano_pronto.sql
 +mysql -u root -p mkradius < /root/srv_pronto.sql
 +mysql -u root -p mkradius < /root/config_pronto.sql
 +
  
 </code> </code>
proxmox.1788202405.txt.gz · Last modified: by protocol