protocol.be

# remover backdoor e minerador de cripto (XMrig/monero)
# encontrei eles nas librarias para mexer nos comandos comuns, classico..
unset LD_PRELOAD
export LD_PRELOAD=""

chattr -ia /etc/ld.so.preload
echo "" > /etc/ld.so.preload
rm -f /etc/ld.so.preload

# matar os processos de mineraçao e persistencia
pkill -9 -f PVE-1
pkill -f PVE-1-maintain
pkill -f PVE-1-update
pkill -f ld-svc

# boa tentativa deles, mais classico tambem..
chattr -ia /etc/systemd/system/ld-svc.service
chattr -ia /lib/systemd/system/ld-svc.service
chattr -ia /etc/systemd/system/PVE-1-update.*
chattr -ia /lib/systemd/system/PVE-1-update.*
chattr -ia /usr/libexec/PVE-1-maintain
chattr -ia /usr/libexec/PVE-1-update
chattr -ia /var/lib/systemd/ld-svc
chattr -ia /var/lib/systemd/PVE-1

systemctl stop PVE-1-update.timer 2>/dev/null || true
systemctl disable PVE-1-update.timer 2>/dev/null || true
systemctl stop ld-svc.timer 2>/dev/null || true
systemctl disable ld-svc.timer 2>/dev/null || true

chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer

chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
rm -f /usr/libexec/PVE-1-maintain /usr/libexec/PVE-1-update
rm -f /var/lib/systemd/ld-svc
rm -rf /var/lib/systemd/PVE-1
rm -rf /var/lib/systemd/.cache
rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
rm  /etc/pve/priv/authorized_keys
rm -f /lib/systemd/system-generators/PVE-1*
rm -f /etc/systemd/system-generators/PVE-1*
rm -f /lib/systemd/system-generators/ld-svc*
rm -f /etc/systemd/system-generators/ld-svc*

systemctl daemon-reload
systemctl reset-failed


# listar as VM e disk ID
cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0"

# extrair as VM (preferencia em disco externo ou remoto)
dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress

Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..

uma chave ssh deles em /etc/pve/priv/authorized_keys:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT 
IP deles:
103.117.145.130 C&C
45.185.15.129 C&C
45.148.10.152 C&C
62.60.130.193 (entry proxy, most probably some botnet zombie)
205.172.58.170 (monero)

grep -a -b -o "BZh" server2-mkauth.raw
dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress

# Extrai as linhas financeiras brutas do arquivo de imagem do disco
strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql

# Extrai as linhas financeiras brutas do arquivo de imagem do disco
strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql

strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql

strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql

strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql

strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql

strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
grep ");$" /root/config_bruto.sql > /root/config_pronto.sql

mysql -u root -p mkradius < /root/clientes_prontos.sql
mysql -u root -p mkradius < /root/financas_prontas.sql
mysql -u root -p mkradius < /root/radcheck_pronto.sql
mysql -u root -p mkradius < /root/radreply_pronto.sql
mysql -u root -p mkradius < /root/plano_pronto.sql
mysql -u root -p mkradius < /root/srv_pronto.sql
mysql -u root -p mkradius < /root/config_pronto.sql

mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1

pveum useradd manuel@pam


pveum acl modify / --roles PVEAdmin --users manuel@pam

ssh host "dd if=/dev/mapper/pve-vm--106--disk--0" | dd of=/dev/mapper/pve-vm--106--disk--0 status=progress

or

dd if=/dev/mapper/pve-vm--106--disk--0 bs=4MiB conv=sync status=progress | ssh host ' dd of=/dev/mapper/pve-vm--106--disk--0 bs=4MiB'

systemctl stop rpcbind

systemctl stop rpcbind.socket

systemctl disable rpcbind

systemctl disable rpcbind.socket

old <8

/etc/apt/sources.list.d/pve-enterprise.list

deb http://download.proxmox.com/debian/pve buster pve-no-subscription

new 8

/etc/apt/sources.list.d/pve-enterprise.list

deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

/etc/apt/sources.list.d/ceph.list

deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription

sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service

Deactivate the volume group:

# vgchange -a n my_volume_group

Now you actually remove the volume group:

# vgremove my_volume_group

https://pve.proxmox.com/wiki/Passthrough_Physical_Disk_to_Virtual_Machine_(VM)

https://github.com/Jamesits/pve-fake-subscription

https://github.com/foundObjects/pve-nag-buster/

https://tteck.github.io/Proxmox/

https://helper-scripts.com/