Wannan hunturu, ko kuma a maimakon haka, a daya daga cikin ranakun tsakanin Kirsimeti na Katolika da Sabuwar Shekara, injiniyoyin fasaha na Veeam sun shagaltu da ayyuka da ba a saba gani ba: suna farautar gungun masu satar bayanai da ake kira "Veeamonymous".

Ya faɗi yadda mutanen da kansu suka fito da kuma aiwatar da ainihin nema a cikin aikinsu, tare da ayyuka "kusa da yaƙi" Kirill Stetsko, Injiniya Escalation.

- Me ya sa ma ka fara wannan?

- Kamar yadda mutane suka zo da Linux a lokaci guda - kawai don nishaɗi, don jin daɗin kansu.

Muna son motsi, kuma a lokaci guda muna son yin wani abu mai amfani, wani abu mai ban sha'awa. Bugu da kari ya zama dole a ba wa injiniyoyi natsuwa daga aikinsu na yau da kullun.

- Wanene ya ba da shawarar wannan? Wanene ra'ayin?

- Manufar ita ce manajan mu Katya Egorova, sa'an nan kuma an haifi ra'ayi da duk ƙarin ra'ayoyin ta hanyar haɗin gwiwa. Da farko mun yi tunanin yin hackathon. Amma yayin haɓakar ra'ayi, ra'ayin ya girma zuwa nema; bayan haka, injiniyan tallafi na fasaha wani nau'in aiki ne na daban fiye da shirye-shirye.

Don haka, mun kira abokai, abokan aiki, abokai, mutane daban-daban sun taimaka mana da ra'ayi - mutum ɗaya daga T2 (layi na biyu na goyon baya shine bayanin kula edita), mutum ɗaya tare da T3, wasu mutane biyu daga ƙungiyar SWAT (ƙungiyar amsawa cikin gaggawa don lokuta na gaggawa musamman - bayanin kula edita). Mu duka muka taru, muka zauna muka yi kokarin samar da ayyuka don neman mu.

— Ba zato ba tsammani na koyi game da wannan duka, domin a iya sanina, ƙwararrun mawallafin allo ne ke yin aikin injina, wato, ba wai kawai kun yi fama da irin wannan abu mai sarƙaƙiya ba, har ma dangane da aikinku. , zuwa fagen aikin ku na ƙwararru.

- Ee, muna so mu sanya shi ba kawai nishaɗi ba, amma don "ɗauka" ƙwarewar fasaha na injiniyoyi. Ɗaya daga cikin ayyukan da ke cikin sashenmu shine musayar ilimi da horarwa, amma irin wannan nema shine kyakkyawar dama don barin mutane su "taba" wasu sababbin fasahohi don rayuwarsu.

- Ta yaya kuka fito da ayyuka?

- Mun yi zaman tunani. Muna da fahimtar cewa dole ne mu yi wasu gwaje-gwaje na fasaha, kuma irin su za su kasance masu ban sha'awa kuma a lokaci guda suna kawo sabon ilimi.
Misali, mun yi tunanin cewa ya kamata mutane su gwada zirga-zirgar ababen hawa, ta amfani da masu gyara hex, yin wani abu don Linux, wasu abubuwa masu zurfi da suka shafi samfuranmu (Veeam Backup & Replication da sauransu).

Har ila yau, ra'ayin ya kasance muhimmin sashi. Mun yanke shawarar gina kan jigon masu satar bayanai, samun damar shiga ba tare da saninsu ba da yanayin sirri. An yi abin rufe fuska na Guy Fawkes ya zama alama, kuma sunan ya zo ta halitta - Veeamonymous.

"Tun farko akwai kalmar"

Don tada sha'awa, mun yanke shawarar shirya kamfen na PR mai taken nema kafin taron: mun rataye fosta tare da sanarwa a kusa da ofishinmu. Bayan 'yan kwanaki kuma, a asirce daga kowa, sun zana musu fenti da gwangwani, suka fara "duck", sun ce wasu maharan sun lalata hotunan, har ma sun haɗa hoto tare da hujja ....

- Don haka kun yi da kanku, wato, ƙungiyar masu shiryawa?!

— E, a ranar Juma’a, da misalin ƙarfe 9 na dare, da kowa ya riga ya tafi, mun je muka zana harafin “V” a kore daga balloons. sai ya tambaya wanene ya bata posters? Wani ya ɗauki wannan batu da muhimmanci kuma ya gudanar da cikakken bincike kan wannan batu.

Don neman, mun kuma rubuta fayilolin mai jiwuwa, "sauti masu tsage": alal misali, lokacin da injiniyan injiniya ya shiga cikin tsarin mu [production CRM], akwai wani robot mai amsawa wanda ya ce kowane nau'i na jimloli, lambobi ... Ga mu nan daga waɗancan kalmomin da ya rubuta, ya haɗa wasu kalmomi masu ma'ana ko žasa, da kyau, watakila ɗan karkatacciyar hanya - alal misali, mun sami "Babu abokai da za su taimake ku" a cikin fayil mai jiwuwa.

Misali, mun wakilci adireshin IP a lambar binary, kuma, ta yin amfani da waɗannan lambobi [wanda ke magana da mutum-mutumi], mun ƙara kowane irin sauti mai ban tsoro. Mun dauki bidiyon da kanmu: a cikin bidiyon muna da wani mutum zaune a cikin baƙar fata kuma yana sanye da abin rufe fuska na Guy Fawkes, amma a gaskiya babu mutum ɗaya, amma uku, saboda biyu suna tsaye a bayansa kuma suna riƙe da "backdrop" da aka yi. na bargo :).

- To, kun ruɗe, in faɗi a sarari.

- Eh, mun kama wuta. Gabaɗaya, da farko mun fito da ƙayyadaddun fasaha namu, sannan muka tsara zane-zane na adabi da wasan kwaikwayo kan batun abin da ake zargin ya faru. A cewar lamarin, mahalarta taron suna farautar gungun masu satar bayanai da ake kira "Veeamonymous". Har ila yau, ra'ayin shi ne cewa za mu, kamar yadda yake, "karya bango na 4," wato, za mu canza abubuwan da suka faru a gaskiya - mun yi fenti daga fenti, alal misali.

Ɗaya daga cikin ’yan ƙasar Turanci daga sashenmu ya taimaka mana wajen sarrafa rubutun.

- Dakata, me yasa mai magana? Shin kun yi duka da Ingilishi kuma?!

- Ee, mun yi shi don ofisoshin St. Petersburg da Bucharest, don haka duk abin da yake cikin Turanci.

Don gwaninta na farko mun yi ƙoƙari mu sa komai ya yi aiki kawai, don haka rubutun ya kasance madaidaiciya kuma mai sauƙi. Mun ƙara ƙarin kewaye: rubutun sirri, lambobin, hotuna.

Mun kuma yi amfani da memes: akwai tarin hotuna kan batutuwan bincike, UFOs, wasu shahararrun labarun ban tsoro - wasu ƙungiyoyi sun shagala da wannan, suna ƙoƙarin nemo wasu saƙonnin ɓoye a can, suna amfani da ilimin su na steganography da sauran abubuwa ... amma, ba shakka, babu wani abu makamancin haka.

Game da ƙaya

Duk da haka, a lokacin shirye-shiryen, mun kuma fuskanci kalubalen da ba zato ba tsammani.

Mun yi gwagwarmaya sosai tare da su kuma mun warware kowane nau'in al'amurran da ba zato ba tsammani, kuma kusan mako guda kafin neman muna tunanin cewa komai ya ɓace.

Wataƙila yana da daraja faɗi kaɗan game da tushen fasaha na nema.

Anyi komai a cikin dakin binciken mu na ESXi. Muna da ƙungiyoyi 6, wanda ke nufin dole ne mu ware wuraren tafkunan albarkatu guda 6. Don haka, ga kowane ƙungiya mun tura wani tafkin daban tare da injunan kama-da-wane (IP iri ɗaya). Amma tunda duk wannan yana kan sabobin da ke kan hanyar sadarwa iri ɗaya ne, tsarin tsarin VLAN ɗinmu na yanzu bai ba mu damar keɓance na'urori a cikin tafkuna daban-daban ba. Kuma, alal misali, yayin gwajin gwaji, mun sami yanayi inda na'ura daga wannan tafkin ta haɗa da na'ura daga wani.

- Ta yaya kuka iya gyara lamarin?

- Da farko mun yi tunani na dogon lokaci, gwada kowane irin zaɓuɓɓuka tare da izini, vLANs daban don injuna. A sakamakon haka, sun yi haka - kowace ƙungiya tana ganin uwar garken Ajiyayyen Veeam ne kawai, ta hanyar da ake aiwatar da duk wani aiki na gaba, amma ba sa ganin ɓoyayyun subpool, wanda ya ƙunshi:

• injunan Windows da yawa
• Windows core uwar garken
• Injin Linux
• biyu VTL (Virtual Tepe Library)

Ana ba da duk wuraren tafki rukuni daban-daban na tashar jiragen ruwa akan maɓallan vDS da nasu VLAN masu zaman kansu. Wannan keɓewa sau biyu shine ainihin abin da ake buƙata don kawar da yiwuwar hulɗar hanyar sadarwa gaba ɗaya.

Game da jarumi

- Akwai wanda zai iya shiga cikin nema? Yaya aka kafa kungiyoyin?

- Wannan shine kwarewarmu ta farko na gudanar da irin wannan taron, kuma ikon dakin gwaje-gwajenmu ya iyakance ga ƙungiyoyi 6.

Na farko, kamar yadda na faɗa, mun gudanar da yaƙin neman zaɓe na PR: ta amfani da fosta da wasiku, mun sanar da cewa za a gudanar da bincike. Har ma muna da wasu alamu - an rufaffen kalmomi a cikin lambar binary a kan fastocin kansu. Ta wannan hanyar, mun sami mutane suna sha'awar, kuma mutane sun riga sun cimma yarjejeniya a tsakaninsu, da abokai, da abokai, kuma sun ba da haɗin kai. A sakamakon haka, mutane da yawa sun amsa fiye da yadda muke da wuraren waha, don haka dole ne mu gudanar da zaɓi: mun zo da aikin gwaji mai sauƙi kuma mun aika ga duk wanda ya amsa. Matsala ce ta hankali wacce dole ne a gaggauta magance ta.

An ba da izinin tawaga har zuwa mutane 5. Babu buƙatar kyaftin, ra'ayin shine haɗin kai, sadarwa tare da juna. Wani yana da ƙarfi, alal misali, a cikin Linux, wani yana da ƙarfi a cikin kaset (ajiyayyen zuwa kaset), kuma kowa da kowa, yana ganin aikin, zai iya saka hannun jari a cikin cikakken bayani. Kowa ya tattauna da juna kuma ya sami mafita.

- A wane lokaci wannan taron ya fara? Shin kuna da wani irin "hour X"?

— Eh, muna da takamaiman ranar da aka keɓe, mun zaɓi ta domin a sami ƙarancin aiki a sashen. A zahiri, an sanar da shugabannin ƙungiyar tun da farko cewa an gayyaci irin waɗannan ƙungiyoyin don shiga cikin neman, kuma suna buƙatar a ba su sauƙi [game da lodi] a ranar. Ya yi kama da ya kamata ya zama ƙarshen shekara, Disamba 28, Jumma'a. Muna tsammanin zai ɗauki kimanin sa'o'i 5, amma duk ƙungiyoyi sun kammala shi da sauri.

- Shin kowa yana kan kafa ɗaya, kowa yana da ayyuka iri ɗaya bisa la'akari na ainihi?

— To, i, kowane ɗayan masu tarawa sun ɗauki wasu labarai daga gogewa ta sirri. Mun san game da wani abu da wannan zai iya faruwa a gaskiya, kuma zai zama abin sha'awa ga mutum ya "ji" shi, duba, kuma ya gane shi. Sun kuma ɗauki wasu ƙarin takamaiman abubuwa - alal misali, dawo da bayanai daga kaset ɗin da suka lalace. Wasu da alamu, amma yawancin ƙungiyoyi sun yi da kansu.

Ko kuma ya zama dole a yi amfani da sihirin rubutun sauri - alal misali, muna da labarin cewa wasu "bam mai ma'ana" sun "yaga" ma'ajiyar juzu'i da yawa zuwa manyan fayilolin da bazuwar bishiyar, kuma ya zama dole a tattara bayanan. Kuna iya yin wannan da hannu - nemo ku kwafi [fiyiloli] ɗaya bayan ɗaya, ko kuna iya rubuta rubutun ta amfani da abin rufe fuska.

Gabaɗaya, mun yi ƙoƙarin tsayawa kan ra'ayin cewa za a iya magance matsala ɗaya ta hanyoyi daban-daban. Misali, idan kun kasance ɗan gogewa kaɗan ko kuna son ruɗewa, to zaku iya magance shi cikin sauri, amma akwai hanyar da za ku magance ta kai tsaye - amma a lokaci guda za ku ɓata lokaci mai yawa akan matsalar. Wato, kusan kowane ɗawainiya yana da mafita da yawa, kuma yana da ban sha'awa waɗanne hanyoyin ƙungiyoyin za su zaɓa. Don haka rashin daidaituwa ya kasance daidai a cikin zaɓin zaɓin mafita.

Af, matsalar Linux ta zama mafi wahala - ƙungiya ɗaya ce kawai ta magance ta, ba tare da wata alama ba.

- Za ku iya ɗaukar alamu? Kamar a cikin nema na gaske??

— Haka ne, yana yiwuwa a ɗauka, domin mun fahimci cewa mutane sun bambanta, kuma waɗanda ba su da ilimin za su iya shiga cikin ƙungiya ɗaya, don haka don kada a jinkirta nassi kuma kada mu rasa sha'awar gasa, mun yanke shawarar cewa mu zai tukwici. Don yin wannan, kowane ƙungiya ya lura da mutum daga cikin masu shirya. To, mun tabbatar da cewa babu wanda ya yi magudi.

Game da taurari

- Akwai kyaututtuka ga wadanda suka yi nasara?

- Ee, mun yi ƙoƙarin yin mafi kyawun kyaututtuka ga duka mahalarta da masu cin nasara: waɗanda suka yi nasara sun karɓi riguna masu zane tare da tambarin Veeam da jumlar rufaffen lambar hexadecimal, baki). Duk mahalarta sun sami abin rufe fuska na Guy Fawkes da jaka mai alamar alama da lambar guda.

- Wato komai ya kasance kamar a cikin nema na gaske!

"To, mun so mu yi wani abu mai sanyi, girma, kuma ina tsammanin mun yi nasara."

- Wannan gaskiya ne! Menene martani na ƙarshe na waɗanda suka shiga wannan nema? Shin kun cimma burin ku?

- Ee, da yawa sun zo daga baya kuma sun ce sun ga raunin raunin su a fili kuma suna son inganta su. Wani ya daina jin tsoron wasu fasahohi - alal misali, zubar da tubalan daga kaset da ƙoƙarin kama wani abu a can ... Wani ya gane cewa yana buƙatar inganta Linux, da sauransu. Mun yi ƙoƙari mu ba da ayyuka masu faɗi da yawa, amma ba marasa ƙanƙanta ba.

Kungiyar da ta yi nasara

"Duk wanda ya so, zai cimma shi!"

- Shin yana buƙatar ƙoƙari mai yawa daga waɗanda suka shirya aikin?

- A gaskiya eh. Amma wannan ya kasance mai yiwuwa saboda gaskiyar cewa ba mu da kwarewa wajen shirya irin waɗannan tambayoyin, irin wannan kayan aiki. (Bari mu yi ajiyar cewa wannan ba shine ainihin kayan aikin mu ba - kawai ya kamata a yi wasu ayyukan wasan.)

Abu ne mai ban sha'awa a gare mu. Da farko na yi shakka, saboda ra'ayin ya yi min sanyi sosai, ina tsammanin zai yi wuya a aiwatar. Amma mun fara yi, muka fara noma, komai ya fara cin wuta, kuma a karshe mun yi nasara. Kuma kusan babu abin rufe fuska.

Gaba daya mun shafe watanni 3. A mafi yawancin, mun zo da ra'ayi kuma mun tattauna abin da za mu iya aiwatarwa. A cikin tsari, a zahiri, wasu abubuwa sun canza, saboda mun fahimci cewa ba mu da fasahar fasaha don yin wani abu. Dole ne mu sake yin wani abu a kan hanya, amma ta hanyar da dukan faci, tarihi da hankali ba su karya ba. Mun yi ƙoƙari ba kawai don ba da jerin ayyukan fasaha ba, amma don sanya shi ya dace da labarin, don ya kasance mai daidaituwa da ma'ana. Babban aikin yana gudana na watan da ya gabata, wato, makonni 3-4 kafin ranar X.

— Don haka, ban da babban aikinku, kun ware lokaci don shiri?

— Mun yi wannan a layi daya da babban aikinmu, i.

- An sake tambayar ku don yin wannan kuma?

- Ee, muna da buƙatun da yawa don maimaitawa.

- Kai fa?

- Muna da sabbin ra'ayoyi, sabbin dabaru, muna son jawo hankalin mutane da yawa kuma mu shimfiɗa shi cikin lokaci - duka tsarin zaɓin da tsarin wasan da kansa. Gabaɗaya, an yi mana wahayi ta hanyar “Cicada” aikin, zaku iya Google - yana da kyau sosai batun IT, mutane daga ko'ina cikin duniya sun haɗu a can, suna fara zaren akan Reddit, akan dandalin tattaunawa, suna amfani da fassarori na lamba, warware tatsuniyoyi. , da duk wannan.

- Tunanin yana da kyau, kawai girmama ra'ayin da aiwatarwa, saboda yana da daraja sosai. Ina fata da gaske cewa kada ku rasa wannan wahayi kuma duk sabbin ayyukan ku ma sun yi nasara. Na gode!

— Ee, za ku iya kallon misalin aikin da ba shakka ba za ku sake amfani da shi ba?

"Ina zargin ba za mu sake amfani da kowannensu ba." Saboda haka, zan iya gaya muku game da ci gaban dukan nema.

Waƙar BonusA farkon farkon, ƴan wasa suna da sunan na'urar kama-da-wane da takaddun shaida daga vCenter. Bayan sun shiga, sai suka ga wannan injin, amma ba ta fara ba. Anan kuna buƙatar tsammani cewa wani abu ba daidai ba ne tare da fayil ɗin .vmx. Da zarar sun zazzage shi, sai su ga tambayar da ake buƙata don mataki na biyu. Mahimmanci, ya ce bayanan da Veeam Backup & Replication ke amfani da shi an ɓoye shi.
Bayan cire hanzarin, zazzage fayil ɗin .vmx baya kuma cikin nasarar kunna na'ura, sai suka ga cewa ɗaya daga cikin diski yana ɗauke da bayanan sirri na base64. Saboda haka, aikin shine a cire shi kuma a sami cikakken sabar Veeam mai aiki.

Kadan game da injin kama-da-wane wanda duk wannan ke faruwa. Kamar yadda muke tunawa, bisa ga makircin, babban abin da ake nema shine mutum mai duhu kuma yana yin wani abu wanda ba shi da doka sosai. Don haka, ya kamata kwamfutar aikinsa ta kasance da kamannin kama-da-wane, wanda dole ne mu ƙirƙira, duk da cewa Windows ce. Abu na farko da muka yi shine ƙara abubuwa da yawa, kamar bayanai akan manyan hacks, hare-haren DDoS, da makamantansu. Daga nan sai suka shigar da duk software na yau da kullun kuma sun sanya juji daban-daban, fayiloli tare da hashes, da sauransu. Komai kamar a cikin fina-finai ne. Daga cikin wasu abubuwa, akwai manyan fayiloli masu suna rufaffiyar akwati *** da buɗaɗɗen akwati ***
Don ci gaba da ci gaba, 'yan wasa suna buƙatar dawo da alamu daga fayilolin madadin.

Anan dole ne a ce a farkon 'yan wasan an ba su bayanai kaɗan, kuma sun karɓi mafi yawan bayanai (kamar IP, login da kalmomin shiga) yayin aikin nema, gano alamu a madadin ajiya ko fayilolin da aka warwatse akan na'urori. . Da farko, fayilolin ajiyar suna kan ma'adanar Linux, amma babban fayil ɗin da ke kan uwar garken yana ɗora tare da tuta. noexec, don haka wakilin da ke da alhakin dawo da fayil ba zai iya farawa ba.

Ta hanyar gyara ma'ajiyar, mahalarta suna samun damar yin amfani da duk abun ciki kuma a ƙarshe za su iya dawo da kowane bayani. Ya rage don fahimtar wane ne. Kuma don yin wannan, kawai suna buƙatar nazarin fayilolin da aka adana akan wannan na'ura, ƙayyade wanene daga cikinsu ya "karye" da abin da ya kamata a mayar da shi.

A wannan gaba, yanayin yanayin ya ƙaura daga ilimin IT na gabaɗaya zuwa takamaiman fasali na Veeam.

A cikin wannan misali na musamman (lokacin da kuka san sunan fayil, amma ba ku san inda za ku nema ba), kuna buƙatar amfani da aikin bincike a cikin Manajan Kasuwanci, da sauransu. Sakamakon haka, bayan maido da dukkan sarkar ma'ana, 'yan wasan suna da wata hanyar shiga/kalmar sirri da fitowar taswira. Wannan yana kawo su zuwa uwar garken Windows Core, kuma ta hanyar RDP (don kada rayuwa ta zama kamar zuma).

Babban fasalin wannan uwar garken: tare da taimakon rubutu mai sauƙi da ƙamus da yawa, an kafa tsarin manyan fayiloli da fayiloli marasa ma'ana. Kuma idan kun shiga, za ku sami saƙon maraba kamar "Bam ɗin tunani ya fashe a nan, don haka dole ne ku tattara alamun don ƙarin matakai."

An raba alamar mai zuwa zuwa rumbun adana juzu'i da yawa (guda 40-50) kuma an rarraba bazuwar tsakanin waɗannan manyan fayiloli. Tunaninmu shi ne ya kamata 'yan wasa su nuna basirarsu wajen rubuta sauƙaƙan rubutun PowerShell don haɗa tarin tarin tarin yawa ta amfani da sanannen abin rufe fuska da samun bayanan da ake buƙata. (Amma ya zama kamar a cikin wannan barkwanci - wasu batutuwa sun zama ci gaba na jiki ba tare da sabawa ba.)

Rumbun yana ƙunshe da hoton kaset (tare da rubutun "Bukin Ƙarshe - Mafi kyawun lokuta"), wanda ya ba da alamar amfani da ɗakin karatu na kaset, wanda ya ƙunshi kaset mai irin wannan suna. Matsala ɗaya ce kawai - ta zama ba za ta iya aiki ba har ma ba a ƙididdige ta ba. Wannan shine inda mai yiwuwa mafi girman ɓangaren neman ya fara. Mun goge taken daga kaset, don haka don dawo da bayanai daga gare ta, kawai kuna buƙatar zubar da tubalan “raw” kuma ku duba ta cikin editan hex don nemo alamun fara fayil.
Mun sami alamar, duba abin biya, ninka toshe ta girmansa, ƙara haɓakawa kuma, ta amfani da kayan aiki na ciki, yi ƙoƙarin dawo da fayil ɗin daga wani ƙayyadadden toshe. Idan an yi komai daidai kuma lissafin ya yarda, to, 'yan wasan za su sami fayil ɗin .wav a hannunsu.

A ciki, ta yin amfani da janareta na murya, a tsakanin sauran abubuwa, ana yin la'akari da lambar binary, wanda aka fadada zuwa wani IP.

Wannan, ya bayyana, sabon uwar garken Windows ne, inda komai ya nuna bukatar amfani da Wireshark, amma babu shi. Babban abin zamba shine cewa akwai tsarin guda biyu da aka shigar akan wannan injin - kawai diski daga na biyu an cire shi ta hanyar mai sarrafa na'urar a layi, kuma sarkar ma'ana tana kaiwa ga buƙatar sake kunnawa. Sa'an nan kuma ya zama cewa ta tsohuwa wani tsarin daban-daban, inda aka shigar da Wireshark, ya kamata ya yi boot. Kuma duk wannan lokacin muna kan OS na biyu.

Babu buƙatar yin wani abu na musamman a nan, kawai ba da damar kamawa a kan keɓaɓɓiyar dubawa ɗaya. Binciken da aka yi kusa da juji yana nuna fakitin hannun hagu a sarari da aka aika daga injin taimako a lokaci-lokaci, wanda ya ƙunshi hanyar haɗi zuwa bidiyon YouTube inda aka nemi 'yan wasa su kira takamaiman lamba. Mai kira na farko zai ji taya murna a wuri na farko, sauran za su sami gayyata zuwa HR (joke)).

Af, mun bude ayyuka ga injiniyoyin tallafin fasaha da masu horarwa. Barka da zuwa tawagar!

source: www.habr.com