yulong-hids-archived
yulong-hids-archived copied to clipboard
[archived] 一款实验性质的主机入侵检测系统
# Ring0驱动宽字符(中文)处理问题 ### 经过驱动调试发现,宽字符在驱动中Dbgview正常输出,在用户态C程序中无法输出中文字符,造成Ring3下C程序漏报
Fix agent memory leaks.
在kali上安装 root@kali:/tmp# ./daemon -install -netloc 192.168.84.161:443 2018/05/14 15:40:37 Download Agent 2018/05/14 15:40:46 Install agent error: Agent Download Error root@kali:/tmp# wget -O /tmp/daemon https://192.168.84.161/json/download?type=daemon\&system=linux\&platform=64\&action=download;chmod +x /tmp/daemon;/tmp/daemon -install -netloc 192.168.84.161:443 --2018-05-14 16:49:05--...
kernel版本 3.10.0-693.21.1.el7.x86_64 运行的命令 insmod syshook_3.10.0-693.ko 可稳定复现 ![image](https://user-images.githubusercontent.com/2731416/38298733-c55588a6-382a-11e8-9adc-eb88f7b9fcb3.png)
![tim 20190228113929](https://user-images.githubusercontent.com/5073720/53539736-bf543c00-3b4d-11e9-9ca1-9073ae80f538.png) ![tim 20190228114054](https://user-images.githubusercontent.com/5073720/53539737-c0856900-3b4d-11e9-8b14-ad7c4cb016bb.png)
server端是内网IP,通过NAT映射公网,agent为公网,连接过来的时候,debug查看,获取到的Available server node 为server的内网IP,这个是否可配置,支持nat映射!
debian9 GCE环境 cat /boot/config-`uname -r` | grep CONFIG_RETPOLINE CONFIG_RETPOLINE=y gcc-6 (6.3.0-18+deb9u1) uname -r 4.9.0-6-amd64 insmod syshook_execve.ko 加载之后执行任意命令都返回 killed
The previous installation is less standard. MongoDB and ELK have their own software repositories on each popular Linux distribution. So it' simple and convenient to install these dependencies from official...
agent在某一时段会dir /proc并发读取打开过高,引起内存异常报警,持续大概5-10分钟左右,根据zabbix监控瞬间占用达3.5个G,应该怎么限制同时读取的并发或者限制agent使用最大使用内存?