超实用的脚本——检查oracle数据库是否存在潜伏的比特币勒索病毒

2019-1-14 09:31 |来自: 互联网 2491 0

摘要: 概述分享一个工作中经常用的一个实用脚本，主要用来检查oracle数据库是否存在潜伏的比特币勒索病毒，之所以用perl，是因为perl语言的核心是正则表达式，在文本处理上非常有优势，与python类似，但语法不同，perl的 ...

关键词：脚本 perl 语法操作系统检查内容 oracle 中经正则

概述

分享一个工作中经常用的一个实用脚本，主要用来检查oracle数据库是否存在潜伏的比特币勒索病毒，之所以用perl，是因为perl语言的核心是正则表达式，在文本处理上非常有优势，与python类似，但语法不同，perl的语法很灵活。下面分享下脚本内容：

checkBitAttack.pl

#!/usr/bin/perl
# 1. Get Attack Objects
my @attackObjects = `sqlplus -sL / as sysdba <<"EOF"
SET LINES 100 PAGES 10 HEAD ON FEEDBACK OFF AUTOT OFF TI OFF TIMI OFF
COL OWNER FOR A20
COL OBJECT_NAME FOR A40
COL OBJECT_TYPE FOR A10
SELECT OWNER
 , "||OBJECT_NAME||" OBJECT_NAME
 ,OBJECT_TYPE
 ,TO_CHAR(CREATED, YYYY-MM-DD HH24:MI:SS) CREATED
 FROM DBA_OBJECTS
 WHERE OBJECT_NAME LIKE DBMS_CORE_INTERNA%
 OR OBJECT_NAME LIKE DBMS_SYSTEM_INTERNA%
 OR OBJECT_NAME LIKE DBMS_SUPPORT_INTERNA%;
EXIT
EOF
`;
my @attackObjectsCMD = `sqlplus -sL / as sysdba <<"EOF"
SET LINES 100 PAGES 10 HEAD OFF FEEDBACK OFF AUTOT OFF TI OFF TIMI OFF
SELECT  DROP ||OBJECT_TYPE|| "||OWNER||"."||OBJECT_NAME||"; OBJECT_NAME
 FROM DBA_OBJECTS
 WHERE OBJECT_NAME LIKE DBMS_CORE_INTERNA%
 OR OBJECT_NAME LIKE DBMS_SYSTEM_INTERNA%
 OR OBJECT_NAME LIKE DBMS_SUPPORT_INTERNA%;
EXIT
EOF
`;
# 2. Get Attack Job
my @attackJob = `sqlplus -sL / as sysdba <<"EOF"
SET LINES 100 PAGES 10 HEAD ON FEEDBACK OFF AUTOT OFF TI OFF TIMI OFF
SET LINE 120
COL LOG_USER FOR A20
COL WHAT FOR A60
SELECT JOB, LOG_USER, WHAT
 FROM DBA_JOBS
 WHERE WHAT LIKE DBMS_STANDARD_FUN9% ;
EXIT
EOF
`;
# 2. Get Attack Job
my @attackJobCMD = `sqlplus -sL / as sysdba <<"EOF"
SET LINES 100 PAGES 10 HEAD OFF FEEDBACK OFF AUTOT OFF TI OFF TIMI OFF
SELECT  -- Logon with ||LOG_USER||CHR(10)|| EXEC DBMS_JOB.BROKEN (||JOB||, TRUE)||CHR(10)|| EXEC DBMS_JOB.REMOVE(||JOB||) STMT
 FROM DBA_JOBS
 WHERE WHAT LIKE DBMS_STANDARD_FUN9% ;
EXIT
EOF
`;
# 3. Get Attack ORACHK
my @attackORACHK = `sqlplus -sL / as sysdba <<"EOF"
SET LINES 100 PAGES 10 HEAD ON FEEDBACK OFF AUTOT OFF TI OFF TIMI OFF
COL OWNER FOR A20
COL OBJECT_NAME FOR A40
COL OBJECT_TYPE FOR A10
SELECT OWNER,"||OBJECT_NAME||" OBJECT_NAME,OBJECT_TYPE,CREATED
 FROM DBA_OBJECTS
 WHERE OBJECT_NAME LIKE ORACHK%;
EXIT
EOF
`;
# 4. Show Result
if(defined $attackObjects[2] or defined $attackJob[2])
{
 print "\n[Attacked] Your Database bas been Attacked !\n";
 # Show Objects
 print "\n1. DB Objects May Have Problems\n";
 print "-- =====================================================================\n";
 if(defined $attackObjects[2])
 {
 print "@attackObjects\nSolutions:@attackObjectsCMD\n";
 print "*** Operations above please do with professional engineer !!!\n";
 }
 else
 {
 print " No Abnormal Objects Found\n";
 }
 # Show Jobs
 print "\n2. DB Job May Have Problems\n";
 print "-- =====================================================================\n";
 if(defined $attackJob[2])
 {
 print "@attackJob\nSolutions:@attackJobCMD\n";
 print "*** Operations above please do with professional engineer !!!\n";
 }
 else
 {
 print " No Abnormal Job Found\n";
 }
 # Show ORACHK
 print "\n3. Table ORACHK may bave Problems\n";
 print "-- =====================================================================\n";
 if(defined $attackORACHK[2])
 {
 print "@attackORACHK\n";
 }
 else
 {
 print " No Abnormal ORACHK Table Found\n";
 }
}
else
{
 print "\n[ Safe] Your Database has not been Attacked !\n";
}
print "\n****************************************************\n";
print "\nContact me：\n";
print " Mobile: 18825144300\n";
print " Email : [email protected]\n";
print "\n************ Copyright @ HWB ******************\n";