Linux下的應急工具

在Linux下，應急的查看點無非那個幾個，一是看表現（宕機、高CPU、高內存、高IO、高網絡通信），二看連接、三看進程、四看日誌、五看文件（Linux一切皆文件），再者結合起來看。所以針對常見的應急操作自己寫了兩個小工具。目前支持CentOS和RedHat，其實由於基於Python，基本是跨平臺，絕大部分功能支持其他發行版本的Linux甚至Windows。

工具的安裝

#要求root權限
git clone https://github.com/cisp/LinuxEmergency.git
cd LinuxEmergency
sh ./install.sh

工具的使用

查看操作系統信息：

[root@centos emergency]# python emergency.py -o

        內核版本 : Linux-3.10.0-514.26.2.el7.v7.4.qihoo.x86_64-x86_64-with-centos-7.2.1511-Core
        CORE數量 : 16
        CPU數量 : 16
        CPU使用率 : scputimes(user=1.0, nice=0.0, system=0.0, idle=15.0, iowait=0.0, irq=0.0, softirq=0.0, steal=0.0, guest=0.0, guest_nice=0.0)
        內存總量  : 33736994816
        內存使用率 : 5.1

[root@centos emergency]#
 

查看內核模塊信息：

[root@centos emergency]# python emergency.py -k
內核模塊 : nfnetlink_queue  來源  :
內核模塊 : nfnetlink_log  來源  :
內核模塊 : nfnetlink  來源  :  nfnetlink_log,nfnetlink_queue
內核模塊 : bluetooth  來源  :

查看所有登錄成功失敗的IP地址：

[root@scentos emergency]# python emergency.py -l
192.168.100.35  失敗
192.168.100.31  失敗
127.0.0.1  失敗
192.168.100.20  成功
 

查看登錄成功和失敗日誌

#  成功的 -s
[root@centos emergency]# python emergency.py -s | more
賬戶 : emergency    時間 : 2017-08-09-11:20  來源 : (192.168.100.24)
賬戶 : emergency    時間 : 2017-08-09-14:34  來源 : (192.168.100.24)
賬戶 : root    時間 : 2017-09-28-12:38  來源 : (192.168.100.65)
賬戶 : root    時間 : 2017-09-28-12:46  來源 : (192.168.100.65)
賬戶 : root    時間 : 2017-09-28-13:13  來源 : (192.168.100.65)

# 失敗的 -f
[root@centos emergency]# python emergency.py -f | more
賬戶 : emergency    時間 : 192.168.100.34  來源 : Jul-6-21:27---21:27
賬戶 : emergency    時間 : 192.168.100.34  來源 : Jul-6-21:25---21:25
賬戶 : admin    時間 : 127.0.0.1  來源 : Jul-5-15:32---15:32

#  如果需要指定IP 加-i參數 ，例如 -i 192.168.100.34；

查看進程列表和詳細信息

#  列表信息
[root@centos emergency]# python emergency.py -a
***********************************************************************************************************
進程ID號: 2     進程名稱: kthreadd     進程用戶: root     啟動時間: 2018-06-16 07:40:48
CPU占比: 0.0%     內存占比: 0.0%
網絡連接:
***********************************************************************************************************
***********************************************************************************************************
進程ID號: 3     進程名稱: ksoftirqd/0     進程用戶: root     啟動時間: 2018-06-16 07:40:48
CPU占比: 0.0%     內存占比: 0.0%
網絡連接:
***********************************************************************************************************
...

##  詳細信息
[root@centos emergency]# python emergency.py -p 28344
***********************************************************************************************************
進程ID號: 28344     進程名稱: screen     進程用戶: emergency     啟動時間: 2018-06-22 13:25:30
工作路徑: /home/emergency/
進程命令: SCREEN
父母進程: 1
親子進程: [28345]
CPU占比: 0.0%     內存占比: 0.0046135703802%
網絡連接:
進程環境:
        終端會話    :  /bin/bash
        安全會話    :
        登錄賬戶    :  emergency
        工作賬戶    :  emergency
        權限路徑    :  /usr/lib64/ccache:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/emergency/tools:/usr/local/bin:/usr/local/sbin:/usr/local/python3/bin:/home/emergency/.local/bin:/home/emergency/bin
        用戶目錄    :  /home/emergency

***********************************************************************************************************

添加virustotal基本查詢功能

# 檢查樣本
[root@centos emergency]# python virustotal.py -f ./LICENSE
******************************************
檢測時間: 2018-07-09 07:31:04
報毒數量: 0
報毒引擎: []
引擎總數: 59
******************************************

# 檢查URL
[root@centos emergency]# python virustota.py -u http://1.1.1.2/bmi/docs.autodesk.com
******************************************
檢測時間: 2018-07-09 16:33:29
關聯樣本: 0
關聯連接: 0
關聯域名: 0
******************************************

# 檢查域名
[root@centos emergency]# python virustota.py -d baidu.com
******************************************
檢測時間: 2018-07-09 16:33:35
關聯樣本: 202
關聯連接: 100
關聯域名: 8
******************************************

# 檢查IP
[root@centos emergency]# python virustota.py -a 114.114.114.114
******************************************
檢測時間: 2018-07-09 16:34:05
關聯樣本: 135
關聯連接: 93
關聯域名: 592
******************************************

增加查看whois信息的功能

[root@centos emergency]# python mywhois.py -d baidu.com
Domain Name: baidu.com
Registry Domain ID: 11181110_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2017-07-27T19:36:28-0700
Creation Date: 1999-10-11T04:05:17-0700
Registrar Registration Expiration Date: 2026-10-11T00:00:00-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Domain Status: serverUpdateProhibited (https://www.icann.org/epp#serverUpdateProhibited)
Domain Status: serverTransferProhibited (https://www.icann.org/epp#serverTransferProhibited)
Domain Status: serverDeleteProhibited (https://www.icann.org/epp#serverDeleteProhibited)
Registrant Organization: Beijing Baidu Netcom Science Technology Co., Ltd.
Registrant State/Province: Beijing
Registrant Country: CN
Admin Organization: Beijing Baidu Netcom Science Technology Co., Ltd.
Admin State/Province: Beijing
Admin Country: CN
Tech Organization: Beijing Baidu Netcom Science Technology Co., Ltd.
Tech State/Province: Beijing
Tech Country: CN
Name Server: ns4.baidu.com
Name Server: ns3.baidu.com
Name Server: dns.baidu.com
Name Server: ns2.baidu.com
Name Server: ns7.baidu.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2018-07-09T02:21:59-0700 <<<

If certain contact information is not shown for a Registrant, Administrative,
or Technical contact, and you wish to send a message to these contacts, please
send your message to [email protected] and specify the domain name in
the subject line. We will forward that message to the underlying contact.

If you have a legitimate interest in viewing the non-public WHOIS details, send
your request and the reasons for your request to [email protected]
and specify the domain name in the subject line. We will review that request and
may ask for supporting documentation and explanation.

The Data in MarkMonitor.com‘s WHOIS database is provided by MarkMonitor.com for
information purposes, and to assist persons in obtaining information about or
related to a domain name registration record.  MarkMonitor.com does not guarantee
its accuracy.  By submitting a WHOIS query, you agree that you will use this Data
only for lawful purposes and that, under no circumstances will you use this Data to:
 (1) allow, enable, or otherwise support the transmission of mass unsolicited,
     commercial advertising or solicitations via e-mail (spam); or
 (2) enable high volume, automated, electronic processes that apply to
     MarkMonitor.com (or its systems).
MarkMonitor.com reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.

MarkMonitor is the Global Leader in Online Brand Protection.

MarkMonitor Domain Management(TM)
MarkMonitor Brand Protection(TM)
MarkMonitor AntiPiracy(TM)
MarkMonitor AntiFraud(TM)
Professional and Managed Services

Visit MarkMonitor at http://www.markmonitor.com
Contact us at +1.8007459229
In Europe, at +44.02032062220

For more information on Whois status codes, please visit
 https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en
--

關於web攻擊日誌的檢測

程序下載：

git clone https://github.com/cisp/AccessLogAnylast.git

關於使用：

    parser.add_option("-f", "--floder",dest="filepath",help="access log file path")
    parser.add_option("-t", "--time",dest="accesstime",help="set search time")
    parser.add_option("-d", "--date",dest="accessdate",help="set search date")
    parser.add_option("-c", "--count",action=‘store_true‘,dest="count",help="show count information")
    parser.add_option("-p", "--payload",dest="payload",help="set search payload")
    parser.add_option("-a","--address",dest="ipaddress",help="set search ipaddress")
    parser.add_option("-v", "--version",action=‘store_true‘,dest="version",help="show document")
    parser.add_option("-i","--detail",action=‘store_true‘,dest="detail",help="show detail")
    parser.add_option("-s","--shell",action=‘store_true‘,dest="webshell",help="show suspicious webshell")
    parser.add_option("-g","--ipflag",dest="ipposition",help="ip position in logfile")
    parser.add_option("-n","--name",dest="filename",help="filename flag")

Linux下應急工具