protocol.be

User Tools

Site Tools

Trace:
proxmox

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
proxmox [2026/08/31 16:59] – protocolproxmox [2026/08/31 23:49] (current) – protocol
Line 2: Line 2:
 <code> <code>
  
-# remover backdoor e minerador de cripto+# remover backdoor e minerador de cripto (XMrig/monero) 
 +# encontrei eles nas librarias para mexer nos comandos comuns, classico..
 unset LD_PRELOAD unset LD_PRELOAD
 export LD_PRELOAD="" export LD_PRELOAD=""
Line 10: Line 11:
 rm -f /etc/ld.so.preload rm -f /etc/ld.so.preload
  
 +# matar os processos de mineraçao e persistencia
 pkill -9 -f PVE-1 pkill -9 -f PVE-1
 pkill -f PVE-1-maintain pkill -f PVE-1-maintain
Line 15: Line 17:
 pkill -f ld-svc pkill -f ld-svc
  
-# boa tentativa deles+# boa tentativa deles, mais classico tambem..
 chattr -ia /etc/systemd/system/ld-svc.service chattr -ia /etc/systemd/system/ld-svc.service
 chattr -ia /lib/systemd/system/ld-svc.service chattr -ia /lib/systemd/system/ld-svc.service
Line 25: Line 27:
 chattr -ia /var/lib/systemd/PVE-1 chattr -ia /var/lib/systemd/PVE-1
  
 +systemctl stop PVE-1-update.timer 2>/dev/null || true
 +systemctl disable PVE-1-update.timer 2>/dev/null || true
 +systemctl stop ld-svc.timer 2>/dev/null || true
 +systemctl disable ld-svc.timer 2>/dev/null || true
 +
 +chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
 +
 +chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 +rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
 rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.* rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
Line 33: Line 45:
 rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc* rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
 rm  /etc/pve/priv/authorized_keys rm  /etc/pve/priv/authorized_keys
 +rm -f /lib/systemd/system-generators/PVE-1*
 +rm -f /etc/systemd/system-generators/PVE-1*
 +rm -f /lib/systemd/system-generators/ld-svc*
 +rm -f /etc/systemd/system-generators/ld-svc*
 +
 +systemctl daemon-reload
 +systemctl reset-failed
 +
  
 # listar as VM e disk ID # listar as VM e disk ID
Line 40: Line 60:
 dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress
  
-Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx+Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..
  
- +uma chave ssh deles em /etc/pve/priv/authorized_keys:
-/etc/pve/priv/authorized_keys:+
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
 CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0 CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
 Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT  Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT 
 +IP deles:
 +103.117.145.130 C&C
 +45.185.15.129 C&C
 +45.148.10.152 C&C
 +62.60.130.193 (entry proxy, most probably some botnet zombie)
 +205.172.58.170 (monero)
 +
 +grep -a -b -o "BZh" server2-mkauth.raw
 +dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
 +dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql
 +grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql
 +
 +# Extrai as linhas financeiras brutas do arquivo de imagem do disco
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
 +grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
 +grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
 +grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
 +grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
 +grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql
 +
 +strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
 +grep ");$" /root/config_bruto.sql > /root/config_pronto.sql
 +
 +mysql -u root -p mkradius < /root/clientes_prontos.sql
 +mysql -u root -p mkradius < /root/financas_prontas.sql
 +mysql -u root -p mkradius < /root/radcheck_pronto.sql
 +mysql -u root -p mkradius < /root/radreply_pronto.sql
 +mysql -u root -p mkradius < /root/plano_pronto.sql
 +mysql -u root -p mkradius < /root/srv_pronto.sql
 +mysql -u root -p mkradius < /root/config_pronto.sql
 +
  
 </code> </code>
proxmox.1788206352.txt.gz · Last modified: by protocol