GScan:Linux Checklist自动化检测,结果聚合|黑客攻击溯源

GScan是一个适用于安全应急响应人员对Linux主机排查时的安全工具。实现主机侧Checklist的全面自动化化扫描检测(包含 
常见检查项并可以自由扩展),根据检测结果自动数据聚合,进行黑客攻击路径溯源。

    **自动化程序的CheckList项如下:**
1.主机信息获取
2.系统初始化alias检查
3.件类安全扫描
  1.系统重要文件完整行扫描
  2.系统可执行文件安全扫描
  3.临时目录文件安全扫描
  4.用户目录文件扫描
  5.可疑隐藏文件扫描
4.各用户历史操作类
  1.境外ip操作类
  2.反弹shel类
5.进程类安全检测
  1.CUP和内存使用异常进程排查
  2.隐藏进程安全扫描
  3.反弹shell类进程扫描
  4.恶意进程信息安全扫描
  5.进程对应可执行文件安全扫描
6.6、网络类安全检测
  1.境外IP链接扫描
  2.恶意特征链接扫描
  3.网卡混杂模式检测
7.后门类检测
  1.LDPRELOAD后门检测
  2.LD_AOUT_PRELOAD后门检测
  3.LDELFPRELOAD后门检测
  4.LD LIBRARY PATH后门检测
  5.ld.so.preload后门检测
  6.PROMPT COMMAND后门检测
  7.Cron后门检测
  8.Alias后门
  9.SSH后门检测
  10.SSH wrapper 后门检测
  11.inetd.conf后门检测
  12.xinetd.conf后门检测
  13.setUID后门检测
  14.8种系统启动项后门检测
8.账户类安全排查
  1.root权限账户检测
  2.空口令账户检测
  3.sudoers文件用户权限检测
  4.查看各账户下登录公钥
  5.账户密码文件权限检测
9.日志类安全分析
  1.secure登陆日志
  2.wtmp登陆日志
  3.utmp登陆日志
  4.lastlog登陆日志
10.安全配置类分析
  1.DNS配置检测
  2.Iptables防火墙配置检测
  3.hosts配置检测
11.Rootkit分析
  1.检查已知rootkit文件类特征
  2.检查已知rootkitLKM类特征
  3.检查已知恶意软件类特征检测
12.WebShell类文件扫描
  1.WebShell类文件扫描


程序下载
git clone https://github.com/grayddq/GScan.git
cd GScan
sh-3.2# python GScan.py -h

  _______      _______.  ______      ___      .__   __.
 /  _____|    /       | /      |    /   \     |  \ |  |    {version:v0.1}
|  |  __     |   (----`|  ,----'   /  ^  \    |   \|  |
|  | |_ |     \   \    |  |       /  /_\  \   |  . `  |    {author:咚咚呛}
|  |__| | .----)   |   |  `----. /  _____  \  |  |\   |
 \______| |_______/     \______|/__/     \__\ |__| \__|    http://grayddq.top
Usage: GScan.py [options]

Options:

  -h, --help     show this help message and exit
  --version      当前程序版本

 Mode:
    GScan running mode options

--overseas   境外模式,此参数将不进行境外ip的匹配
--full       完全模式,此参数将启用完全扫描
--debug      调试模式,进行程序的调试数据输出
--dif        差异模式,比对上一次的结果,输出差异结果信息。
--sug        排查建议,用于对异常点的手工排查建议
--pro        处理方案,根据异常风险生成初步的处理方案

 Optimization:
 Optimization options

--time=TIME  搜索指定时间内主机改动过的所有文件,demo: --time='2019-05-07
             00:00:00~2019-05-07 23:00:00'
--job        添加定时任务,用于定时执行程序
--log        打包当前系统的所有安全日志(暂不支持

命令参考:
python GScan.py

python GScan.py --sug --pro

# 进行定时任务设置,异常日志将按行输出到./GScan/log/log.log,可通过syslog等服务同步日志信息。

python GScan.py --job #每天零点执行一次

python GScan.py --job --hour=2 #每2小时执行一次

检测结果
日志及结果目录默认:./GScan/log/gscan.log

gscan-1024x995.png

gscan2-1024x601.png

gscan1.png

我来吐槽

*

*

已有 40 条评论

  1. clourgy

    Zentel Website With Free Shipping Overseas Pharmacy discreet cialis meds Acheter Levitra Pour

  2. Twirway

    vardenafil levitra precio is there a legitimate canadian pharmacy where i can buy stromectol online Real Zentel Echinococcosis Online Tablet Overseas

  3. Keysler

    Although, one significant difference between the two drugs is how long they stay in your system purchase cialis online cheap The brand pills are so ridiculously overpriced I don t even remember buying them

  4. wainnef

    However, for as attractive as they are, I wouldn t say they re discreet priligy usa

  5. ruinkix

    A brochure is available at the Chamber office cialis without a prescription

  6. Nizscoons

    Ovarian cancer and continuing absorption is very bulky cialis and viagra sales Is fluticasone propionate bad for me because it s a steroid

  7. Gearsella

    There was no limitation regarding the inclusion of any human or animal models for PCOS or cell lines researches. clomid Uterine adenomyosis and or adenomyoma is characterized by the presence of heterotopic endometrial glands and stroma within the myometrium, 2.

  8. furtuby

    Lifestyle are situations like your ovaries. pct nolvadex dosage

  9. ziserse

    does doxycycline have a shelf life Or you can wrap the foot with a bandage soaked in tea tree and oregano essential oils.

  10. Arrerswaf

    This will happen for a small subset of men best way to take lasix

  11. ethinny

    5x to 2x larger than the 2014 one where to buy cialis online

  12. Allercext

    stromectol rosacea Plasma N acetylputrescine, cadaverine and 1, 3 diaminopropane potential biomarkers of lung cancer used to evaluate the efficacy of anticancer drugs

  13. Epibigo

    We recorded their weight before and after chemotherapy and also a year after chemotherapy to find out whether the change with weight is transitory reddit priligy It s hard to say how the DEA prioritizes its resources

  14. Almobre

    actos harga elocon cream 10 gr Jacobs departure after 16 years with the company comes amonth after LVMH founder and chief executive Bernard Arnaultappointed his daughter Delphine as deputy head of Louis Vuittonand replaced last year longstanding chief Yves Carcelle withgroup veteran Michael Burke osteoporosis tamoxifen

  15. Attaicift

    order clomid from india online But Tommy Robinson, a white working class lad from Luton, and Maajid Nawaz, a British Pakistani Liberal Democrat parliamentary candidate, have more in common than you might think

  16. legepunny

    ivermectin for humans online flurbiprofen cefixime ofloxacin dry syrup brands But when she didnГў t have anything to hand over, the suspects fled, cops said

  17. justymn

    doxylis acheter Provides information in Spanish about balancing work and cancer treatment and survivorship

  18. Spoiffutt

    Background Adjuvant therapy after breast surgery, including tamoxifen or aromatase inhibitors, improves the postoperative outcomes and long term survival of breast cancer patients half life of lasix Previous guidelines recommend monitoring troponin in high risk patients to guide the decisiveness of cardioprotective management 10, 77

  19. ristsnums

    People think of them as terrible places stromectol tablets

  20. nuabnuame

    lipothin por quantos dias tomar ivermectina Japan s new chief nuclear negotiator for North Korea Junichi Ihara met with his Chinese counterpart Monday, apparently explaining Tokyo s stance that there should be no multilateral talks with Pyongyang before it takes concrete and meaningful steps toward denuclearization clomid for male purchase

  21. hahacticy

    JAMA 279 21 1709 1714, 1998 tamoxifen nolvadex Bring back your voucher to redeem your reward whenever you want

  22. unfaina

    The ERG changes persist indefinitely, which can help distinguish the condition from retinitis pigmentosa where a history of quinine ingestion may not be volunteered by the patient 53 nolvadex pct Once you have narrowed down the options to focus on the type of shaving lubricant that you prefer and the products designed for your gender, you can compare the other features of the formulas

  23. frurgeorS

    soft tissue or skin metastasis is there a generic cialis available Si a la mezcla aГ±adimos ademГЎs algГєn compuesto de testosterona las ganancias serГЎn aГєn mГЎs sorprendentes

  24. boufave

    Physician and patient education about clinical trials is crucial contrareembolso kamagra paypal This includes individual drugs, combinations of drugs, and surgical and radiation techniques Investigations include new types of targeted therapy, 223 cancer vaccines, oncolytic virotherapy, 224 gene therapy 225 226 and immunotherapy

  25. boufave

    the pharmacy to buy clomid online from Baladia E, Basulto J, Manera M, Martinez R, Calbet D

  26. KaliSlece

    Lucas RycbiBbjejFuTOxyG 5 20 2022 fincar finasteride online canada

  27. Undopsy

    and you will, if you have to stromectol cena

  28. edimisy

    co chairman of the Congressional Caucus on Women s Issues online viagra generic Hemodynamics for bedside nurse

  29. fliplem

    Recently, I noticed that every time I take collagen my anxiety appeared so it is pretty evidence for me the relation where to buy priligy in usa

  30. ovazoky

    women shouldn t use androgenic compounds first off UNLESS they simply do not care about masculinizing side effects hey some women don t care is azithromycin an antibiotic

  31. Undopsy

    Monitor Closely 1 bupropion decreases effects of ioflupane I 123 by receptor binding competition priligy amazon uk I was given antibiotics and I delivered my son who is now 2 years old and healthy

  32. marlomi

    finasteride 1 mg prices Very low doses of this medication may help you sleep more soundly

  33. queueds

    cialis on sale in usa The primary end point progression of AKI defined by worsening AKIN stage occurred in 45 11

  34. enlarly

    accutane dosing calculator The magic ring in my hand just does inositol hexanicotinate lower blood pressure now can activate the domain once, but it can only be used once

  35. danianamn

    buy cialis online europe Initially, women are given 2

  36. danianamn

    Rojansky N et al cheap cialis online canadian pharmacy Patients were instructed to uptitrate their insulin dose in the evening based on fasting blood glucose measurements to achieve a target of 72100 mg dL

  37. scupesace

    can you buy lasix over the counter fludrocortisone, metolazone

  38. liapGearl

    isotretinoin Emperor Ning Qi s current move is what is the main cause of erectile dysfunction obviously to bring the whole world back into unity, but if he doesn t want to be the emperor, who is he optimistic about Why, can t bear it Ning Qidi raised his eyebrows and asked I really want to bear it, maybe you can think about how to disobey me