服务器遭受CC攻击怎么搞?



  • 服务器遭受CC攻击怎么搞?

    今天上午,应急的时候遇到了一个客户服务器疑似遭受了CC攻击,空余就把CC整理一下
    netstat -ano 输出的结果

    tcp        0      0 192.168.5.135:80        182.140.227.21:43779    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:59421      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.7:20910      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:54850      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:52886      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.7:21813      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:13540      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:62526      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:5207      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:58612      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:8786       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:52899      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.18:20206    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:1087       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.17:16603    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:63105      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:63413      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.16:52527    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        61.160.224.7:5654       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:7029       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.23:56996     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:58080     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:49741      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:64320      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:64792      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.12:51689       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:58154      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:54846      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        42.81.56.4:27775        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:44557      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:49729      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.18:44392    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:1244       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:50512      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:57368     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:61796     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:48745      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:45109      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:2962      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:59698      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:47941      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:1106      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:56325      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.7:12980      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:2209       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:47685      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:2430      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:14599      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:49754      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:55882     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:47634      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:33798      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:40079      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:4559       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.16:8592     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:13874      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:1502       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:5526       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:63767      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:14756      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.16:51491    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:48293      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:2469      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:4796       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:59033     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.17:49584      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.10:2949        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:1513      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.17:20606    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:5016       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:60322      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:55176      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:59815      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:64584      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:46841      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        61.160.224.7:3992       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.22:32405    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.8:27289      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:59362      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:41501      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.11:4843        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:13238      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.8:31606        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.17:45563    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:42254      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:54195      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:52433      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.8:36198      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:62171      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:4284       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.17:51083    TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:48035      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:4635       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:60319     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:56036     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        42.81.56.5:63546        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.16:5320     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:4104       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.18:23095     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.12:62943       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:64311     TIME_WAIT  
    tcp        0      0 192.168.5.135:56058     192.168.5.5:443         TIME_WAIT  
    tcp        0      0 192.168.5.135:80        61.160.224.7:1708       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:53950      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:8268      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.11:6398        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:4879      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:13050      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:4163       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:50122      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:1077      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:6258       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:13321      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:56809      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:50840      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:55262      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:49726      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:43949      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:54122      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.7:21791      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:8259       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.8:37328        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        123.6.13.8:39406        TIME_WAIT  
    tcp        0      0 192.168.5.135:80        117.107.128.162:14695   TIME_WAIT  
    tcp        0      0 192.168.5.135:80        61.160.224.10:61538     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.21:31853      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:46326      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:60789      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:11682      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:57665      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:57883     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.18:2997       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.8:43486      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:58618     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:56408      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        182.140.227.16:52196    ESTABLISHED
    tcp        0      0 192.168.5.135:80        112.25.60.15:7527       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:3689       TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:61110     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        61.240.144.25:39293     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:40076      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.8:34250      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        112.25.60.15:42872      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        120.199.93.9:53934      TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:55362     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:57328     TIME_WAIT  
    tcp        0      0 192.168.5.135:80        221.204.18.16:64976     TIME_WAIT  
    

    解决:

    思路很简单,让服务器尽快的收回浪费的TIME_WAIT资源,让服务器尽快重用TIME_WAIT资源

    WIndows服务器遭受CC攻击判别方法:

    1.遭受CC攻击时web服务器会出现80端口对外关闭现象
    netstat -ano如果出现大量SYN_RECEEIVED 或者TIME_WAIT那么大概率事件服务器就是cc攻击了表明无法建立握手应答处于等待状态
    2.我们可以通过写一个批处理的脚本来判断服务器是不是处于cc攻击的状态
    比如说:

    echo off time /t >>log.log
    netstat -n -p tcp lfind “:80”>>Log.log notepad log.log
    exit
    

    脚本大概意思就是筛选当前所有ddos到80端口的外来链接
    嫌麻烦直接netstat -ano|findstr “80” > c:\log.log
    3.直接看web日志,路径在C:WINDOWSsystem32LogFilesHTTPERR目录下会有类似httperr1.log啥啥的日志文件,可能存在很多日志,可以根据日志时间什么的判断,一般默认web日志记录的ddos攻击软件项并不多,我们可以建议用户通过.iis配置,让web日志记录更多
    大概操作时这样:

    开始→管理工具”打开“Internet信息服务器”,展开左侧的DDOS攻击软件项定位到到相应的DDOS攻击软件Web站点, 
    然后右键点击选择“属性”打开站点属性窗口,在“网站”选项卡下点击“属性”按钮,在“日志记录属 性”窗口的DDOS攻击软件“高级”选项卡下可以勾选相应的DDOS攻击软件“扩展属性”,以便让Web日志进行记录。 比如其中的DDOS攻击软件“发送的DDOS攻击软件字节数”、“接收的DDOS攻击软件字节数”、“所用时间 ”这三项默认是没有选中的DDOS攻击软件,但在记录判断CC攻击中是非常有用的DDOS攻击软件,可以勾选。如果你对安全的DDOS攻击软件要求比较高,可以在“常规”选项卡下对“新日志计划”进行设置,让其“每小时 ”或者“每一天”进行记录。为了便于日后进行分析时好确定时间可以勾选“文件命名和创建使用当地时间” 
    

    Linux服务器判别方法:

    1.tcpdump
    a. 通过tcpdump -s0 -A -n -i any | grep -o -E '(GET|POST|HEAD) .*'判断,一般都属输出一些静态文件比如说css,js啥啥的,如果出现差不多固定的地址或者非常奇怪的地址,多半就是被攻击了
    b:通过tcpdump -s0 -A -n -i any | grep ^User-Agent判断,不同用户正常访问是可以通过useragent看出来的,但你看到很多固定的useragent输出,那一定是被攻击了
    😄 如果你服上有很多网站,你可以用tcpdump -s0 -A -n -i any | grep ^Host来输出那个网站正在被疯狂请求
    2.netstat
    a.通过netstat -nat|grep -i “80”|wc -l来查看80端口的连接数
    b.通过netstat -ntu | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n对ip连接数进行排序
    b. 通过netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n 判断,IP前面的数字时链接书,正常网站几十到一百都算正常,但出现几千,那大概率事件就是肯定cc攻击了
    如果你服的httpd服务被疯狂的c了,那么你可以通过设置一些参数让服务器主动断开与客户服务端连接,为毛?因为他猫了个咪的你不断开,就会导致更多资源被阻塞
    修改/etc/sysctl.conf文件,添加:

    net.ipv4.tcp+syncookies = 1 //开启SYN_Coolies
    net.ipv4 tw_recycle =1 //让time_wait可以重用
    net.ipv4.tcp_fin_timeout =30 //默认的超时时间
    

    先写这么多,以后遇到,在来总结


Log in to reply