Differences

This shows you the differences between two versions of the page.

--- proxmox [2026/08/31 17:04] – protocol
+++ proxmox [2026/08/31 23:49] (current) – protocol
@@ Line 27: / Line 27: @@
 chattr -ia /var/lib/systemd/PVE-1
+systemctl stop PVE-1-update.timer 2>/dev/null || true
+systemctl disable PVE-1-update.timer 2>/dev/null || true
+systemctl stop ld-svc.timer 2>/dev/null || true
+systemctl disable ld-svc.timer 2>/dev/null || true
+chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
+rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
+chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
+rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
 rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
 rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
@@ Line 35: / Line 45: @@
 rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
 rm  /etc/pve/priv/authorized_keys
+rm -f /lib/systemd/system-generators/PVE-1*
+rm -f /etc/systemd/system-generators/PVE-1*
+rm -f /lib/systemd/system-generators/ld-svc*
+rm -f /etc/systemd/system-generators/ld-svc*
+systemctl daemon-reload
+systemctl reset-failed
 # listar as VM e disk ID
@@ Line 48: / Line 66: @@
 CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
 Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT
+IP deles:
+.117.145.130 C&C
+.185.15.129 C&C
+.148.10.152 C&C
+.60.130.193 (entry proxy, most probably some botnet zombie)
+.172.58.170 (monero)
+grep -a -b -o "BZh" server2-mkauth.raw
+dd if=/root/server1_partition.raw bs=1 skip=24461097825 status=none | grep -a -b -o "BZh"
+dd if=server2-mkauth.raw of=staged_padded.maz bs=1 skip=62236491651 count=150000000 status=progress
+# Extrai as linhas financeiras brutas do arquivo de imagem do disco
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_cliente\`" > /root/backup_urgente_clientes.sql
+grep ");$" /root/backup_urgente_clientes.sql > /root/clientes_prontas.sql
+# Extrai as linhas financeiras brutas do arquivo de imagem do disco
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_lanc\`" > /root/financas_bruto.sql
+grep ");$" /root/financas_bruto.sql > /root/financas_prontas.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`radcheck\`" > /root/radcheck_bruto.sql
+grep ");$" /root/radcheck_bruto.sql > /root/radcheck_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`radreply\`" > /root/radreply_bruto.sql
+grep ");$" /root/radreply_bruto.sql > /root/radreply_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_plano\`" > /root/plano_bruto.sql
+grep ");$" /root/plano_bruto.sql > /root/plano_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_srv\`" > /root/srv_bruto.sql
+grep ");$" /root/srv_bruto.sql > /root/srv_pronto.sql
+strings server2-mkauth.raw | grep -E "^INSERT INTO \`sis_config\`" > /root/config_bruto.sql
+grep ");$" /root/config_bruto.sql > /root/config_pronto.sql
+mysql -u root -p mkradius < /root/clientes_prontos.sql
+mysql -u root -p mkradius < /root/financas_prontas.sql
+mysql -u root -p mkradius < /root/radcheck_pronto.sql
+mysql -u root -p mkradius < /root/radreply_pronto.sql
+mysql -u root -p mkradius < /root/plano_pronto.sql
+mysql -u root -p mkradius < /root/srv_pronto.sql
+mysql -u root -p mkradius < /root/config_pronto.sql
 </code>