Differences

This shows you the differences between two versions of the page.

--- proxmox [2024/05/13 07:58] – created protocol
+++ proxmox [2026/08/31 23:49] (current) – protocol
@@ Line 1: / Line 1: @@
-=== mount proxmox virtual disk ===
+===== Limpar backdoor =====
+<code>
+# remover backdoor e minerador de cripto (XMrig/monero)
+# encontrei eles nas librarias para mexer nos comandos comuns, classico..
+unset LD_PRELOAD
+export LD_PRELOAD=""
+chattr -ia /etc/ld.so.preload
+echo "" > /etc/ld.so.preload
+rm -f /etc/ld.so.preload
+# matar os processos de mineraçao e persistencia
+pkill -9 -f PVE-1
+pkill -f PVE-1-maintain
+pkill -f PVE-1-update
+pkill -f ld-svc
+# boa tentativa deles, mais classico tambem..
+chattr -ia /etc/systemd/system/ld-svc.service
+chattr -ia /lib/systemd/system/ld-svc.service
+chattr -ia /etc/systemd/system/PVE-1-update.*
+chattr -ia /lib/systemd/system/PVE-1-update.*
+chattr -ia /usr/libexec/PVE-1-maintain
+chattr -ia /usr/libexec/PVE-1-update
+chattr -ia /var/lib/systemd/ld-svc
+chattr -ia /var/lib/systemd/PVE-1
+systemctl stop PVE-1-update.timer 2>/dev/null || true
+systemctl disable PVE-1-update.timer 2>/dev/null || true
+systemctl stop ld-svc.timer 2>/dev/null || true
+systemctl disable ld-svc.timer 2>/dev/null || true
+chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
+rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
+chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
+rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
+rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
+rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
+rm -f /usr/libexec/PVE-1-maintain /usr/libexec/PVE-1-update
+rm -f /var/lib/systemd/ld-svc
+rm -rf /var/lib/systemd/PVE-1
+rm -rf /var/lib/systemd/.cache
+rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
+rm  /etc/pve/priv/authorized_keys
+rm -f /lib/systemd/system-generators/PVE-1*
+rm -f /etc/systemd/system-generators/PVE-1*
+rm -f /lib/systemd/system-generators/ld-svc*
+rm -f /etc/systemd/system-generators/ld-svc*
+systemctl daemon-reload
+systemctl reset-failed
+# listar as VM e disk ID
+cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0"
+# extrair as VM (preferencia em disco externo ou remoto)
+dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress
+Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..
+uma chave ssh deles em /etc/pve/priv/authorized_keys:
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
+CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
+Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT
+IP deles:
+.117.145.130 C&C
+.185.15.129 C&C
+.148.10.152 C&C
+.60.130.193 (entry proxy, most probably some botnet zombie)
+.172.58.170 (monero)
+grep -a -b -o "BZh" server2-mkauth.raw
+dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
+dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress
+# Extrai as linhas financeiras brutas do arquivo de imagem do disco
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql
+grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql
+# Extrai as linhas financeiras brutas do arquivo de imagem do disco
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
+grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
+grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
+grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
+grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
+grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
+grep ");$" /root/config_bruto.sql > /root/config_pronto.sql
+mysql -u root -p mkradius < /root/clientes_prontos.sql
+mysql -u root -p mkradius < /root/financas_prontas.sql
+mysql -u root -p mkradius < /root/radcheck_pronto.sql
+mysql -u root -p mkradius < /root/radreply_pronto.sql
+mysql -u root -p mkradius < /root/plano_pronto.sql
+mysql -u root -p mkradius < /root/srv_pronto.sql
+mysql -u root -p mkradius < /root/config_pronto.sql
+</code>
+===== mount proxmox virtual disk =====
 <code C [enable_keyword_links="false"]>
 mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1
 </code>
-=== dd through ssh ===
+===== Add user from CLI =====
+<code>
+pveum useradd manuel@pam
+pveum acl modify / --roles PVEAdmin --users manuel@pam
+</code>
+===== dd through ssh =====
 <code>
 ssh host "dd if=/dev/mapper/pve-vm--106--disk--0" | dd of=/dev/mapper/pve-vm--106--disk--0 status=progress
@@ Line 14: / Line 137: @@
 </code>
-=== repositories ===
+===== disable portmap port 111 =====
-old:
-/etc/apt/sources.list.d/pve-enterprise.list
+systemctl stop rpcbind
-deb http://download.proxmox.com/debian/pve buster pve-no-subscription
+systemctl stop rpcbind.socket
-new:
+systemctl disable rpcbind
+systemctl disable rpcbind.socket
+===== repositories =====
+old <8
+<code>
 /etc/apt/sources.list.d/pve-enterprise.list
+deb http://download.proxmox.com/debian/pve buster pve-no-subscription
+</code>
+new 8
+<code>
+/etc/apt/sources.list.d/pve-enterprise.list
 deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription
 /etc/apt/sources.list.d/ceph.list
 deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription
+</code>
+===== remove nag screen =====
-=== remove nag screen ===
 <code>
 sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service
@@ Line 37: / Line 178: @@
-=== links to sort ===
+===== links to sort =====
+Deactivate the volume group:
+# vgchange -a n my_volume_group
+Now you actually remove the volume group:
+# vgremove my_volume_group
+https://pve.proxmox.com/wiki/Passthrough_Physical_Disk_to_Virtual_Machine_(VM)
 https://github.com/Jamesits/pve-fake-subscription