[新手上路]批处理新手入门导读[视频教程]批处理基础视频教程[视频教程]VBS基础视频教程[批处理精品]批处理版照片整理器
[批处理精品]纯批处理备份&还原驱动[批处理精品]CMD命令50条不能说的秘密[在线下载]第三方命令行工具[在线帮助]VBScript / JScript 在线参考
返回列表 发帖
Batcher

Rank: 12Rank: 12Rank: 12

帖子
14779 
积分
45953 
技术
847  
捐助
745  
注册时间
2008-6-9 
1楼 跳转到 » 倒序看帖
打印
tT
发表于 2023-11-24 12:19 | 只看该作者

[转载代码] Linux应急处置/信息搜集/漏洞检测Shell脚本

Linux应急处置/信息搜集/漏洞检测工具，支持基础配置/网络流量/任务计划/环境变量/用户信息/Services/bash/恶意文件/内核Rootkit/SSH/Webshell/挖矿文件/挖矿进程/供应链/服务器风险等13类70+项检查

【使用方法】

联网状态：

  • apt-get install silversearcher-ag
  • yum -y install the_silver_searcher


离线状态：

  • Debian：dpkg -i silversearcher-ag_2.2.0-1+b1_amd64.deb
  • Centos：rpm -ivh the_silver_searcher-2.1.0-1.el7.x86_64.rpm


  1. git clone https://github.com/al0ne/LinuxCheck.git

  2. chmod u+x LinuxCheck.sh

  3. ./LinuxCheck.sh
复制代码


如果已经安装了ag和rkhunter可以直接使用以下命令：
  1. bash -c "$(curl -sSL https://raw.githubusercontent.com/al0ne/LinuxCheck/master/LinuxCheck.sh)"
复制代码

文件会保存成ipaddr_hostname_username_timestamp.log 这种格式

LinuxCheck.sh
  1. #!/usr/bin/env bash

  2. 

  3. echo ""

  4. echo " ========================================================= "

  5. echo " \        Linux应急处置/信息搜集/漏洞检测脚本 V2.3      / "

  6. echo " ========================================================= "

  7. echo " # 支持Centos、Debian系统检测                    "

  8. echo " # author：al0ne                    "

  9. echo " # https://github.com/al0ne                    "

  10. echo " # 更新日期：2022年08月5日                    "

  11. echo " # 参考来源：                "

  12. echo " #   1.Gscan https://github.com/grayddq/GScan  "

  13. echo " #   2.Lynis https://github.com/CISOfy/lynis  "

  14. echo -e "\n"

  15. 

  16. # 更新日志：2022年08月05日

  17. #### 修复内核模块检查日志过多问题

  18. # 更新日志：2022年03月07日

  19. #### 添加SSH软连接后门检测

  20. # 更新日期：2021年10月17日

  21. #### 添加Ntpclient/WorkMiner/TeamTNT挖矿木马检测

  22. #### 添加Rootkit模块检测逻辑

  23. #### 添加Python pip投毒检测

  24. #### 添加$HOME/.profile查看

  25. #### 添加服务器风险检查(Redis)

  26. 

  27. # WEB Path 设置web目录 默认的话是从/目录去搜索 性能较慢

  28. webpath='/'

  29. 

  30. print_msg() {

  31.   echo -e "\e[00;31m[+]$1\e[00m"

  32. }

  33. 

  34. ### 1.环境检查 ###

  35. print_msg "环境检测"

  36. # 验证是否为root权限

  37. if [ $UID -ne 0 ]; then

  38.   print_msg "请使用root权限运行!"

  39.   exit 1

  40. else

  41.   print_msg "当前为root权限"

  42. fi

  43. 

  44. # 验证操作系统是debian系还是centos

  45. OS='None'

  46. 

  47. if [ -e "/etc/os-release" ]; then

  48.   source /etc/os-release

  49.   case ${ID} in

  50.   "debian" | "ubuntu" | "devuan")

  51.     OS='Debian'

  52.     ;;

  53.   "centos" | "rhel fedora" | "rhel")

  54.     OS='Centos'

  55.     ;;

  56.   *) ;;

  57.   esac

  58. fi

  59. 

  60. if [ $OS = 'None' ]; then

  61.   if command -v apt-get >/dev/null 2>&1; then

  62.     OS='Debian'

  63.   elif command -v yum >/dev/null 2>&1; then

  64.     OS='Centos'

  65.   else

  66.     echo -e "\n不支持这个系统\n"

  67.     echo -e "已退出"

  68.     exit 1

  69.   fi

  70. fi

  71. 

  72. # 安装应急必备工具

  73. cmdline=(

  74.   "net-tools"

  75.   "telnet"

  76.   "nc"

  77.   "lrzsz"

  78.   "wget"

  79.   "strace"

  80.   "traceroute"

  81.   "htop"

  82.   "tar"

  83.   "lsof"

  84.   "tcpdump"

  85. )

  86. for prog in "${cmdline[@]}"; do

  87. 

  88.   if [ $OS = 'Centos' ]; then

  89.     soft=$(rpm -q "$prog")

  90.     if echo "$soft" | grep -E '没有安装|未安装|not installed' >/dev/null 2>&1; then

  91.       echo -e "$prog 安装中......"

  92.       yum install -y "$prog" >/dev/null 2>&1

  93.       yum install -y the_silver_searcher >/dev/null 2>&1

  94.     fi

  95.   else

  96.     if dpkg -L $prog | grep 'does not contain any files' >/dev/null 2>&1; then

  97.       echo -e "$prog 安装中......"

  98.       apt install -y "$prog" >/dev/null 2>&1

  99.       apt install -y silversearcher-ag >/dev/null 2>&1

  100.     fi

  101. 

  102.   fi

  103. done

  104. 

  105. echo -e "\n"

  106. 

  107. # 设置保存文件

  108. ipaddress=$(ip address | ag -o '(?<=inet )\d+\.\d+\.\d+\.\d+(?=\/2)' | head -n 1)

  109. filename=$ipaddress'_'$(hostname)'_'$(whoami)'_'$(date +%s)_log'.log'

  110. vuln="$ipaddress_$(hostname)_$(whoami)_$(date +%s)_vuln.log"

  111. 

  112. base_check() {

  113.   echo -e "############ 基础配置检查 ############\n" | tee -a "$filename"

  114.   echo -e "\e[00;31m[+]系统信息\e[00m" | tee -a "$filename"

  115.   #当前用户

  116.   echo -e "USER:\t\t$(whoami)" 2>/dev/null | tee -a "$filename"

  117.   #版本信息

  118.   echo -e "OS Version:\t$(uname -r)" | tee -a "$filename"

  119.   #主机名

  120.   echo -e "Hostname: \t$(hostname -s)" | tee -a "$filename"

  121.   #服务器SN

  122.   echo -e "服务器SN: \t$(dmidecode -t1 | ag -o '(?<=Serial Number: ).*')" | tee -a "$filename"

  123.   #uptime

  124.   echo -e "Uptime: \t$(uptime | awk -F ',' '{print $1}')" | tee -a "$filename"

  125.   #系统负载

  126.   echo -e "系统负载: \t$(uptime | awk '{print $9" "$10" "$11" "$12" "$13}')" | tee -a "$filename"

  127.   #cpu信息

  128.   echo -e "CPU info:\t$(ag -o '(?<=model name\t: ).*' </proc/cpuinfo | head -n 1)" | tee -a "$filename"

  129.   #cpu核心

  130.   echo -e "CPU 核心:\t$(cat /proc/cpuinfo | grep 'processor' | sort | uniq | wc -l)" | tee -a "$filename"

  131.   #ipaddress

  132.   ipaddress=$(ifconfig | ag -o '(?<=inet |inet addr:)\d+\.\d+\.\d+\.\d+' | ag -v '127.0.0.1') >/dev/null 2>&1

  133.   echo -e "IPADDR:\t\t${ipaddress}" | sed ":a;N;s/\n/ /g;ta" | tee -a "$filename"

  134.   echo -e "\n" | tee -a "$filename"

  135.   echo -e "\e[00;31m[+]CPU使用率:  \e[00m" | tee -a "$filename"

  136.   awk '$0 ~/cpu[0-9]/' /proc/stat 2>/dev/null | while read line; do

  137.     echo "$line" | awk '{total=$2+$3+$4+$5+$6+$7+$8;free=$5;\

  138.         print$1" Free "free/total*100"%",\

  139.         "Used " (total-free)/total*100"%"}' | tee -a "$filename"

  140.   done

  141.   echo -e "\n" | tee -a "$filename"

  142.   #登陆用户

  143.   echo -e "\e[00;31m[+]登陆用户\e[00m" | tee -a "$filename"

  144.   who | tee -a "$filename"

  145.   echo -e "\n" | tee -a "$filename"

  146.   #CPU占用TOP 15

  147.   cpu=$(ps aux | grep -v ^'USER' | sort -rn -k3 | head -15) 2>/dev/null

  148.   echo -e "\e[00;31m[+]CPU TOP15:  \e[00m\n${cpu}\n" | tee -a "$filename"

  149.   #内存占用TOP 15

  150.   mem=$(ps aux | grep -v ^'USER' | sort -rn -k4 | head -15) 2>/dev/null

  151.   echo -e "\e[00;31m[+]内存占用 TOP15:  \e[00m\n${mem}\n" | tee -a "$filename"

  152.   #内存占用

  153.   echo -e "\e[00;31m[+]内存占用\e[00m" | tee -a "$filename"

  154.   free -mh | tee -a "$filename"

  155.   echo -e "\n" | tee -a "$filename"

  156.   #剩余空间

  157.   echo -e "\e[00;31m[+]剩余空间\e[00m" | tee -a "$filename"

  158.   df -mh | tee -a "$filename"

  159.   echo -e "\n" | tee -a "$filename"

  160.   echo -e "\e[00;31m[+]硬盘挂载\e[00m" | tee -a "$filename"

  161.   ag -v "#" </etc/fstab | awk '{print $1,$2,$3}' | tee -a "$filename"

  162.   echo -e "\n" | tee -a "$filename"

  163.   #安装软件

  164.   echo -e "\e[00;31m[+]常用软件\e[00m" | tee -a "$filename"

  165.   cmdline=(

  166.     "which perl"

  167.     "which gcc"

  168.     "which g++"

  169.     "which python"

  170.     "which php"

  171.     "which cc"

  172.     "which go"

  173.     "which node"

  174.     "which nodejs"

  175.     "which bind"

  176.     "which tomcat"

  177.     "which clang"

  178.     "which ruby"

  179.     "which curl"

  180.     "which wget"

  181.     "which mysql"

  182.     "which redis"

  183.     "which ssserver"

  184.     "which vsftpd"

  185.     "which java"

  186.     "which apache"

  187.     "which apache2"

  188.     "which nginx"

  189.     "which git"

  190.     "which mongodb"

  191.     "which docker"

  192.     "which tftp"

  193.     "which psql"

  194.     "which kafka"

  195. 

  196.   )

  197. 

  198.   for prog in "${cmdline[@]}"; do

  199.     soft=$($prog)

  200.     if [ "$soft" ] 2>/dev/null; then

  201.       echo -e "$soft" | ag -o '\w+$' --nocolor | tee -a "$filename"

  202.     fi

  203.   done

  204.   echo -e "\n" | tee -a "$filename"

  205.   #HOSTS

  206.   echo -e "\e[00;31m[+]/etc/hosts \e[00m" | tee -a "$filename"

  207.   cat /etc/hosts | ag -v "#" | tee -a "$filename"

  208.   echo -e "\n" | tee -a "$filename"

  209. }

  210. 

  211. network_check() {

  212.   echo -e "############ 网络/流量检查 ############\n" | tee -a "$filename"

  213.   #ifconfig

  214.   echo -e "\e[00;31m[+]ifconfig\e[00m" | tee -a "$filename"

  215.   /sbin/ifconfig -a | tee -a "$filename"

  216.   echo -e "\n" | tee -a "$filename"

  217.   #网络流量

  218.   echo -e "\e[00;31m[+]网络流量 \e[00m" | tee -a "$filename"

  219.   echo "Interface    ByteRec   PackRec   ByteTran   PackTran" | tee -a "$filename"

  220.   awk ' NR>2' /proc/net/dev | while read line; do

  221.     echo "$line" | awk -F ':' '{print "  "$1"  " $2}' |

  222.       awk '{print $1"   "$2 "    "$3"   "$10"  "$11}' | tee -a "$filename"

  223.   done

  224.   echo -e "\n" | tee -a "$filename"

  225.   #端口监听

  226.   echo -e "\e[00;31m[+]端口监听\e[00m" | tee -a "$filename"

  227.   netstat -tulpen | ag 'tcp|udp.*' --nocolor | tee -a "$filename"

  228.   echo -e "\n" | tee -a "$filename"

  229.   #对外开放端口

  230.   echo -e "\e[00;31m[+]对外开放端口\e[00m" | tee -a "$filename"

  231.   netstat -tulpen | awk '{print $1,$4}' | ag -o '.*0.0.0.0:(\d+)|:::\d+' --nocolor | tee -a "$filename"

  232.   echo -e "\n" | tee -a "$filename"

  233.   #网络连接

  234.   echo -e "\e[00;31m[+]网络连接\e[00m" | tee -a "$filename"

  235.   netstat -antop | ag ESTAB --nocolor | tee -a "$filename"

  236.   echo -e "\n" | tee -a "$filename"

  237.   #连接状态

  238.   echo -e "\e[00;31m[+]TCP连接状态\e[00m" | tee -a "$filename"

  239.   netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}' | tee -a "$filename"

  240.   echo -e "\n" | tee -a "$filename"

  241.   #路由表

  242.   echo -e "\e[00;31m[+]路由表\e[00m" | tee -a "$filename"

  243.   /sbin/route -nee | tee -a "$filename"

  244.   echo -e "\n" | tee -a "$filename"

  245.   #路由转发

  246.   echo -e "\e[00;31m[+]路由转发\e[00m" | tee -a "$filename"

  247.   ip_forward=$(more /proc/sys/net/ipv4/ip_forward | awk -F: '{if ($1==1) print "1"}')

  248.   if [ -n "$ip_forward" ]; then

  249.     echo "/proc/sys/net/ipv4/ip_forward 已开启路由转发" | tee -a "$filename"

  250.   else

  251.     echo "该服务器未开启路由转发" | tee -a "$filename"

  252.   fi

  253.   echo -e "\n" | tee -a "$filename"

  254.   #DNS

  255.   echo -e "\e[00;31m[+]DNS Server\e[00m" | tee -a "$filename"

  256.   ag -o '\d+\.\d+\.\d+\.\d+' --nocolor </etc/resolv.conf | tee -a "$filename"

  257.   echo -e "\n" | tee -a "$filename"

  258.   #ARP

  259.   echo -e "\e[00;31m[+]ARP\e[00m" | tee -a "$filename"

  260.   arp -n -a | tee -a "$filename"

  261.   echo -e "\n" | tee -a "$filename"

  262.   #混杂模式

  263.   echo -e "\e[00;31m[+]网卡混杂模式\e[00m" | tee -a "$filename"

  264.   if ip link | ag PROMISC >/dev/null 2>&1; then

  265.     echo "网卡存在混杂模式！" | tee -a "$filename"

  266.   else

  267.     echo "网卡不存在混杂模式" | tee -a "$filename"

  268. 

  269.   fi

  270.   echo -e "\n" | tee -a "$filename"

  271.   #防火墙

  272.   echo -e "\e[00;31m[+]IPTABLES防火墙\e[00m" | tee -a "$filename"

  273.   iptables -L | tee -a "$filename"

  274.   echo -e "\n" | tee -a "$filename"

  275. }

  276. 

  277. crontab_check() {

  278.   echo -e "############ 任务计划检查 ############\n" | tee -a "$filename" | tee -a "$vuln"

  279.   #crontab

  280.   echo -e "\e[00;31m[+]Crontab\e[00m" | tee -a "$filename"

  281.   crontab -u root -l | ag -v '#' --nocolor | tee -a "$filename"

  282.   ls -alht /etc/cron.*/* | tee -a "$filename"

  283.   echo -e "\n" | tee -a "$filename"

  284. 

  285.   #crontab可疑命令

  286.   echo -e "\e[00;31m[+]Crontab Backdoor \e[00m" | tee -a "$vuln"

  287.   ag '((?:useradd|groupadd|chattr)|(?:wget\s|curl\s|tftp\s\-i|scp\s|sftp\s)|(?:bash\s\-i|fsockopen|nc\s\-e|sh\s\-i|\"/bin/sh\"|\"/bin/bash\"))' /etc/cron* /var/spool/cron/* --nocolor | tee -a "$vuln"

  288.   echo -e "\n" | tee -a "$vuln"

  289. }

  290. 

  291. env_check() {

  292.   echo -e "############ 环境变量检查 ############\n" | tee -a "$filename"

  293.   #env

  294.   echo -e "\e[00;31m[+]env\e[00m" | tee -a "$filename"

  295.   env | tee -a "$filename"

  296.   echo -e "\n" | tee -a "$filename"

  297.   #PATH

  298.   echo -e "\e[00;31m[+]PATH\e[00m" | tee -a "$filename"

  299.   echo "$PATH" | tee -a "$filename"

  300.   echo -e "\n" | tee -a "$filename"

  301.   #LD_PRELOAD

  302.   echo -e "\e[00;31m[+]LD_PRELOAD\e[00m" | tee -a "$vuln"

  303.   echo ${LD_PRELOAD} | tee -a "$vuln"

  304.   echo -e "\n" | tee -a "$vuln"

  305.   #LD_ELF_PRELOAD

  306.   echo -e "\e[00;31m[+]LD_ELF_PRELOAD\e[00m" | tee -a "$vuln"

  307.   echo ${LD_ELF_PRELOAD} | tee -a "$vuln"

  308.   echo -e "\n" | tee -a "$vuln"

  309.   #LD_AOUT_PRELOAD

  310.   echo -e "\e[00;31m[+]LD_AOUT_PRELOAD\e[00m" | tee -a "$vuln"

  311.   echo ${LD_AOUT_PRELOAD} | tee -a "$vuln"

  312.   echo -e "\n" | tee -a "$vuln"

  313.   #PROMPT_COMMAND

  314.   echo -e "\e[00;31m[+]PROMPT_COMMAND\e[00m" | tee -a "$vuln"

  315.   echo "${PROMPT_COMMAND}" | tee -a "$vuln"

  316.   echo -e "\n" | tee -a "$vuln"

  317.   #LD_LIBRARY_PATH

  318.   echo -e "\e[00;31m[+]LD_LIBRARY_PATH\e[00m" | tee -a "$vuln"

  319.   echo "${LD_LIBRARY_PATH}" | tee -a "$vuln"

  320.   echo -e "\n" | tee -a "$vuln"

  321.   #ld.so.preload

  322.   echo -e "\e[00;31m[+]ld.so.preload\e[00m" | tee -a "$vuln"

  323.   preload='/etc/ld.so.preload'

  324.   if [ -e "${preload}" ]; then

  325.     cat ${preload} | tee -a "$vuln"

  326.   fi

  327.   echo -e "\n" | tee -a "$vuln"

  328. }

  329. 

  330. user_check() {

  331.   echo -e "############ 用户信息检查 ############\n" | tee -a "$filename"

  332.   echo -e "\e[00;31m[+]可登陆用户\e[00m" | tee -a "$filename"

  333.   cat /etc/passwd | ag -v 'nologin$|false$' | tee -a "$filename"

  334.   echo -e "\n" | tee -a "$filename"

  335.   echo -e "\e[00;31m[+]passwd文件修改日期: \e[00m" $(stat /etc/passwd | ag -o '(?<=Modify: ).*' --nocolor) | tee -a "$filename"

  336.   echo -e "\n" | tee -a "$filename"

  337.   echo -e "\e[00;31m[+]sudoers(请注意NOPASSWD)\e[00m" | tee -a "$filename"

  338.   cat /etc/sudoers | ag -v '#' | sed -e '/^$/d' | ag ALL --nocolor | tee -a "$filename"

  339.   echo -e "\n" | tee -a "$filename"

  340.   echo -e "\e[00;31m[+]登录信息\e[00m" | tee -a "$filename"

  341.   w | tee -a "$filename"

  342.   echo -e "\n" | tee -a "$filename"

  343.   last | tee -a "$filename"

  344.   echo -e "\n" | tee -a "$filename"

  345.   lastlog | tee -a "$filename"

  346.   echo -e "\n" | tee -a "$filename"

  347.   echo "登陆ip: $(ag -a accepted /var/log/secure /var/log/auth.* 2>/dev/null | ag -o '\d+\.\d+\.\d+\.\d+' | sort | uniq)" | tee -a "$filename"

  348.   echo -e "\n" | tee -a "$filename"

  349. }

  350. 

  351. service_check() {

  352.   echo -e "############ 服务状态检查 ############\n" | tee -a "$filename"

  353.   echo -e "\e[00;31m[+]正在运行的Service \e[00m" | tee -a "$filename"

  354.   systemctl -l | grep running | awk '{print $1}' | tee -a "$filename"

  355.   echo -e "\n" | tee -a "$filename"

  356.   echo -e "\e[00;31m[+]最近添加的Service \e[00m" | tee -a "$filename"

  357.   ls -alhtR /etc/systemd/system/multi-user.target.wants | tee -a "$filename"

  358.   ls -alht /etc/systemd/system/*.service | ag -v 'dbus-org' | tee -a "$filename"

  359.   echo -e "\n" | tee -a "$filename"

  360. }

  361. 

  362. bash_check() {

  363.   echo -e "######Bash配置检查######\n" | tee -a "$filename"

  364.   #查看history文件

  365.   echo -e "\e[00;31m[+]History\e[00m" | tee -a "$filename"

  366.   ls -alht /root/.*_history | tee -a "$filename"

  367.   echo -e "\n" | tee -a "$filename"

  368.   cat ~/.*history | ag '(?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])|http://|https://|\bssh\b|\bscp\b|\.tar|\bwget\b|\bcurl\b|\bnc\b|\btelnet\b|\bbash\b|\bsh\b|\bchmod\b|\bchown\b|/etc/passwd|/etc/shadow|/etc/hosts|\bnmap\b|\bfrp\b|\bnfs\b|\bsshd\b|\bmodprobe\b|\blsmod\b|\bsudo\b' --nocolor | ag -v 'man\b|ag\b|cat\b|sed\b|git\b|docker\b|rm\b|touch\b|mv\b|\bapt\b|\bapt-get\b' | tee -a "$filename"

  369.   echo -e "\n" | tee -a "$filename"

  370.   #/etc/profile

  371.   echo -e "\e[00;31m[+]/etc/profile \e[00m" | tee -a "$filename"

  372.   cat /etc/profile | ag -v '#' | tee -a "$filename"

  373.   echo -e "\n" | tee -a "$filename"

  374.   # $HOME/.profile

  375.   echo -e "\e[00;31m[+]\$HOME/.profile \e[00m" | tee -a "$filename"

  376.   cat $HOME/.profile | ag -v '#' | tee -a "$filename"

  377.   echo -e "\n" | tee -a "$filename"

  378.   #/etc/rc.local

  379.   echo -e "\e[00;31m[+]/etc/rc.local \e[00m" | tee -a "$filename"

  380.   cat /etc/rc.local | ag -v '#' | tee -a "$filename"

  381.   echo -e "\n" | tee -a "$filename"

  382.   #~/.bash_profile

  383.   echo -e "\e[00;31m[+]~/.bash_profile \e[00m" | tee -a "$filename"

  384.   if [ -e "$HOME/.bash_profile" ]; then

  385.     cat ~/.bash_profile | ag -v '#' | tee -a "$filename"

  386.   fi

  387.   echo -e "\n" | tee -a "$filename"

  388.   #~/.bashrc

  389.   echo -e "\e[00;31m[+]~/.bashrc \e[00m" | tee -a "$filename"

  390.   cat ~/.bashrc | ag -v '#' | tee -a "$filename"

  391.   echo -e "\n" | tee -a "$filename"

  392.   #bash反弹shell

  393.   echo -e "\e[00;31m[+]bash反弹shell \e[00m" | tee -a "$vuln"

  394.   ps -ef | ag 'bash -i' | ag -v 'ag' | awk '{print $2}' | xargs -i{} lsof -p {} | ag 'ESTAB' --nocolor | tee -a "$vuln"

  395.   echo -e "\n" | tee -a "$vuln"

  396. }

  397. 

  398. file_check() {

  399.   echo -e "############ 文件检查 ############\n" | tee -a "$filename"

  400.   echo -e "\e[00;31m[+]系统文件修改时间 \e[00m" | tee -a "$vuln"

  401.   cmdline=(

  402.     "/sbin/ifconfig"

  403.     "/bin/ls"

  404.     "/bin/login"

  405.     "/bin/netstat"

  406.     "/bin/top"

  407.     "/bin/ps"

  408.     "/bin/find"

  409.     "/bin/grep"

  410.     "/etc/passwd"

  411.     "/etc/shadow"

  412.     "/usr/bin/curl"

  413.     "/usr/bin/wget"

  414.     "/root/.ssh/authorized_keys"

  415.   )

  416.   for soft in "${cmdline[@]}"; do

  417.     echo -e "文件：$soft\t\t\t修改日期：$(stat $soft | ag -o '(?<=Modify: )[\d-\s:]+')" | tee -a "$vuln"

  418.   done

  419. 

  420.   echo -e "\n" | tee -a "$vuln"

  421.   echo -e "\e[00;31m[+]...隐藏文件 \e[00m" | tee -a "$vuln"

  422.   find / ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/boot/*" -name ".*." | tee -a "$vuln"

  423.   echo -e "\n" | tee -a "$vuln"

  424.   #tmp目录

  425.   echo -e "\e[00;31m[+]/tmp \e[00m" | tee -a "$filename"

  426.   # shellcheck disable=SC2012

  427.   ls /tmp /var/tmp /dev/shm -alht | tee -a "$filename"

  428.   echo -e "\n" | tee -a "$filename"

  429.   #alias 别名

  430.   echo -e "\e[00;31m[+]alias \e[00m" | tee -a "$filename"

  431.   alias | ag -v 'git' | tee -a "$filename"

  432.   echo -e "\n" | tee -a "$filename"

  433.   #SUID

  434.   echo -e "\e[00;31m[+]SUID \e[00m" | tee -a "$vuln"

  435.   find / ! -path "/proc/*" -perm -004000 -type f | ag -v 'snap|docker|pam_timestamp_check|unix_chkpwd|ping|mount|su|pt_chown|ssh-keysign|at|passwd|chsh|crontab|chfn|usernetctl|staprun|newgrp|chage|dhcp|helper|pkexec|top|Xorg|nvidia-modprobe|quota|login|security_authtrampoline|authopen|traceroute6|traceroute|ps' | tee -a "$vuln"

  436.   echo -e "\n" | tee -a "$vuln"

  437.   #lsof -L1

  438.   #进程存在但文件已经没有了

  439.   echo -e "\e[00;31m[+]lsof +L1 \e[00m" | tee -a "$filename"

  440.   lsof +L1 | tee -a "$filename"

  441.   echo -e "\n" | tee -a "$filename"

  442.   #近7天改动

  443.   echo -e "\e[00;31m[+]近七天文件改动 mtime \e[00m" | tee -a "$filename"

  444.   find /etc /bin /lib /sbin /dev /root/ /home /tmp /var /usr ! -path "/var/log*" ! -path "/var/spool/exim4*" ! -path "/var/backups*" -mtime -7 -type f | ag -v '\.log|cache|vim|/share/|/lib/|.zsh|.gem|\.git|LICENSE|README|/_\w+\.\w+|\blogs\b|elasticsearch|nohup|i18n' | xargs -i{} ls -alh {} | tee -a "$filename"

  445.   echo -e "\n" | tee -a "$filename"

  446.   #近7天改动

  447.   echo -e "\e[00;31m[+]近七天文件改动 ctime \e[00m" | tee -a "$filename"

  448.   find /etc /bin /lib /sbin /dev /root/ /home /tmp /var /usr ! -path "/var/log*" ! -path "/var/spool/exim4*" ! -path "/var/backups*" -ctime -7 -type f | ag -v '\.log|cache|vim|/share/|/lib/|.zsh|.gem|\.git|LICENSE|README|/_\w+\.\w+|\blogs\b|elasticsearch|nohup|i18n' | xargs -i{} ls -alh {} | tee -a "$filename"

  449.   echo -e "\n" | tee -a "$filename"

  450.   #大文件100mb

  451.   #有些黑客会将数据库、网站打包成一个文件然后下载

  452.   echo -e "\e[00;31m[+]大文件>200mb \e[00m" | tee -a "$filename"

  453.   find / ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/boot/*" -size +200M -exec ls -alht {} + 2>/dev/null | ag '\.gif|\.jpeg|\.jpg|\.png|\.zip|\.tar.gz|\.tgz|\.7z|\.log|\.xz|\.rar|\.bak|\.old|\.sql|\.1|\.txt|\.tar|\.db|/\w+$' --nocolor | ag -v 'ib_logfile|ibd|mysql-bin|mysql-slow|ibdata1' | tee -a "$filename"

  454.   echo -e "\n" | tee -a "$filename"

  455.   #敏感文件

  456.   echo -e "\e[00;31m[+]敏感文件 \e[00m" | tee -a "$vuln"

  457.   find / ! -path "/lib/modules*" ! -path "/usr/src*" ! -path "/snap*" ! -path "/usr/include/*" -regextype posix-extended -regex '.*sqlmap|.*msfconsole|.*\bncat|.*\bnmap|.*nikto|.*ettercap|.*tunnel\.(php|jsp|asp|py)|.*/nc\b|.*socks.(php|jsp|asp|py)|.*proxy.(php|jsp|asp|py)|.*brook.*|.*frps|.*frpc|.*aircrack|.*hydra|.*miner|.*/ew$' -type f | ag -v '/lib/python' | xargs -i{} ls -alh {} | tee -a "$vuln"

  458.   echo -e "\n" | tee -a "$vuln"

  459. 

  460.   echo -e "\e[00;31m[+]可疑黑客文件 \e[00m" | tee -a "$vuln"

  461.   find /root /home /opt /tmp /var/ /dev -regextype posix-extended -regex '.*wget|.*curl|.*openssl|.*mysql' -type f 2>/dev/null | xargs -i{} ls -alh {} | ag -v '/pkgs/|/envs/' | tee -a "$vuln"

  462.   echo -e "\n" | tee -a "$vuln"

  463. }

  464. 

  465. rootkit_check() {

  466.   echo -e "############ Rootkit检查 ############\n" | tee -a "$vuln"

  467.   #lsmod 可疑模块

  468.   echo -e "\e[00;31m[+]lsmod 可疑模块\e[00m" | tee -a "$vuln"

  469.   lsmod | ag -v "ablk_helper|ac97_bus|acpi_power_meter|aesni_intel|ahci|ata_generic|ata_piix|auth_rpcgss|binfmt_misc|bluetooth|bnep|bnx2|bridge|cdrom|cirrus|coretemp|crc_t10dif|crc32_pclmul|crc32c_intel|crct10dif_common|crct10dif_generic|crct10dif_pclmul|cryptd|dca|dcdbas|dm_log|dm_mirror|dm_mod|dm_region_hash|drm|drm_kms_helper|drm_panel_orientation_quirks|e1000|ebtable_broute|ebtable_filter|ebtable_nat|ebtables|edac_core|ext4|fb_sys_fops|floppy|fuse|gf128mul|ghash_clmulni_intel|glue_helper|grace|i2c_algo_bit|i2c_core|i2c_piix4|i7core_edac|intel_powerclamp|ioatdma|ip_set|ip_tables|ip6_tables|ip6t_REJECT|ip6t_rpfilter|ip6table_filter|ip6table_mangle|ip6table_nat|ip6ta ble_raw|ip6table_security|ipmi_devintf|ipmi_msghandler|ipmi_si|ipmi_ssif|ipt_MASQUERADE|ipt_REJECT|iptable_filter|iptable_mangle|iptable_nat|iptable_raw|iptable_security|iTCO_vendor_support|iTCO_wdt|jbd2|joydev|kvm|kvm_intel|libahci|libata|libcrc32c|llc|lockd|lpc_ich|lrw|mbcache|megaraid_sas|mfd_core|mgag200|Module|mptbase|mptscsih|mptspi|nf_conntrack|nf_conntrack_ipv4|nf_conntrack_ipv6|nf_defrag_ipv4|nf_defrag_ipv6|nf_nat|nf_nat_ipv4|nf_nat_ipv6|nf_nat_masquerade_ipv4|nfnetlink|nfnetlink_log|nfnetlink_queue|nfs_acl|nfsd|parport|parport_pc|pata_acpi|pcspkr|ppdev|rfkill|sch_fq_codel|scsi_transport_spi|sd_mod|serio_raw|sg|shpchp|snd|snd_ac97_codec|snd_ens1371|snd_page_alloc|snd_pcm|snd_rawmidi|snd_seq|snd_seq_device|snd_seq_midi|snd_seq_midi_event|snd_timer|soundcore|sr_mod|stp|sunrpc|syscopyarea|sysfillrect|sysimgblt|tcp_lp|ttm|tun|uvcvideo|videobuf2_core|videobuf2_memops|videobuf2_vmalloc|videodev|virtio|virtio_balloon|virtio_console|virtio_net|virtio_pci|virtio_ring|virtio_scsi|vmhgfs|vmw_balloon|vmw_vmci|vmw_vsock_vmci_transport|vmware_balloon|vmwgfx|vsock|xfs|xt_CHECKSUM|xt_conntrack|xt_state|raid*|tcpbbr|btrfs|.*diag|psmouse|ufs|linear|msdos|cpuid|veth|xt_tcpudp|xfrm_user|xfrm_algo|xt_addrtype|br_netfilter|input_leds|sch_fq|ib_iser|rdma_cm|iw_cm|ib_cm|ib_core|.*scsi.*|tcp_bbr|pcbc|autofs4|multipath|hfs.*|minix|ntfs|vfat|jfs|usbcore|usb_common|ehci_hcd|uhci_hcd|ecb|crc32c_generic|button|hid|usbhid|evdev|hid_generic|overlay|xt_nat|qnx4|sb_edac|acpi_cpufreq|ixgbe|pf_ring|tcp_htcp|cfg80211|x86_pkg_temp_thermal|mei_me|mei|processor|thermal_sys|lp|enclosure|ses|ehci_pci|igb|i2c_i801|pps_core|isofs|nls_utf8|xt_REDIRECT|xt_multiport|iosf_mbi|qxl|cdc_ether|usbnet|ip6table_raw|skx_edac|intel_rapl|wmi|acpi_pad|ast|i40e|ptp|nfit|libnvdimm|bpfilter|failover" | tee -a "$vuln"

  470.   echo -e "\n" | tee -a "$vuln"

  471. 

  472.   echo -e "\e[00;31m[+]Rootkit 内核模块\e[00m" | tee -a "$vuln"

  473.   kernel=$(grep -E 'hide_tcp4_port|hidden_files|hide_tcp6_port|diamorphine|module_hide|module_hidden|is_invisible|hacked_getdents|hacked_kill|heroin|kernel_unlink|hide_module|find_sys_call_tbl|h4x_delete_module|h4x_getdents64|h4x_kill|h4x_tcp4_seq_show|new_getdents|old_getdents|should_hide_file_name|should_hide_task_name' </proc/kallsyms)

  474.   if [ -n "$kernel" ]; then

  475.     echo "存在内核敏感函数！疑似Rootkit内核模块" | tee -a "$vuln"

  476.     echo "$kernel" | tee -a "$vuln"

  477.   else

  478.     echo "未找到内核敏感函数" | tee -a "$vuln"

  479.   fi

  480.   echo -e "\n" | tee -a "$vuln"

  481. 

  482.   echo -e "\e[00;31m[+]可疑的.ko模块\e[00m" | tee -a "$vuln"

  483.   find / ! -path "/proc/*" ! -path "/usr/lib/modules/*" ! -path "/lib/modules/*" ! -path "/boot/*" -regextype posix-extended -regex '.*\.ko' | tee -a "$vuln"

  484.   echo -e "\n" | tee -a "$vuln"

  485. }

  486. 

  487. ssh_check() {

  488.   echo -e "############ SSH检查 ############\n" | tee -a "$filename"

  489.   #SSH爆破IP

  490.   echo -e "\e[00;31m[+]SSH爆破\e[00m" | tee -a "$filename"

  491.   if [ $OS = 'Centos' ]; then

  492.     ag -a 'authentication failure' /var/log/secure* | awk '{print $14}' | awk -F '=' '{print $2}' | ag '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -nr | head -n 25 | tee -a "$filename"

  493.   else

  494.     ag -a 'authentication failure' /var/log/auth.* | awk '{print $14}' | awk -F '=' '{print $2}' | ag '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -nr | head -n 25 | tee -a "$filename"

  495.   fi

  496.   echo -e "\n" | tee -a "$filename"

  497.   #SSHD

  498.   echo -e "\e[00;31m[+]SSHD \e[00m" | tee -a "$filename"

  499.   echo -e "/usr/sbin/sshd"

  500.   stat /usr/sbin/sshd | ag 'Access|Modify|Change' --nocolor | tee -a "$filename"

  501.   echo -e "\n" | tee -a "$filename"

  502. 

  503.   #ssh后门配置检查

  504.   echo -e "\e[00;31m[+]SSH 后门配置 \e[00m" | tee -a "$vuln"

  505.   if [ -e "$HOME/.ssh/config" ]; then

  506.     grep LocalCommand <~/.ssh/config | tee -a "$vuln"

  507.     grep ProxyCommand <~/.ssh/config | tee -a "$vuln"

  508.   else

  509.     echo -e "未发现ssh配置文件" | tee -a "$vuln"

  510.   fi

  511.   echo -e "\n" | tee -a "$vuln"

  512. 

  513.   #ssh后门配置检查

  514.   echo -e "\e[00;31m[+]SSH 软连接后门 \e[00m" | tee -a "$vuln"

  515.   if ps -ef | ag '\s+\-oport=\d+' >/dev/null 2>&1; then

  516.     ps -ef | ag '\s+\-oport=\d+' | tee -a "$vuln"

  517.   else

  518.     echo "未检测到SSH软连接后门" | tee -a "$vuln"

  519. 

  520.   fi

  521.   echo -e "\n" | tee -a "$vuln"

  522. 

  523.   echo -e "\e[00;31m[+]SSH inetd后门检查 \e[00m" | tee -a "$vuln"

  524.   if [ -e "/etc/inetd.conf" ]; then

  525.     grep -E '(bash -i)' </etc/inetd.conf | tee -a "$vuln"

  526.   fi

  527.   echo -e "\n" | tee -a "$vuln"

  528. 

  529.   echo -e "\e[00;31m[+]SSH key\e[00m" | tee -a "$vuln"

  530.   sshkey=${HOME}/.ssh/authorized_keys

  531.   if [ -e "${sshkey}" ]; then

  532.     # shellcheck disable=SC2002

  533.     cat ${sshkey} | tee -a "$vuln"

  534.   else

  535.     echo -e "SSH key文件不存在\n" | tee -a "$vuln"

  536.   fi

  537.   echo -e "\n" | tee -a "$vuln"

  538. }

  539. 

  540. webshell_check() {

  541.   echo -e "############ Webshell检查 ############\n" | tee -a "$vuln"

  542.   echo -e "\e[00;31m[+]PHP webshell查杀\e[00m" | tee -a "$vuln"

  543.   ag --php -l -s -i 'array_map\(|pcntl_exec\(|proc_open\(|popen\(|assert\(|phpspy|c99sh|milw0rm|eval?\(|\(gunerpress|\(base64_decoolcode|spider_bc|shell_exec\(|passthru\(|base64_decode\s?\(|gzuncompress\s?\(|gzinflate|\(\$\$\w+|call_user_func\(|call_user_func_array\(|preg_replace_callback\(|preg_replace\(|register_shutdown_function\(|register_tick_function\(|mb_ereg_replace_callback\(|filter_var\(|ob_start\(|usort\(|uksort\(|uasort\(|GzinFlate\s?\(|\$\w+\(\d+\)\.\$\w+\(\d+\)\.|\$\w+=str_replace\(|eval\/\*.*\*\/\(' $webpath | tee -a "$vuln"

  544.   ag --php -l -s -i '^(\xff\xd8|\x89\x50|GIF89a|GIF87a|BM|\x00\x00\x01\x00\x01)[\s\S]*<\?\s*php' $webpath | tee -a "$vuln"

  545.   ag --php -l -s -i '\b(assert|eval|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec)\b[\/*\s]*\(+[\/*\s]*((\$_(GET|POST|REQUEST|COOKIE)\[.{0,25})|(base64_decode|gzinflate|gzuncompress|gzdecode|str_rot13)[\s\(]*(\$_(GET|POST|REQUEST|COOKIE)\[.{0,25}))' $webpath | tee -a "$vuln"

  546.   ag --php -l -s -i '\$\s*(\w+)\s*=[\s\(\{]*(\$_(GET|POST|REQUEST|COOKIE)\[.{0,25});[\s\S]{0,200}\b(assert|eval|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec)\b[\/*\s]*\(+[\s"\/*]*(\$\s*\1|((base64_decode|gzinflate|gzuncompress|gzdecode|str_rot13)[\s\("]*\$\s*\1))' $webpath | tee -a "$vuln"

  547.   ag --php -l -s -i '\b(filter_var|filter_var_array)\b\s*\(.*FILTER_CALLBACK[^;]*((\$_(GET|POST|REQUEST|COOKIE|SERVER)\[.{0,25})|(eval|assert|ass\\x65rt|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec))' $webpath | tee -a "$vuln"

  548.   ag --php -l -s -i "\b(assert|eval|system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec|include)\b\s*\(\s*(file_get_contents\s*\(\s*)?[\'\"]php:\/\/input" $webpath | tee -a "$vuln"

  549.   echo -e "\n" | tee -a "$vuln"

  550.   #JSP webshell查杀

  551.   echo -e "\e[00;31m[+]JSP webshell查杀\e[00m" | tee -a "$vuln"

  552.   ag --jsp -l -s -i '<%@\spage\simport=[\s\S]*\\u00\d+\\u00\d+|<%@\spage\simport=[\s\S]*Runtime.getRuntime\(\).exec\(request.getParameter\(|Runtime.getRuntime\(\)' $webpath | tee -a "$vuln"

  553.   echo -e "\n" | tee -a "$vuln"

  554. }

  555. 

  556. poison_check() {

  557.   echo -e "############ 供应链投毒检测 ############\n" | tee -a "$vuln"

  558.   echo -e "\e[00;31m[+]Python2 pip 检测\e[00m" | tee -a "$vuln"

  559.   pip freeze | ag "istrib|djanga|easyinstall|junkeldat|libpeshka|mumpy|mybiubiubiu|nmap-python|openvc|python-ftp|pythonkafka|python-mongo|python-mysql|python-mysqldb|python-openssl|python-sqlite|virtualnv|mateplotlib|request=" | tee -a "$vuln"

  560.   echo -e "\n" | tee -a "$vuln"

  561.   echo -e "\e[00;31m[+]Python3 pip 检测\e[00m" | tee -a "$vuln"

  562.   pip3 freeze | ag "istrib|djanga|easyinstall|junkeldat|libpeshka|mumpy|mybiubiubiu|nmap-python|openvc|python-ftp|pythonkafka|python-mongo|python-mysql|python-mysqldb|python-openssl|python-sqlite|virtualnv|mateplotlib|request=" | tee -a "$vuln"

  563.   echo -e "\n" | tee -a "$vuln"

  564. }

  565. 

  566. miner_check() {

  567.   echo -e "############ 挖矿木马检查 ############\n" | tee -a "$vuln"

  568.   echo -e "\e[00;31m[+]常规挖矿进程检测\e[00m" | tee -a "$vuln"

  569.   ps aux | ag "systemctI|kworkerds|init10.cfg|wl.conf|crond64|watchbog|sustse|donate|proxkekman|test.conf|/var/tmp/apple|/var/tmp/big|/var/tmp/small|/var/tmp/cat|/var/tmp/dog|/var/tmp/mysql|/var/tmp/sishen|ubyx|cpu.c|tes.conf|psping|/var/tmp/java-c|pscf|cryptonight|sustes|xmrig|xmr-stak|suppoie|ririg|/var/tmp/ntpd|/var/tmp/ntp|/var/tmp/qq|/tmp/qq|/var/tmp/aa|gg1.conf|hh1.conf|apaqi|dajiba|/var/tmp/look|/var/tmp/nginx|dd1.conf|kkk1.conf|ttt1.conf|ooo1.conf|ppp1.conf|lll1.conf|yyy1.conf|1111.conf|2221.conf|dk1.conf|kd1.conf|mao1.conf|YB1.conf|2Ri1.conf|3Gu1.conf|crant|nicehash|linuxs|linuxl|Linux|crawler.weibo|stratum|gpg-daemon|jobs.flu.cc|cranberry|start.sh|watch.sh|krun.sh|killTop.sh|cpuminer|/60009|ssh_deny.sh|clean.sh|\./over|mrx1|redisscan|ebscan|barad_agent|\.sr0|clay|udevs|\.sshd|/tmp/init|xmr|xig|ddgs|minerd|hashvault|geqn|\.kthreadd|httpdz|pastebin.com|sobot.com|kerbero|2t3ik|ddgs|qW3xt|ztctb" | ag -v 'ag' | tee -a "$vuln"

  570.   find / ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/boot/*" -regextype posix-extended -regex '.*systemctI|.*kworkerds|.*init10.cfg|.*wl.conf|.*crond64|.*watchbog|.*sustse|.*donate|.*proxkekman|.*cryptonight|.*sustes|.*xmrig|.*xmr-stak|.*suppoie|.*ririg|gg1.conf|.*cpuminer|.*xmr|.*xig|.*ddgs|.*minerd|.*hashvault|\.kthreadd|.*httpdz|.*kerbero|.*2t3ik|.*qW3xt|.*ztctb|.*miner.sh' -type f | tee -a "$vuln"

  571.   echo -e "\n" | tee -a "$vuln"

  572. 

  573.   echo -e "\e[00;31m[+]Ntpclient 挖矿木马检测\e[00m" | tee -a "$vuln"

  574.   find / ! -path "/proc/*" ! -path "/sys/*" ! -path "/boot/*" -regextype posix-extended -regex 'ntpclient|Mozz' | tee -a "$vuln"

  575.   ls -alh /tmp/.a /var/tmp/.a /run/shm/a /dev/.a /dev/shm/.a 2>/dev/null | tee -a "$vuln"

  576.   echo -e "\n" | tee -a "$vuln"

  577. 

  578.   echo -e "\e[00;31m[+]WorkMiner 挖矿木马检测\e[00m" | tee -a "$vuln"

  579.   ps aux | ag "work32|work64|/tmp/secure.sh|/tmp/auth.sh" | ag -v 'ag'

  580.   ls -alh /tmp/xmr /tmp/config.json /tmp/secure.sh /tmp/auth.sh /usr/.work/work64 2>/dev/null | tee -a "$vuln"

  581.   echo -e "\n" | tee -a "$vuln"

  582. }

  583. 

  584. risk_check() {

  585.   echo -e "############ 服务器风险/漏洞检查 ############\n" | tee -a "$vuln"

  586.   echo -e "\e[00;31m[+]Redis弱密码检测\e[00m" | tee -a "$vuln"

  587.   cat /etc/redis/redis.conf 2>/dev/null | ag '(?<=requirepass )(test|123456|admin|root|12345678|111111|p@ssw0rd|test|qwerty|zxcvbnm|123123|12344321|123qwe|password|1qaz|000000|666666|888888)' | tee -a "$vuln"

  588.   echo -e "\n" | tee -a "$vuln"

  589. }

  590. 

  591. base_check

  592. network_check

  593. crontab_check

  594. env_check

  595. user_check

  596. service_check

  597. bash_check

  598. file_check

  599. rootkit_check

  600. ssh_check

  601. webshell_check

  602. poison_check

  603. miner_check

  604. risk_check
复制代码

原文：https://github.com/al0ne/LinuxCheck
收藏 分享
我帮忙写的代码不需要付钱。如果一定要给，请在微信群或QQ群发给大家吧。
【微信公众号、微信群、QQ群】http://bbs.bathome.net/thread-3473-1-1.html
【支持批处理之家，加入VIP会员！】http://bbs.bathome.net/thread-67716-1-1.html

返回列表