Linux木马查杀辅助脚本

最新推荐文章于 2024-10-09 17:42:05 发布
最新推荐文章于 2024-10-09 17:42:05 发布
阅读量787 收藏 2
点赞数 1
CC 4.0 BY-SA版权
分类专栏： Linux 文章标签： Linux 木马
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/Jaskzon/article/details/90449808 
#/bin/sh
#
#
# Linux information Collection
#
#
#  by  thecastle <https://github.com/IIComing> 
#
# . ############################################################

clear
echo
echo "############################################################"
echo '|                                                           |'
echo "|    Linux Information Collection  			              |"
echo "|                                                           |"
echo "|       by thecastle <https://github.com/IIComing>          |"
echo "############################################################"
echo
echo
echo "STARTING >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>"
echo
echo "Running Time: `date |awk '{print $6" "$2" "$3" "$4}'`"
echo
echo "############################################################"
echo

echo -n "Step 1."
echo "  Hi, are you root?"

if [ -f /usr/bin/id ]; then
  /usr/bin/id |grep "uid=0" >/dev/null 2>&1
  if [ $? -eq 0 ] ; then
     echo "         yes, I am root."
  else
     echo "         Please su root first."
     exit
  fi
else 
	echo "Check for /usr/bin/id........"
	exit
fi

######

echo
echo -n "Step 2."
echo "  Backup PATH variable......"

if [ -f "/tmp/PATH" ] ; then
   echo $PATH >/tmp/PATH
else
   touch /tmp/PATH
   echo $PATH >/tmp/PATH
fi

######

echo
echo -n "Step 3."
echo "  Please change to /tmp directory to see the Gather."

RUNTIME=`date |awk '{print $6" "$2" "$3" "$4}'`
GATHERMAINDIR=/tmp/
GATHERFILE=$GATHERMAINDIR/Gather.`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $2}' |head -n 1`.`date |awk '{print $6"."$2"."$3"."$4}'`

if [ -d $GATHERMAINDIR ] ; then
   echo "         Gathermaindir OK"
else
   echo -n "         Make Gathermaindir..."
   mkdir $GATHERMAINDIR
   chmod 775 $GATHERMAINDIR
   echo "    [ OK ]"
fi

######

echo
echo -n "Step 4."
echo "  Information gathering..."
echo

echo " ____________________________________________________________________ " >>$GATHERFILE
echo "|                                                                    |" >>$GATHERFILE
echo "|                  Linux information Collection                      |" >>$GATHERFILE
echo "|                                                                    |" >>$GATHERFILE
echo "|       		 by thecastle <https://github.com/IIComing>            |" >>$GATHERFILE
echo "|____________________________________________________________________|" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Generate Time: $RUNTIME" >>$GATHERFILE
echo "" >>$GATHERFILE

######

HOSTNAME=`hostname`
DOMAINNAME=`domainname`
OSTYEP=`uname -s`" "`uname -p`" "`uname -r`
UPTIME=`uptime`
MAINIPADD=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $2}' |head -n 1`
MAINNETMASK=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $4}' |head -n 1`
MAINBROADCAST=`ifconfig -a |grep inet |grep -v "127.0.0.1" |awk '{print $6}' |head -n 1`
ROUTETABLE=`netstat -nr`
DNSADDR=`cat /etc/resolv.conf | sed -e '/^#/d' -e /^$/d |grep nameserver | awk '{ print $2 }'`

######

echo '################################################################' >>$GATHERFILE
echo "|                  -= Basic Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

######

echo -n "Checking hostname..."
echo "HostName: $HOSTNAME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking domainname..."
echo "DomainName: $DOMAINNAME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking ostype..."
echo "OsType: $OSTYEP" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking uptime..."
echo "Uptime: $UPTIME" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking hostmainip..."
echo "HostMainIP: $MAINIPADD" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking mainnetmask..."
echo "MainNetMask: $MAINNETMASK" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking all Ethernet card mode..."
echo "Mode: `ifconfig -a|grep UP`" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking mainbroadcast..."
echo "MainBroadCast: $MAINBROADCAST" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking othernetinfo..."
ifconfig -a |grep inet |grep -v "127.0.0.1" |grep -v $MAINIPADD >/dev/null 2>&1
if [ $? -ne 0 ];then 
echo "OtherNetInfo = NONE" >>$GATHERFILE
else
echo "OtherNetInfo :" >>$GATHERFILE
OTHERNETINFO=`ifconfig -a |grep inet |grep -v "127.0.0.1" |grep -v $MAINIPADD 2>/dev/null`
echo $OTHERNETINFO >>$GATHERFILE
fi
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking route table..."
echo "RouteTable: $ROUTETABLE" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking DNS address..."
echo "DNSAddress: $DNSADDR" >>$GATHERFILE
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo -n "Checking syspath variable..."
echo "Syspath:`cat /tmp/PATH`" >>$GATHERFILE 2>/dev/null
echo "    [ OK ]"
echo "" >>$GATHERFILE

######

echo '################################################################' >>$GATHERFILE
echo "|             -= Key command file information =-                |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking File size..."
echo "................................................................." >>$GATHERFILE
echo "File size                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -ahl `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr`>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking File type ..."
echo "................................................................." >>$GATHERFILE
echo "File type                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
file `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr` >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking File md5 ..."
echo "................................................................." >>$GATHERFILE
echo "File md5                  " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -ahl `which ps` `which lsof` `which netstat` `which ss` `which pstree` `which kill` `which killall` `which lsattr` `which chattr` | awk '{print $9}' | xargs md5sum >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|              -= Accounts Password Information =-             |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking umask..."
echo "................................................................." >>$GATHERFILE
echo "Umask Current Value   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Umask = `umask 2>/dev/null`" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

echo -n "Checking account password information..."
echo "................................................................." >>$GATHERFILE
echo "Account password information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
join -t ':' /etc/passwd /etc/shadow | grep -v "\!" | grep -v "\*" |sed -e '/^#/d' -e /^$/d >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/login.defs file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/login.defs File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/login.defs ];then
cat /etc/login.defs| sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/login.defs file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/profile file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/profile File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/profile ];then
cat /etc/profile |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/profile file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking Current logged in user ..."
echo "................................................................." >>$GATHERFILE
echo "Current logged in user    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
w >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/securetty file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/securetty File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/securetty ];then
cat /etc/securetty | sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/securetty file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Rc*.d Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/rc*.d start file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc*.d directory start file "  >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -gld /etc/rc0.d/* | grep -v -E "K[0-9]" | grep  -v README >>$GATHERFILE
ls -gld /etc/rc1.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc2.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -adl /etc/rc3.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc4.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc5.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
ls -gdl /etc/rc6.d/* | grep -v -E "K[0-9]" | grep  -v README>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/rc*.d file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc*.d file List "  >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
a0=`find /etc/rc0.d -type f | grep -v README 2>/dev/null`
a1=`find /etc/rc1.d -type f | grep -v README 2>/dev/null`
a2=`find /etc/rc2.d -type f | grep -v README 2>/dev/null`
a3=`find /etc/rc3.d -type f | grep -v README 2>/dev/null`
a4=`find /etc/rc4.d -type f | grep -v README 2>/dev/null`
a5=`find /etc/rc5.d -type f | grep -v README 2>/dev/null`
a6=`find /etc/rc6.d -type f | grep -v README 2>/dev/null`
for i in $a0 $a1 $a2 $a3 $a4 $a5 $a6; do
echo -n "Checking $i file..."
echo "................................................................." >>$GATHERFILE
echo "$i File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat $i |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"
done
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Process Information =-                    |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking process status information..."
echo "................................................................." >>$GATHERFILE
echo "Process Status Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ps -axu >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking process tree information..."
echo "................................................................." >>$GATHERFILE
echo "Process Tree Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
pstree -p>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking modules information..."
echo "................................................................." >>$GATHERFILE
echo "Modules Information    " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /sbin/lsmod ];then
lsmod >>$GATHERFILE
else
echo "no modules information" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                 -= Network Information =-                    |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking /etc/init.d/ directory..."
echo "................................................................." >>$GATHERFILE
echo "/etc/init.d/ directory " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ls -al /etc/init.d/* >>$GATHERFILE
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking chkconfig information..."
echo "................................................................." >>$GATHERFILE
echo "Chkconfig Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f '/sbin/chkconfig' ];then
chkconfig --list >>$GATHERFILE 2>/dev/null
else
echo "no chkconfig information" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking sockets information..."
echo "................................................................." >>$GATHERFILE
echo "Sockets Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
ss -p >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking listening server ports information..."
echo "................................................................." >>$GATHERFILE
echo "Listening Server Ports Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -ant | grep LISTEN >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking listening services information..."
echo "................................................................." >>$GATHERFILE
echo "Listening Services Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -at | grep LISTEN >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking program processes active connections information..."
echo "................................................................." >>$GATHERFILE
echo "Program Processes Active Connections Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
netstat -pt >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking lsof Information..."
echo "................................................................." >>$GATHERFILE
echo "lsof Information " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
lsof -i >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

#####

echo '################################################################' >>$GATHERFILE
echo "|                 -= Syslog Information =-                     |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/syslog.conf file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/syslog.conf File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/syslog.conf ];then
cat /etc/syslog.conf |sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/syslog.conf file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                   -= DNS Information =-                      |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE

echo -n "Checking /etc/resolv.conf file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/resolv.conf File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/resolv.conf ];then
cat /etc/resolv.conf |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/resolv.conf file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/hosts file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/hosts File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/hosts ];then
cat /etc/hosts|sed -e '/^#/d' -e /^$/d >>$GATHERFILE
else
echo "no /etc/hosts file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|                   -= Cron Information =-                     |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking crontab Information..."
echo "................................................................." >>$GATHERFILE
echo "crontab Information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /usr/bin/crontab ];then
crontab -l >>$GATHERFILE
else
echo "no /usr/bin/crontab file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking /etc/crontab file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/crontab File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
if [ -f /etc/crontab ];then
cat /etc/crontab | sed -e '/^#/d' -e /^$/d>>$GATHERFILE
else
echo "no /etc/crontab file" >>$GATHERFILE
fi
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

if [ -d /var/spool/cron ];then
c=`find /var/spool/cron -type f 2>/dev/null`
for i in $c;do
echo -n "Checking $i file..."
echo "................................................................." >>$GATHERFILE
echo "$i File Content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat $i |sed -e '/^#/d' -e /^$/d>>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"
done
fi 
echo "" >>$GATHERFILE

######

echo '################################################################' >>$GATHERFILE
echo "|                -= Special Files Information =-               |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking /etc/rc.local file..."
echo "................................................................." >>$GATHERFILE
echo "/etc/rc.local content   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
cat /etc/rc.local | sed -e '/^#/d' -e /^$/d>>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking SUID file..."
echo "................................................................." >>$GATHERFILE
echo "SUID File List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -type f \( -perm -04000 -o -perm -02000 \) \-exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking iptables..."
echo "................................................................." >>$GATHERFILE
echo "Iptables information   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
iptables -L >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking abnormity & hide file..."
echo "................................................................." >>$GATHERFILE
echo "Abnormity & Hide File List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -name "..*" >>$GATHERFILE 2>/dev/null
find / -name ".*" | cat -v >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking nouser file or directory..."
echo "................................................................." >>$GATHERFILE
echo "Nouser File or Directory List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -nouser -exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo -n "Checking nogroup file or directory..."
echo "................................................................." >>$GATHERFILE
echo "Nogroup File or Directory List   " >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
find / -nogroup -exec ls -lg {} \; >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

echo '################################################################' >>$GATHERFILE
echo "|              -= Packages/Patches Information =-              |" >>$GATHERFILE
echo '################################################################' >>$GATHERFILE
echo "" >>$GATHERFILE


echo -n "Checking packages installed information..."
echo "................................................................." >>$GATHERFILE
echo "Packages Installed Information" >>$GATHERFILE
echo "................................................................." >>$GATHERFILE
echo "" >>$GATHERFILE
rpm -a >>$GATHERFILE 2>/dev/null
echo "" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "    [ OK ]"

######

# >>>>> ###################################################################

echo
echo -n "Step 5."
echo "  ALL Done."

echo "######################################################################" >>$GATHERFILE
echo "" >>$GATHERFILE
echo "Information collection is complete." >>$GATHERFILE
echo "" >>$GATHERFILE
echo "######################################################################" >>$GATHERFILE

echo "######################################################################"
echo "Information collection is complete."
echo "Please read Gather $GATHERFILE for more details."
echo "######################################################################"
echo


exit 0
Linux应急Rootkit后门查杀&&病毒查杀软件
chinese_cabbage0的博客
07-16 951
生产环境中建议错峰安排扫描任务，避免同时运行多个全盘扫描工具。检测rootkit、后门程序和可疑文件，通过校验和验证系统命令的完整性。检测常见rootkit和系统后门，包括隐藏进程、内核模块恶意修改等。检测隐藏进程、TCP/UDP端口和文件系统隐藏技术。开源反病毒引擎，检测恶意软件、特洛伊木马和恶意脚本。高级系统工具集（进程/内核/网络/注册表分析）企业级端点防护，提供实时威胁防护和EDR功能。支持检测wtmp/utmp日志篡改。三合一检测（进程/端口/文件系统）企业级防护方案，支持服务器和工作站。
kali linux 支持什么编程语言_渗透过程中可能要用到的Kali工具小总结
weixin_39576066的博客
10-24 3036
渗透过程中可能要用到的Kali工具小总结写在最前面最近在搞渗透的时候，发现过程中有一些kali工具还是很适合使用的所以写一个渗透过程中可能用到的kali渗透工具的小小总结写的不对 多多包涵 各位大佬轻喷 :DKali用得好 牢饭准管饱渗透不规范 亲人两行泪先来了解一下Kali(From Wikipdeia)Kali Linux是基于Debian的Linux发行版， 设计用于数字取证操作系统。由Of...
Linux下查杀webshell木马的工具.zip
01-05
Linux下查杀webshell木马的工具.zip
Linux下手动查杀木马
菜鸟、上路
08-25 7216
一、 模拟木马程序病原体并让木马程序自动运行 黑客让脚本自动执行的三种方法： 计划任务，crontab；开机启动；系统命令被替换，使用命令后被触发。 1、 生成木马程序病原体 [root@xuegod120 ~]# vim /usr/bin/fregonnzkq #!/bin/bash touch /tmp/aaa.txt while true do echo date >> /tmp...
linux版杀木马软件,linux下的木马软件
weixin_42298032的博客
05-10 189
Rootkit出现于二十世纪90年代初，在1994年2月的一篇安全咨询报告中首先使用了rootkit这个名词。这篇安全咨询就是CERT-CC的CA-1994-01，题目是Ongoing Network Monitoring Attacks，最新的修订时间是1997年9月19日。从出现至今，rootkit的技术发展非常迅速，应用越来越广泛，检测难度也越来越大。其中针对SunOS和Linux两种操作系...
Linux服务器挖矿木马病毒查杀记录（-bash mcrond bprofr pwnrig ntpdate dbused sysdr）
jackhanyuan的博客
10-09 2781
近期，服务器异常，通过htop或top命令查看CPU占用前几的进程，发现root用户的-bash进程把CPU一半的核占满，而另一台服务器上x用户（被新创建的用户）和一个普通用户CPU占用也异常。杀掉进程后立马又启动了新进程，查看PID目录，可以看到exe指向了一个被删除了的-bash进程(/usr/bin/-bash)，使用查看State为的网络连接，发现有异常外网连接这应该就是-bash病毒木马了。
linux系统查杀木马
最新发布
03-28
### 如何在 Linux 系统中检测和删除木马病毒 #### 工具介绍 为了保护 Linux 系统免受木马和其他恶意程序的影响，可以使用专门的安全检测工具来扫描系统中的潜在威胁。这些工具能够帮助识别已知的恶意软件以及可能...
综合型在线查毒工具：木马病毒快速查杀
- 多样化检测：支持查杀病毒、木马、间谍软件、广告软件等多种类型的恶意软件。 - 云端分析：利用云服务器进行数据处理，确保分析速度快且效率高。 - 文件上传扫描：用户可以上传疑似感染的文件到云端进行扫描。 - ...
linux-宝塔Linux面板简单好用的服务器运维面板
08-13
5. **安全防护**：内置防火墙规则配置，可以设置端口开放、禁止IP访问，以及进行木马查杀，增强服务器安全性。 6. **性能监控**：实时显示服务器资源使用情况，包括CPU、内存、磁盘I/O、网络流量等，帮助用户了解...
Linux下python版后门智能查杀脚本
11-13
这款查杀程序采用插件化实现，可以对新型的web后门添加自定义的查杀插件，现有的10余款插件已经能够查杀目前常见的大部分web后门，不过要注意的是现有的插件大多数都是查杀PHP后门的，asp及aspx不在覆盖范围，jsp的插件较少，因为当初写这个程序是为了解决linux下的webshell查杀问题。
linux下的webshell查杀工具
04-03
一款好用的linux下的webshell查杀软件。linux下的webshell查杀工具很少，所以这里分享出来。用于发现服务器上的web后门 官方网站地址：https://www.shellpub.com
clamav-linux杀毒工具及安装脚本.zip
07-27
clamav 为linux环境的杀毒工具，附件为 clamav 安装包及安装脚本，只要配置好 yum 源，直接运行脚本即可完成编译安装。具体可查看附件中 README.txt 文件。
linux下木马查杀工具,网站木马后门查杀工具Linux系统专用
weixin_39564605的博客
05-11 569
#!/usr/bin/python# -*- coding: utf-8 -*-#blog:www.sinesafe.comimportosimportsysimportrerulelist =['(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))','(_decode\([\'"][\w\+/=]{200,...
Linux 下使用杀毒软件clamav扫描木马病毒
热门推荐
飞空静渡
08-31 1万+
软件安装： sudo apt-get install clamav 然后在控制台下运行：clamscan /home 会报错： LibClamAV Error: cli_loaddb(): No supported database files found in /var/lib/clamav/ ERROR: Can't open file or directory
linux监控脚本的作用,五个常用的Linux监控脚本
weixin_32296621的博客
04-30 268
为大家提供五个常用linux监控脚本(查看主机网卡流量、系统状况监控、监控主机的磁盘空间,当使用空间超过90％就通过发mail来发警告、监控CPU和内存的使用情况、全方位监控主机)，有需要的朋友不妨看看哦。1、查看主机网卡流量复制代码 代码如下:#!/bin/bash#network#Mike.Xuwhile : ; dotime='date +%m"-"%d" "%k":"%M'day='dat...
linux 查杀sh脚本
xbcsu的博客
04-20 1115
Linux查找脚本的进程号
linux病毒脚本分析
dzlyxzy的博客
01-21 1790
树莓派/opt下多个几个莫名其妙的脚本，并且给添加到了rc.local中开机自动执行。请大神们帮忙分析一下吧。其中suck***是调试程序的时候用到的，大家可以无视。感觉关键部分是最后sshpass -praspberry开始的几段。#!/bin/bash echo "Suck dick .......................................................
Ubuntu 系统安装和使用杀毒软件ClamAV
科研学习笔记！
09-20 8699
Ubuntu 系统安装和使用杀毒软件ClamAV
Linux木马查杀与防护技术详解
"这篇资料主要介绍了在Linux系统中如何手动进行木马查杀的过程，包括木马程序的自我监测、防止删除以及隐藏等技术。内容来源于www.eimhe.com美河学习在线，对于理解Linux安全管理和木马查杀具有一定的参考价值。" ...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值