1
heiher 2022-07-28 11:21:02 +08:00 via Android
靠,这东西都做了什么???
|
2
l2d 2022-07-28 11:25:48 +08:00 1
不然呢?要不先看看目前主流的 HIDS 都是怎么实现的...?
你做 rootkit 检测, 监控 cred 变化情况都得用 LKM 。而且用 kprobe 检测系统调用也是要 lkm 加载检测模块的啊。 |
3
fengjianxinghun 2022-07-28 11:26:20 +08:00
云盾安骑士核心驱动,懂得都懂,ftrace hook 了一些东西
|
5
morphyhu OP [root@aliyun ~]# rmmod AliSecGuard
rmmod: ERROR: Module AliSecGuard is in use 请教如何彻底移除?? |
6
morphyhu OP Google 到了
/usr/local/aegis/AliSecGuard/AliSecGuard --stopdriver |
7
morphyhu OP 不管用.还是存在...
|
8
morphyhu OP 终于搞定了.
参考 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_monitoring_and_updating_the_kernel/managing-kernel-modules_managing-monitoring-and-updating-the-kernel cat >> /etc/modprobe.d/blacklist.conf <<EOF # Blacklists AliSecGuard blacklist AliSecGuard install AliSecGuard /bin/false EOF reboot |
9
morphyhu OP 干净多了.
[root@ aliyun local]# lsmod Module Size Used by nfit 55016 0 libnvdimm 147731 1 nfit iosf_mbi 15582 0 crc32_pclmul 13133 0 ghash_clmulni_intel 13273 0 aesni_intel 189415 0 ppdev 17671 0 lrw 13286 1 aesni_intel gf128mul 15139 1 lrw glue_helper 13990 1 aesni_intel ablk_helper 13597 1 aesni_intel cryptd 21190 3 ghash_clmulni_intel,aesni_intel,ablk_helper parport_pc 28205 0 i2c_piix4 22401 0 pcspkr 12718 0 virtio_balloon 18015 0 joydev 17389 0 parport 46395 2 ppdev,parport_pc ip_tables 27126 0 ext4 579979 1 mbcache 14958 1 ext4 jbd2 107478 1 ext4 ata_generic 12923 0 pata_acpi 13053 0 virtio_blk 18222 2 virtio_console 28076 1 virtio_net 28063 0 cirrus 24377 1 drm_kms_helper 179394 1 cirrus syscopyarea 12529 1 drm_kms_helper sysfillrect 12701 1 drm_kms_helper sysimgblt 12640 1 drm_kms_helper fb_sys_fops 12703 1 drm_kms_helper ttm 114635 1 cirrus ata_piix 35052 0 drm 429744 4 ttm,drm_kms_helper,cirrus libata 243133 3 pata_acpi,ata_generic,ata_piix crct10dif_pclmul 14307 0 crct10dif_common 12595 1 crct10dif_pclmul crc32c_intel 22094 0 serio_raw 13434 0 virtio_pci 22985 0 virtio_ring 22746 5 virtio_blk,virtio_net,virtio_pci,virtio_balloon,virtio_console virtio 14959 5 virtio_blk,virtio_net,virtio_pci,virtio_balloon,virtio_console drm_panel_orientation_quirks 12957 1 drm floppy 69432 0 [root@ aliyun local]# |
10
zyxk 2022-07-28 14:53:32 +08:00 1
看不懂咋办?我是不是废了
|
12
461da73c 2022-07-28 15:12:18 +08:00
重装成自己想要的纯净系统啊,买了轻量云第一步操作。
|
13
461da73c 2022-07-28 15:12:33 +08:00
指不定还有啥后门。
|