1. #!/bin/bash
    2. echo "
    5.                          ____ _  _ ____ ____ ____ ____ _  _ ____ _   _ 
    6.                            |___ |\/| |___ |__/ | __ |___ |\ | |     \_/  
    7.                            |___ |  | |___ |  \ |__] |___ | \| |___   |                                            
    9. "
    10. read -p "Press any key to continue." var
    12. echo -e "\033[34m[-]主机信息：\033[0m"
    13. # 当前用户
    14. echo -e "USER:\t\t" $(whoami) 2>/dev/null
    15. # 版本信息
    16. echo -e "OS Version:\t" ${PRETTY_NAME}
    17. # 主机名
    18. echo -e "Hostname: \t" $(hostname -s)
    19. # uptime
    20. echo -e "uptime: \t" $(uptime | awk -F ',' '{print $1}')
    21. printf "\n"
    23. # CPU占用率
    24. echo -e "\033[34m[-]CPU使用率：\033[0m"
    25. awk '$0 ~/cpu[0-9]/' /proc/stat 2>/dev/null | while read line; do
    26.     echo "$line" | awk '{total=$2+$3+$4+$5+$6+$7+$8;free=$5;\
    27.         print$1" Free "free/total*100"%",\
    28.         "Used " (total-free)/total*100"%"}'
    29. done
    30. printf "\n"
    32. # CPU占用TOP 10
    33. cpu=$(ps aux | grep -v ^'USER' | sort -rn -k3 | head -10) 2>/dev/null
    34. echo -e "\033[34m[-]CPU TOP 10：\033[0m\n${cpu}\n"
    36. # 内存占用
    37. echo -e "\033[34m[-]内存占用：\033[0m"
    38. free -m
    39. printf "\n"
    41. # 内存占用TOP 10
    42. cpu=$(ps aux | grep -v ^'USER' | sort -rn -k3 | head -10) 2>/dev/null
    43. #echo -e "\e[00;31m[*]内存占用 TOP10:  \e[00m\n${cpu}\n"
    44. echo -e "\033[34m[-]内存占用 TOP 10：\033[0m\n${cpu}\n"
    46. # 查看passwd下的用户，是否存在可疑用户
    47. echo -e "\033[34m[-]/etc/passwd:\033[0m" #blue
    48. cat /etc/passwd |grep -nvi "nologin"
    50. # 显示可远程登录的用户
    51. echo -e "\033[34m[-]可远程登录用户：\033[0m"
    52. awk -F: '/\$1|\$6/{print $1}' /etc/shadow
    54. # 查看有无特权用户，并将其删除
    55. echo -e "\033[34m[-]特权用户：\033[0m"
    56. admin=`awk -F: '$3==0{print $1}' /etc/passwd`
    57. echo -e "$admin"
    59. # 删除可疑特权用户，将/home下的用户一块删掉
    60. for b in {1..10}
    61. do 
    62.     admin=`awk -F: '$3==0{print $1}' /etc/passwd`
    63.     echo "请输入要删除的用户名:"
    64.   echo "无需删除请输入“0”"
    65.     read user
    66.     if [ $user == "0" ]; then
    67.         break
    68.     else
    69.         #del=`userdel -r $user`
    70.         echo "Del $user succefssful!!"
    71.     fi
    72. done
    74. # 显示处于连接状态的端口号和响应的进程
    75. port=`netstat -antlp` # port=`netstat -antlp | grep -ni "ESTABLISHED"`
    76. echo -e "\033[34m[-]连接端口状态:：\033[0m"
    77. echo -e "$port"
    79. # for循环用于获取各个pid对应的进程
    80. for a in {1..10}
    81. do 
    82.     echo "please input PID $a [if PID==0, break!]:"
    83.     read PID
    84.     if [ $PID -eq 0 ];
    85.     then
    86.         break
    87.     else
    88.         exe=`ls -l /proc/$PID/exe`
    89.         ps=`ps aux | grep $PID` 
    90.         echo -e "$PID\033[34m 对应进程文件路径 ->  $exe\033[0m" #blue
    91.         echo -e "$PID\033[34m 对应进程为 ->  $ps\033[0m" #blue    
    92.     fi
    93.     echo "是否要杀掉此进程?[1/0]"
    94.     read result
    95.     if [ $result -eq 1 ]; then
    96.         `kill $PID`
    97.         echo "$PID 删除成功！"
    98.     else
    99.         echo "$PID 删除失败！"
    100.     fi
    101. done
    102. printf "\n"
    104. # 查看历史命令，并显示异常操作
    105. shell=`cat ~/.bash_history | grep -e "chmod" -e "rm" -e "wget" -e "ssh" -e "tar" -e "zip" -e "scp"`
    106. echo -e "\033[34m[-]历史命令:：\033[0m"
    107. echo -e "$shell"
    108. printf "\n"
    110. # 增强型历史命令记录
    111. echo -e "\033[34m[-]是否添加增强型历史命令记录？[1/0]\033[0m"
    112. read r
    113. if [ $r -eq 0 ]; then
    114.     echo "未添加增强型命令记录！"
    115. else
    117.     cat>>/tmp/666.txt<<EOF
    118. USER_IP=\`who -u am i 2>/dev/null | awk '{print $NF}' | sed -e 's/[()]//g'\` 
    119. if [ "\$USER_IP" = "" ]
    120. then
    121. USER_IP=\`hostname\`
    122. fi
    123. export HISTTIMEFORMAT="%F %T $USER_IP \`whoami\` "
    124. shopt -s histappend
    125. export PROMPT_COMMAND="history -a"
    126. EOF
    127. echo "/etc/profile写入成功！"
    128. printf "\n"
    130. # 使配置生效
    131. #source /etc/profile
    132. echo "/etc/profile已生效！"
    133. printf "\n"
    134. fi
    136. # 用户自定义启动项
    137. echo -e "\033[34m[-]用户自定义启动项：\033[0m"
    138. chkconfig=$(chkconfig --list | grep -E ":on|启用" | awk '{print $1}')
    139. if [ -n "$chkconfig" ];then
    140.     (echo "[*]用户自定义启动项:" && echo "$chkconfig")
    141. else
    142.     echo "[!]未发现用户自定义启动项"
    143. fi
    144. printf "\n"
    146. # 可能存在的危险启动项
    147. echo -e "\033[34m[-]危险启动项：\033[0m"
    148. dangerstarup=$(chkconfig --list | grep -E ":on|启用" | awk '{print $1}' | grep -E "\.(sh|per|py)$")
    149. if [ -n "$dangerstarup" ];then
    150.     echo "[!]发现危险启动项:" && echo "$dangerstarup"
    151. else
    152.     echo "[*]未发现危险启动项"
    153. fi
    154. printf "\n"
    156. # 系统定时任务
    157. echo -e "\033[34m[-]系统定时任务：\033[0m"
    158. syscrontab=$(more /etc/crontab | grep -v "# run-parts" | grep run-parts)
    159. if [ -n "$syscrontab" ];then
    160.     echo "[!]发现存在系统定时任务:" && more /etc/crontab 
    161. else
    162.     echo "[*]未发现系统定时任务"
    163. fi
    164. printf "\n"
    166. # 可疑定时任务
    167. echo -e "\033[34m[-]可疑定时任务：\033[0m"
    168. dangersyscron=$(egrep "((chmod|useradd|groupadd|chattr)|((wget|curl)*\.(sh|pl|py)$))"  /etc/cron*/* /var/spool/cron/*)
    169. if [ $? -eq 0 ];then
    170.     (echo "[!]发现可疑定时任务：" && echo "$dangersyscron")
    171. else
    172.     echo "[*]未发现可疑系统定时任务"
    173. fi
    174. printf "\n"
    176. # 查看日志配置
    177. echo -e "\033[34m[-]日志配置：\033[0m"
    178. logconf=$(more /etc/rsyslog.conf | egrep -v "#|^$")
    179. if [ -n "$logconf" ];then
    180.     (echo "[*]日志配置如下:" && echo "$logconf")
    181. else
    182.     echo "[!]未发现日志配置文件"
    183. fi
    184. printf "\n"
    186. # 检查日志是否被清除
    187. echo -e "\033[34m[-]查看日志是否被清除：\033[0m"
    188. logs=$(ls -l /var/log/)
    189. if [ -n "$logs" ];then
    190.     echo "[*]日志文件存在"
    191. else
    192.     echo "[!]日志文件不存在,可能被清除！"
    193. fi
    194. printf "\n"
    196. # secure日志分析
    197. echo -e "\033[34m[-]secure日志分析-登录成功情况：\033[0m"
    198. loginsuccess=$(more /var/log/secure* | grep "Accepted password" | awk '{print $1,$2,$3,$9,$11}')
    199. if [ -n "$loginsuccess" ];then
    200.     (echo "[*]日志中分析到以下用户成功登录:" && echo "$loginsuccess") 
    201.     (echo "[*]登录成功的IP及次数如下：" && grep "Accepted " /var/log/secure* | awk '{print $11}' | sort -nr | uniq -c ) 
    202.     (echo "[*]登录成功的用户及次数如下:" && grep "Accepted" /var/log/secure* | awk '{print $9}' | sort -nr | uniq -c ) 
    203. else
    204.     echo "[*]日志中未发现成功登录的情况"
    205. fi
    206. printf "\n"
    208. echo -e "\033[34m[-]secure日志分析-登录失败情况：\033[0m"
    209. loginfailed=$(more /var/log/secure* | grep "Failed password" | awk '{print $1,$2,$3,$9,$11}')
    210. if [ -n "$loginfailed" ];then
    211.     (echo "[!]日志中发现以下登录失败的情况:" && echo "$loginfailed") |  tee -a $danger_file 
    212.     (echo "[!]登录失败的IP及次数如下:" && grep "Failed password" /var/log/secure* | awk '{print $11}' | sort -nr | uniq -c) 
    213.     (echo "[!]登录失败的用户及次数如下:" && grep "Failed password" /var/log/secure* | awk '{print $9}' | sort -nr | uniq -c) 
    214. else
    215.     echo "[*]日志中未发现登录失败的情况"
    216. fi
    217. printf "\n"
    219. echo -e "\033[34m[-]secure日志分析-本机登录情况：\033[0m"
    220. systemlogin=$(more /var/log/secure* | grep -E "sshd:session.*session opened" | awk '{print $1,$2,$3,$11}')
    221. if [ -n "$systemlogin" ];then
    222.     (echo "[*]本机登录情况:" && echo "$systemlogin")
    223.     (echo "[*]本机登录账号及次数如下:" && more /var/log/secure* | grep -E "sshd:session.*session opened" | awk '{print $11}' | sort -nr | uniq -c)
    224. else
    225.     echo "[!]未发现在本机登录退出情况！"
    226. fi
    227. printf "\n"
    229. echo -e "\033[34m[-]secure日志分析-新增用户情况：\033[0m"
    230. newusers=$(more /var/log/secure* | grep "new user"  | awk -F '[=,]' '{print $1,$2}' | awk '{print $1,$2,$3,$9}')
    231. if [ -n "$newusers" ];then
    232.     (echo "[!]日志中发现新增用户:" && echo "$newusers")
    233.     (echo "[*]新增用户账号及次数如下:" && more /var/log/secure* | grep "new user" | awk '{print $8}' | awk -F '[=,]' '{print $2}' | sort | uniq -c)
    234. else
    235.     echo "[*]日志中未发现新增加用户"
    236. fi
    237. printf "\n"
    239. # message日志分析
    240. echo -e "\033[34m[-]message日志分析-文件传输情况：\033[0m"
    241. zmodem=$(more /var/log/message* | grep "ZMODEM:.*BPS")
    242. if [ -n "$zmodem" ];then
    243.     (echo "[!]传输文件情况:" && echo "$zmodem")
    244. else
    245.     echo "[*]日志中未发现传输文件"
    246. fi
    247. printf "\n"
    249. echo -e "\033[34m[-]cron日志分析-定时下载：\033[0m"
    250. cron_download=$(more /var/log/cron* | grep "wget|curl")
    251. if [ -n "$cron_download" ];then
    252.     (echo "[!]定时下载情况:" && echo "$cron_download")
    253. else
    254.     echo "[*]未发现定时下载情况"
    255. fi
    256. printf "\n"
    258. echo -e "\033[34m[-]cron日志分析-定时执行脚本：\033[0m"
    259. cron_shell=$(more /var/log/cron* | grep -E "\.py$|\.sh$|\.pl$") 
    260. if [ -n "$cron_shell" ];then
    261.     (echo "[!]发现定时执行脚本:" && echo "$cron_download")
    262. else
    263.     echo "[*]未发现定时下载脚本"
    264. fi
    265. printf "\n"
    267. # btmp日志分析
    268. echo -e "\033[34m[-]btmp日志分析-错误登录日志分析：\033[0m"
    269. lastb=$(lastb)
    270. if [ -n "$lastb" ];then
    271.     (echo "[！]错误登录日志如下:" && echo "$lastb")
    272. else
    273.     echo "[*]未发现错误登录日志"
    274. fi
    275. printf "\n"
    277. # lastlog日志分析
    278. echo -e "\033[34m[-]lastlog日志分析-最后一次登录：\033[0m"
    279. lastlog=$(lastlog)
    280. if [ -n "$lastlog" ];then
    281.     (echo "[！]所有用户最后一次登录日志如下:" && echo "$lastlog")
    282. else
    283.     echo "[*]未发现所有用户最后一次登录日志"
    284. fi
    285. printf "\n"
    287. # wtmp日志分析
    288. echo -e "\033[34m[-]wtmp日志分析-用户登录分析：\033[0m"
    289. lasts=$(last | grep pts | grep -vw :0)
    290. if [ -n "$lasts" ];then
    291.     (echo "[！]历史上登录到本机的用户如下:" && echo "$lasts")
    292. else
    293.     echo "[*]未发现历史上登录到本机的用户信息"
    294. fi
    295. printf "\n"
    298. #文件排查
    299. echo -e "\033[34m[-]文件排查：\033[0m"
    300. #敏感文件
    301. echo -e "\033[34m[-]敏感文件列表：\033[0m"
    302. find / ! -path "/lib/modules*" ! -path "/usr/src*" ! -path "/snap*" ! -path "/usr/include/*" -regextype posix-extended -regex '.*sqlmap|.*msfconsole|.*\bncat|.*\bnmap|.*nikto|.*ettercap|.*backdoor|.*tunnel\.(php|jsp|asp|py)|.*\bnc|.*socks.(php|jsp|asp|py)|.*proxy.(php|jsp|asp|py)|.*brook.*|.*frps|.*frpc'
    303. printf "\n"
    304. echo -e "\033[34m[-]新增特权文件列表：\033[0m"
    305. echo -e "
    306. [1]: php
    307. [2]: jsp
    308. [3]: asp
    309. "
    310. echo "请根据编号选择语言[if input == 0; break]:"
    311. read language
    312. if [ $language -eq 1 ]; then
    313.     php=`find / -mtime 0 -name "*.php"`
    314.     php1=`find / -name *.php -perm 777`
    315.     echo -e "$php"
    316.     echo -e "777 = $php1"
    317. elif [ $language -eq 2 ]; then
    318.     jsp=`find / -mtime 0 -name "*.jsp"`
    319.     jsp1=`find / -name *.jsp -perm 777`
    320.     echo -e "$jsp"
    321.     echo -e "777 = $jsp1"
    322. elif [ $language -eq 3 ]; then
    323.     asp=`find / -mtime 0 -name "*.asp"`
    324.     asp1=`find / -name *.asp -perm 777`
    325.     echo -e "$asp"
    326.     echo -e "777 = $asp1"
    327. else
    328.     echo "未匹配语言！"
    329. fi
    330. printf "\n"
    332. # 查看指定目录下文件的时间排序[从新到旧]
    333. echo -e "\033[34m[-]查看指定目录下文件的时间排序[从新到旧]：\033[0m"
    334. #ls -alt | head -n 10
    335. for x in {1..10}
    336. do
    337.     echo -e "\033[34m[-]请输入目录名称[if input == 0; break]：\033[0m"
    338.     read directory 
    339.     # if [ `echo $directory | awk -v tem=0 '{print($1>tem)? "1":"0"}'` == "0" ];then
    340.     if [ $directory == "0" ]; then
    341.         break
    342.     else
    343.         directory1=`ls $directory -alt | head -n 30`
    344.         echo -e "$directory1"
    345.     fi
    346. done
    347. printf "\n"
    349. # 查看异常文件的创建修改等的时间
    350. echo -e "\033[34m[-]查看异常文件的创建修改等的时间：\033[0m"
    351. for y in {1..10}
    352. do
    353.     echo -e "\033[34m[-]请输入文件的绝对路径[if input == 0; break]：\033[0m"
    354.     read file
    355.     if [ $file == "0" ]; then
    356.         break
    357.     else
    358.         files=`stat $file`
    359.         echo -e "$files"
    360.     fi
    361. done
    363. echo -e "\033[34m[+]检查结束！\033[0m"

    linux.sh