centos入侵溯源

#使用命令查看服务器安装的服务，需要重点查看可以对公网开放的常见业务

systemctl list-unit-files --type=service

#或者进行过滤

systemctl list-unit-files --type=service | egrep 'httpd|nginx|mysql|redis|tomcat|jboss|node|java|squid|apache'

#awk '{print $1}' 主要是为了获取日志中的访问来源IP这列
#head -20 是统计访问量较高的前20个IP
cat /var/log/httpd/access_log |awk '{print $1}'|sort | uniq -c | sort -
nr|head -20

cat /var/log/httpd/access_log | egrep 'eval|cmd|func|cgibin|
jndi|excute|%20|system|exec|passthru|shell_exec|popen|proc_open'

cat /var/log/httpd/access_log | egrep 'eval|cmd|func|cgibin|
jndi|excute|%20|system|exec|passthru|shell_exec|popen|proc_open'|awk
'{print$1" "$7" "$9}'

cat /var/log/httpd/access_log | egrep 'admin|login'|grep POST
cat /var/log/httpd/access_log | egrep 'admin|login'|grep GET

#awk '{print $1}' 主要是为了获取日志中的访问来源IP这列
#head -20 是统计访问量较高的前20个IP
cat /var/log/nginx/access.log |awk '{print $1}'|sort | uniq
-c | sort -nr|head -20

cat /var/log/nginx/access.log | egrep 'eval|cmd|func|cgibin|
jndi|excute|%20|system|exec|passthru|shell_exec|popen|proc_open'

grep "Failed password" /var/log/secure | grep -oE "\b([0-9]{1,3}\.){3}
[0-9]{1,3}\b" | sort | uniq -c | sort -nr|head -20

##1、定位有多少IP在爆破主机的root帐号：
grep "Failed password for root" /var/log/secure | awk '{print $11}' | sort |
uniq -c | sort -nr | more
#定位有哪些IP在爆破：
#grep "Failed password" /var/log/secure|grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-
9][0-9]?)\.
#(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.
(25[0-5]|2[0-4] [0-9]|[01]?[0-9][0-9]?)"|uniq -c
grep "Failed password" /var/log/secure | grep -oE "\b([0-9]{1,3}\.){3}[0-9]
{1,3}\b" | sort | uniq -c | sort -nr
#爆破用户名字典是什么？
grep "Failed password" /var/log/secure|perl -e 'while($_=<>){ /for(.*?) from/;
print "$1\n";}'|uniq -c|sort -nr
##2、登录成功的IP有哪些：
grep "Accepted " /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -nr
| more
##3、增加非法用户如somebody日志：
grep "useradd" /var/log/secure
'''
Jul 10 00:12:15 localhost useradd[2382]: new group: name=somebody, GID=1001
Jul 10 00:12:15 localhost useradd[2382]: new user: name=somebody, UID=1001,
GID=1001, home=/home/somebody , shell=/bin/bash
Jul 10 00:12:58 localhost passwd: pam_unix(passwd:chauthtok): password changed
for somebody
'''
##4、sudo授权执行日志：
sudo -l
'''
Jul 10 00:43:09 localhost sudo: good : TTY=pts/4 ; PWD=/home/good ; USER=root ;
COMMAND=/sbin/shutdown -r now
'''
##5、爆破用户名字典（按照登陆失败次数排序）
grep "Failed password" /var/log/secure | awk '{if ($9 == "invalid") print $11;
else print $9}' | sort | uniq -c | sort -nr

egrep 'eval|\$_POST|\$_REQUEST|\$_GET|assert' /usr/share/nginx/html/*/*
egrep 'eval|\$_POST|\$_REQUEST|\$_GET|assert' /usr/share/nginx/html/*
egrep 'eval|\$_POST|\$_REQUEST|\$_GET|assert' /var/www/html/*/*
egrep 'eval|\$_POST|\$_REQUEST|\$_GET|assert' /var/www/html/*

cat /etc/redis.conf |grep bind
cat /etc/redis.conf |grep requirepass
cat /etc/redis.conf |grep protected-mode