蛋疼啊，服务器被入侵成肉鸡了，发出大量SYN请求到某个网站！（瞬间有种被OOXX（强）（奸）的赶脚） 泪奔ING...

源起：

Linux服务器日常检查，#ps aux 发现大量httpd进程，和往常情况不同(和以往多出好几倍)，接着#top 一下，httpd名列前茅！（JJ Fly...）

#netstat -anp 发现大量SYN_SENT,成肉鸡了！（瞬间有种被OOXX（强）（奸）的赶脚）！

#cd / 转到根目录  #ll -a检查最近修改过的文件，发现/etc文件夹在前几天凌晨三点被修改过，#cd /etc   #ll -a

检测是否存在root.kit

1.安装chkrootkit（不安装工具，手动检测，你会疯的）

rootkit从浅显的层面来讲即一种具有自我隐蔽性的后门程序，它往往被入侵者作为一种入侵工具。通过rootkit，入侵者可以偷偷控制被入侵的电脑，因此危害巨大。chkrootkit是一个Linux系统下的查找检测rootkit后门的工具。

安装方法

1、准备gcc编译环境

对于CentOS系统，执行下述三条命令：

yum -y install gcc
yum -y install gcc-c++
yum -y install make

对于debian系统，执行下述两条命令：

apt-get -y install gcc
apt-get -y install make

2、下载chkrootkit源码

chkrootkit的官方网站为 http://www.chkrootkit.org ，下述下载地址为官方地址。为了安全起见，务必在官方下载此程序：

1 [root@www ~]# wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

3、解压下载回来的安装包

1 [root@www ~]# tar zxf chkrootkit.tar.gz

4、编译安装（后文命令中出现的“*”无需替换成具体字符，原样复制执行即可）

1 [root@www ~]# cd chkrootkit-*
2 [root@www ~]# make sense

注意，上面的编译命令为make sense。

5、把编译好的文件部署到/usr/local/目录中，并删除遗留的文件

1 [root@www ~]# cd ..
2 [root@www ~]# cp -r chkrootkit-* /usr/local/chkrootkit
3 [root@www ~]# rm -r chkrootkit-*

至此，安装完毕。

使用方法

安装好的chkrootkit程序位于 /usr/local/chkrootkit/chkrootkit

直接执行

1 root@vm:~# /usr/local/chkrootkit/chkrootkit

即可对系统rootkit进行全面扫面，并滚动显示出结果，

（注：由于chkrootkit的检查过程使用了部分系统命令。因此，如果服务器被入侵，则依赖的系统命令可能也已经被入侵者做了手脚，chkrootkit的结果将变得完全不可信，甚至连系统ls等查看文件的基础命令也变得不可信。）

（附：chkrootkit参数说明）

Usage: ./chkrootkit [options] [test ...]
   Options:
        -h                显示帮助信息
        -V                显示版本信息
        -l                显示测试内容
        -d                debug模式，显示检测过程的相关指令程序
        -q                安静模式，只显示有问题部分，
        -x                高级模式，显示所有检测结果
        -r dir            设定指定的目录为根目录
        -p dir1:dir2:dirN 检测指定目录
        -n                跳过NFS连接的目录

2.rootkit hunter的使用

 
2.1 解压安装
解压
#tar -zxvf rkhunter-1.3.4.tar.gz
安装
#cd rkhunter-1.3.4
#./installer.sh -h
Usage: ./installer.sh <parameters>
Ordered valid parameters:
--help (-h)      : 显示帮助
--examples       : 显示安装实例
--layout <value> : 选择安装模板(安装必选参数).
                   模板选择：
                    - default: (FHS compliant),
                    - /usr,
                    - /usr/local,
                    - oldschool: 之前版本安装路径,
                    - custom: 自定义安装路径,
                    - RPM: for building RPM's. Requires $RPM_BUILD_ROOT.
                    - DEB: for building DEB's. Requires $DEB_BUILD_ROOT.
--striproot      : Strip path from custom layout (for package maintainers).
--install        : 根据选择目录安装
--show           : 显示安装路径
--remove         : 卸载rkhunter
--version        : 显示安装版本
 
安装指令
#./installer.sh --layout default --install
 
2.2 rkhunter操作
#/usr/local/bin/rkhunter --propupd
#/usr/local/bin/rkhunter -c --sk -rwo
 
Warning: File '/bin/awk' has the immutable-bit set.
Warning: File '/bin/basename' has the immutable-bit set.
Warning: File '/bin/bash' has the immutable-bit set.
Warning: File '/bin/cat' has the immutable-bit set.
Warning: File '/bin/chmod' has the immutable-bit set.
Warning: File '/bin/chown' has the immutable-bit set.
Warning: File '/bin/cp' has the immutable-bit set.
Warning: File '/bin/csh' has the immutable-bit set.
Warning: File '/bin/cut' has the immutable-bit set.
Warning: File '/bin/date' has the immutable-bit set.
Warning: File '/bin/df' has the immutable-bit set.
Warning: File '/bin/dmesg' has the immutable-bit set.
Warning: File '/bin/echo' has the immutable-bit set.
Warning: File '/bin/ed' has the immutable-bit set.
Warning: File '/bin/egrep' has the immutable-bit set.
Warning: File '/bin/env' has the immutable-bit set.
Warning: File '/bin/fgrep' has the immutable-bit set.
Warning: File '/bin/grep' has the immutable-bit set.
Warning: File '/bin/kill' has the immutable-bit set.
Warning: File '/bin/login' has the immutable-bit set.
Warning: File '/bin/ls' has the immutable-bit set.
Warning: File '/bin/mail' has the immutable-bit set.
Warning: File '/bin/mktemp' has the immutable-bit set.
Warning: File '/bin/more' has the immutable-bit set.
Warning: File '/bin/mount' has the immutable-bit set.
Warning: File '/bin/mv' has the immutable-bit set.
Warning: File '/bin/netstat' has the immutable-bit set.
Warning: File '/bin/ps' has the immutable-bit set.
Warning: File '/bin/pwd' has the immutable-bit set.
Warning: File '/bin/rpm' has the immutable-bit set.
Warning: File '/bin/sed' has the immutable-bit set.
Warning: File '/bin/sh' has the immutable-bit set.
Warning: File '/bin/sort' has the immutable-bit set.
Warning: File '/bin/su' has the immutable-bit set.
Warning: File '/bin/touch' has the immutable-bit set.
Warning: File '/bin/uname' has the immutable-bit set.
Warning: File '/bin/gawk' has the immutable-bit set.
Warning: File '/bin/tcsh' has the immutable-bit set.
Warning: File '/usr/bin/awk' has the immutable-bit set.
Warning: File '/usr/bin/cut' has the immutable-bit set.
Warning: File '/usr/bin/env' has the immutable-bit set.
Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: perl script text executable
Warning: The command '/usr/bin/groups' has been replaced by a script: /usr/bin/groups: Bourne shell script text executable
Warning: File '/usr/bin/kill' has the immutable-bit set.
Warning: The command '/usr/bin/ldd' has been replaced by a script: /usr/bin/ldd: Bourne shell script text executable
Warning: File '/usr/bin/top' has the immutable-bit set.
Warning: The command '/usr/bin/whatis' has been replaced by a script: /usr/bin/whatis: Bourne shell script text executable
Warning: File '/usr/bin/gawk' has the immutable-bit set.
Warning: File '/sbin/chkconfig' has the immutable-bit set.
Warning: File '/sbin/depmod' has the immutable-bit set.
Warning: File '/sbin/fuser' has the immutable-bit set.
Warning: File '/sbin/ifconfig' has the immutable-bit set.
Warning: File '/sbin/ifdown' has the immutable-bit set.
Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable
Warning: File '/sbin/ifup' has the immutable-bit set.
Warning: The command '/sbin/ifup' has been replaced by a script: /sbin/ifup: Bourne-Again shell script text executable
Warning: File '/sbin/init' has the immutable-bit set.
Warning: File '/sbin/insmod' has the immutable-bit set.
Warning: File '/sbin/ip' has the immutable-bit set.
Warning: File '/sbin/lsmod' has the immutable-bit set.
Warning: File '/sbin/modinfo' has the immutable-bit set.
Warning: File '/sbin/modprobe' has the immutable-bit set.
Warning: File '/sbin/nologin' has the immutable-bit set.
Warning: File '/sbin/rmmod' has the immutable-bit set.
Warning: File '/sbin/runlevel' has the immutable-bit set.
Warning: File '/sbin/sulogin' has the immutable-bit set.
Warning: File '/sbin/sysctl' has the immutable-bit set.
Warning: File '/sbin/syslogd' has the immutable-bit set.
Warning: File '/usr/sbin/adduser' has the immutable-bit set.
Warning: No hash value found for file '/usr/sbin/amd' in the rkhunter.dat file.
Warning: File '/usr/sbin/amd' has the immutable-bit set.
Warning: File '/usr/sbin/chroot' has the immutable-bit set.
Warning: File '/usr/sbin/groupadd' has the immutable-bit set.
Warning: File '/usr/sbin/groupdel' has the immutable-bit set.
Warning: File '/usr/sbin/groupmod' has the immutable-bit set.
Warning: File '/usr/sbin/grpck' has the immutable-bit set.
Warning: File '/usr/sbin/kudzu' has the immutable-bit set.
Warning: File '/usr/sbin/lsof' has the immutable-bit set.
Warning: File '/usr/sbin/prelink' has the immutable-bit set.
Warning: File '/usr/sbin/pwck' has the immutable-bit set.
Warning: File '/usr/sbin/sestatus' has the immutable-bit set.
Warning: File '/usr/sbin/tcpd' has the immutable-bit set.
Warning: File '/usr/sbin/useradd' has the immutable-bit set.
Warning: File '/usr/sbin/userdel' has the immutable-bit set.
Warning: File '/usr/sbin/usermod' has the immutable-bit set.
Warning: File '/usr/sbin/vipw' has the immutable-bit set.
Warning: File '/usr/sbin/xinetd' has the immutable-bit set.
Warning: Dreams Rootkit                           [ Warning ]
         File '/usr/bin/sense' found
         File '/usr/bin/sl2' found
         File '/usr/bin/(swapd)' found
Warning: Checking for possible rootkit strings    [ Warning ]
         Found string '/dev/ttyoa' in file '/bin/netstat'. Possible rootkit: Sin Rootkit
Warning: Found possible sniffer log file: /usr/lib/libice.log
Warning: Found enabled xinetd service: /etc/xinetd.d/auth
Warning: Found enabled xinetd service: /etc/xinetd.d/cups-lpd
Warning: Found enabled xinetd service: /etc/xinetd.d/swat
Warning: Found enabled xinetd service: /etc/xinetd.d/vmware-authd
Warning: Possible promiscuous interfaces:
         'ifconfig' command output:
         'ip' command output: eth0
Warning: Account 'test' is root equivalent (UID = 0)
Warning: Account 'james' is root equivalent (UID = 0)
Warning: Account 'master' is root equivalent (UID = 0)
Warning: Account 'admin' is root equivalent (UID = 0)
Warning: The SSH configuration option 'PermitRootLogin' has not been set.
         The default value may be 'yes', to allow root access.
Warning: The SSH configuration option 'Protocol' has not been set.
         The default value may be '2,1', to allow the use of protocol version 1.
Warning: Hidden file found: /usr/share/man/man1/..1.gz: gzip compressed data, from Unix, max compression
Warning: Application 'exim', version '4.43', is out of date, and possibly a security risk.
Warning: Application 'gpg', version '1.2.6', is out of date, and possibly a security risk.
Warning: Application 'openssl', version '0.9.7a', is out of date, and possibly a security risk.
Warning: Application 'php', version '4.3.9', is out of date, and possibly a security risk.
One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)
结果就是“中招”，基本上就是重新安装系统的命了。不过从检查的结果来看，可以判断所中的rootkit的类型和被替换的系统文件。同时对一些程序版本进行检测，提供的信息比较多。
 
2.3 指令参数说明
#/usr/local/bin/rkhunter
Usage: rkhunter {--check | --update | --versioncheck |
                 --propupd [{filename | directory | package name},...] |
                 --list [{tests | {lang | languages} | rootkits},...] |
                 --version | --help} [options]
Current options are:
         --append-log                  在日志文件后追加日志，而不覆盖原有日志
         --bindir <directory>...       Use the specified command directories
     -c, --check                       检测当前系统
  --cs2, --color-set2                  Use the second color set for output
         --configfile <file>           使用特定的配置文件
         --cronjob                     作为cron定期运行
                                       (包含参数 -c, --sk , --nocolors )
         --dbdir <directory>           Use the specified database directory
         --debug                       Debug模式(不要使用除非要求使用)
         --disable <test>[,<test>...]  跳过指定检查对象(默认为无)
         --display-logfile             在最后显示日志文件内容
         --enable  <test>[,<test>...]  对指定检测对象进行检查
                                       (默认检测所有对象)
         --hash {MD5 | SHA1 | NONE |   使用指定的文件哈希函数
                 <command>}            (Default is SHA1)
     -h, --help                        显示帮助菜单
 --lang, --language <language>         指定使用的语言
                                       (Default is English)
         --list [tests | languages |   罗列测试对象明朝，使用语言，可检测的木马程序
                 rootkits]             
     -l, --logfile [file]              写到指定的日志文件名
                                       (Default is /var/log/rkhunter.log)
         --noappend-log                不追加日志，直接覆盖日志文件
         --nocolors                    输出只显示黑白两色
         --nolog                       不写入日志文件
--nomow, --no-mail-on-warning          如果有警告信息，不发送邮件
   --ns, --nosummary                   不显示检查结果的统计数据
 --novl, --no-verbose-logging          不显示详细记录
         --pkgmgr {RPM | DPKG | BSD |  使用特定的包管理用于文件的哈希值验证
                   NONE}               (Default is NONE)
         --propupd [file | directory | 更新整个文件属性数据库或仅仅更新指定条目
                    package]...        
     -q, --quiet                       安静模式(no output at all)
  --rwo, --report-warnings-only        只显示警告信息
     -r, --rootdir <directory>         使用指定的root目录
   --sk, --skip-keypress               自动完成所有检测，跳过键盘输入

--summary                     显示检测结果的统计信息
                                       (This is the default)
         --syslog [facility.priority]  记录检测启动和结束时间到系统日志中
                                       (Default level is authpriv.notice)
         --tmpdir <directory>          使用指定的临时目录
         --update                      检测更新内容
   --vl, --verbose-logging             使用详细日志记录 (on by default)
     -V, --version                     显示版本信息
         --versioncheck                检测最新版本
     -x, --autox                       当X在使用时，自动启动检测
     -X, --no-autox                    当X在使用时，不自启检测

转自：

http://www.spriteking.com/archives/1133

Linux后门入侵检测的更多相关文章

  1. 安全运维之：Linux后门入侵检测工具的使用

    安全运维之:Linux后门入侵检测工具的使用 https://blog.csdn.net/exitgogo/article/details/39547113

  2. Linux后门入侵检测工具，附bash漏洞解决方法[转载]

    转自:http://blog.jobbole.com/77663/ 官网 ClamAV杀毒软件介绍 ClamAV是一个在命令行下查毒软件,因为它不将杀毒作为主要功能,默认只能查出您计算机内的病毒,但是 ...

  3. Linux后门入侵检测工具

    一.rootkit简介 rootkit是Linux平台下最常见的一种木马后门工具,它主要通过替换系统文件来达到入侵和和隐蔽的目的,这种木马比普通木马后门更加危险和隐蔽,普通的检测工具和检查手段很难发现 ...

  4. Chkrootkit安装配置教程 – Linux后门入侵检测

    rootkit从浅显的层面来讲即一种具有自我隐蔽性的后门程序,它往往被入侵者作为一种入侵工具.通过rootkit,入侵者可以偷偷控制被入侵的电脑,因此危害巨大.chkrootkit是一个Linux系统 ...

  5. Linux后门入侵检测工具，附bash漏洞解决方法

    一.rootkit简介 rootkit是Linux平台下最常见的一种木马后门工具,它主要通过替换系统文件来达到入侵和和隐蔽的目的,这种木马比普通木马后门更加危险和隐蔽,普通的检测工具和检查手段很难发现 ...

  6. Linux主机入侵检测

    检查系统信息.用户账号信息 ● 操作系统信息 cat /proc/version 用户信息 用户信息文件 /etc/passwd root:x:0:0:root:/root:/bin/bash 用户名 ...

  7. Linux入侵检测工具 - RKHunter

    RKHunter是Linux系统平台下的一款开源入侵检测工具 特点 (1)安装便捷,运行快速 (2)扫描范围全,能够检测各种已知的rootkit特征码.端口扫描.常用程序文件的变动情况检查 主要功能 ...

  8. Linux 入侵检测小结

    Linux  入侵检测小结 0x00 审计命令 在linux中有5个用于审计的命令: last:这个命令可用于查看我们系统的成功登录.关机.重启等情况:这个命令就是将/var/log/wtmp文件格式 ...

  9. Linux 上搭建 Snort+BASE 入侵检测系统

    配置实验环境 由于本人电脑的存储空间不足,无法再承担安装一个虚拟机的开销,因此在阿里云上申请了一个云服务器进行本次实验.服务器配置如下: 1 核 - 2GB 内存 - 40GB 系统盘 操作系统:Ub ...

随机推荐

  1. 25_android下文件访问的权限

    写文件:FileOutputStream fos = 上下文.openFileOutput("private.txt",Context.MODE_PRIVATR);参数1 文件名, ...

  2. CSS常用布局整理（二）

    1-2-1单列变宽布局 side列定宽300px,content列变宽,尺寸是100%-300px.核心的问题就是浮动列的宽度应该等于“100% - 300px”,而CSS显然不支持这种带有减法运算的 ...

  3. Sco Openserver下 配置SSH服务（图解）

    Sco Openserver下 配置SSH服务 好久没玩儿Sco Unix系统了,春节过后为邮政系统的一个朋友调试系统( 装了个远程服务) ,这两天将安装过程回忆了一下,总结出来给大家分享. 本试验需 ...

  4. a different object with the same identifier value was already associat

    问题:这个著名的托管态update更新异常 org.hibernate.NonUniqueObjectException: a different object with the same ident ...

  5. 手机h5 页面 iPhone 下 手机号码 蓝色字体 黑色字体

    在手机端 苹果系统下 手机号码会变成蓝色的 ,如何不让手机号变成蓝色  黑色 或者其他颜色 , 苹果真是的 原因是识别成了电话号码,然后成为了链接.解决方法: 更改链接的颜色 a{ color: re ...

  6. JavaScript 性能优化1

    一直在学习javascript,也有看过<犀利开发Jquery内核详解与实践>,对这本书的评价只有两个字犀利,可能是对javascript理解的还不够透彻异或是自己太笨,更多的是自己不擅于 ...

  7. leetcode 118

    118. Pascal's Triangle Given numRows, generate the first numRows of Pascal's triangle. For example, ...

  8. Oracle定时器执行多线程

    what里面加下面代码强制执行多线程   begin  execute immediate 'alter session force parallel dml parallel 16';  pkg_s ...

  9. xdotool-linux下的按键精灵

    这是我在ST写的用来自动打开机顶盒的脚本 #!/bin/bash init_stb() { xdotool type "telnet 10.80.117.$1" xdotool k ...

  10. c#中判断对象为空的几种方式（字符串等）

    (1)先了解几个与空类型相关的关键字和对象  Null : 关键字表示不引用任何对象的空引用,它是所有引用类型变量的默认值,在2.0版本之前也就只有引用变量类型可以为null,如(string a=n ...