protocol.be

This is an old revision of the document!

Limpar backdoor

# remover backdoor e minerador de cripto (XMrig/monero)
# encontrei eles nas librarias para mexer nos comandos comuns, classico..
unset LD_PRELOAD
export LD_PRELOAD=""

chattr -ia /etc/ld.so.preload
echo "" > /etc/ld.so.preload
rm -f /etc/ld.so.preload

# matar os processos de mineraçao e persistencia
pkill -9 -f PVE-1
pkill -f PVE-1-maintain
pkill -f PVE-1-update
pkill -f ld-svc

# boa tentativa deles, mais classico tambem..
chattr -ia /etc/systemd/system/ld-svc.service
chattr -ia /lib/systemd/system/ld-svc.service
chattr -ia /etc/systemd/system/PVE-1-update.*
chattr -ia /lib/systemd/system/PVE-1-update.*
chattr -ia /usr/libexec/PVE-1-maintain
chattr -ia /usr/libexec/PVE-1-update
chattr -ia /var/lib/systemd/ld-svc
chattr -ia /var/lib/systemd/PVE-1

systemctl stop PVE-1-update.timer 2>/dev/null || true
systemctl disable PVE-1-update.timer 2>/dev/null || true
systemctl stop ld-svc.timer 2>/dev/null || true
systemctl disable ld-svc.timer 2>/dev/null || true

chattr -ia /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer
rm -f /etc/systemd/system/PVE-1-update.timer /lib/systemd/system/PVE-1-update.timer

chattr -ia /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
rm -f /etc/systemd/system/ld-svc.timer /lib/systemd/system/ld-svc.timer
rm -f /etc/systemd/system/ld-svc.service /lib/systemd/system/ld-svc.service
rm -f /etc/systemd/system/PVE-1-update.* /lib/systemd/system/PVE-1-update.*
rm -f /usr/libexec/PVE-1-maintain /usr/libexec/PVE-1-update
rm -f /var/lib/systemd/ld-svc
rm -rf /var/lib/systemd/PVE-1
rm -rf /var/lib/systemd/.cache
rm -f /etc/cron.d/ld-svc* /etc/cron.hourly/ld-svc* /etc/cron.daily/ld-svc*
rm  /etc/pve/priv/authorized_keys
rm -f /lib/systemd/system-generators/PVE-1*
rm -f /etc/systemd/system-generators/PVE-1*
rm -f /lib/systemd/system-generators/ld-svc*
rm -f /etc/systemd/system-generators/ld-svc*

systemctl daemon-reload
systemctl reset-failed


# listar as VM e disk ID
cat /etc/pve/qemu-server/*.conf | grep -E "name|scsi0|virtio0"

# extrair as VM (preferencia em disco externo ou remoto)
dd if=/dev/pve/vm-100-disk-0 of=/mnt/sdb1/vm100.raw bs=4M status=progress

Usar testdisk para restaurar, nao esqueçe selecionar MBR or GPT, se for XFS use kpartx ou forçando offset em loop device..

uma chave ssh deles em /etc/pve/priv/authorized_keys:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCltvjARi/1pL5C3YYRrHnxgE6Os2Yd/68Vq3q4lRJOU5GdiuP1EN5wcPq1whg4CF0iWsLnz+nt/ZCJGnRvyTELkumdzIPYmxb
CVt0aNVoUYc71EQhNA4Q1XbqrzCwzjB/gun+8J/+vILYSwpi8AUDqNXAd6T66d5WhNpURf9MB1h4W+m3iD0skYL/xRf/+6SRy+P+xIkBSBZQHtSLecAcNWk1cnO+Db4DU0fzeM0
Eezua0I2YLm9KizbgE11FxEB+9NQW3fkdRuYtZZGMzd2DHB+V5jwfCxPKl0SpyWmQNL+cpn9Lpt0EP/GGP/7QA4IL4whAPWOcsU5UpdSESz8DT

mount proxmox virtual disk

mount -t vfat -o loop,offset=$((8192 * 512 ))  imgfile.img /mnt/disk1

Add user from CLI

pveum useradd manuel@pam


pveum acl modify / --roles PVEAdmin --users manuel@pam

dd through ssh

ssh host "dd if=/dev/mapper/pve-vm--106--disk--0" | dd of=/dev/mapper/pve-vm--106--disk--0 status=progress

or

dd if=/dev/mapper/pve-vm--106--disk--0 bs=4MiB conv=sync status=progress | ssh host ' dd of=/dev/mapper/pve-vm--106--disk--0 bs=4MiB'

disable portmap port 111

systemctl stop rpcbind

systemctl stop rpcbind.socket

systemctl disable rpcbind

systemctl disable rpcbind.socket

repositories

old <8

/etc/apt/sources.list.d/pve-enterprise.list

deb http://download.proxmox.com/debian/pve buster pve-no-subscription

new 8

/etc/apt/sources.list.d/pve-enterprise.list

deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

/etc/apt/sources.list.d/ceph.list

deb http://download.proxmox.com/debian/ceph-quincy bookworm no-subscription

remove nag screen

sed -Ezi.bak "s/(function\(orig_cmd\) \{)/\1\n\torig_cmd\(\);\n\treturn;/g" /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js && systemctl restart pveproxy.service