회사 홈페이지가 해킹당했다(개발자ver.) - 그누보드 게시판 해킹대응 기록

ps aux | grep -E 'httpd|apache|nginx' | grep -v grep

cd /사이트경로

cat > _maintenance.php << 'EOF'
<?php
$key = 'CHANGE-ME-난수문자열';
if (isset($_GET['unlock']) && $_GET['unlock'] === $key) {
    setcookie('site_pass', $key, time()+60*60*24*30, '/');
    header('Location: /'); exit;
}
if (isset($_COOKIE['site_pass']) && $_COOKIE['site_pass'] === $key) { return; }
header('HTTP/1.1 503 Service Unavailable');
header('Retry-After: 86400');
header('Content-Type: text/html; charset=utf-8');
exit('<h1>홈페이지 점검 중입니다</h1>');
EOF

echo 'auto_prepend_file = /사이트경로/_maintenance.php' > .user.ini
chmod 644 _maintenance.php .user.ini

rm /사이트경로/.user.ini /사이트경로/_maintenance.php

# 용량 확인
du -sh /사이트경로
df -h ~

# 파일 (백그라운드, SSH 끊겨도 계속)
nohup tar -czf ~/backup_$(date +%Y%m%d).tar.gz -C /상위경로 사이트폴더 > ~/backup.log 2>&1 &

# DB 접속 정보 (그누보드5는 대문자 상수)
grep -i mysql /사이트경로/data/dbconfig.php

# DB
mysqldump -u계정 -p DB명 > ~/db_$(date +%Y%m%d).sql

tail -3 ~/db_20260813.sql          # "-- Dump completed on" 이 있어야 정상
grep -c "CREATE TABLE" ~/db_20260813.sql   # 그누보드는 30~50개

# 1. 업로드 폴더 내 실행 파일 — 정상이면 거의 안 나온다
find /사이트경로/data -type f \( -name "*.php*" -o -name "*.phtml" -o -name "*.inc" \) 2>/dev/null

# 2. 최근 변경된 PHP
find /사이트경로 -name "*.php" -mtime -180 -printf '%TY-%Tm-%Td %p\n' 2>/dev/null | sort -r | head -40

# 3. 악성 시그니처
grep -rl --include="*.php" -E "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(base64|assert\(\\\$_|shell_exec|passthru\(" /사이트경로 2>/dev/null

# 4. 이미지 폴더에 숨은 PHP 코드
grep -rl "<?php" /사이트경로/data/file 2>/dev/null

# 5. 지속성 확보 흔적
crontab -l
cat ~/.ssh/authorized_keys 2>/dev/null

SELECT table_name, ROUND(data_length/1024/1024,1) AS data_mb, table_rows
FROM information_schema.tables WHERE table_schema='DB명'
ORDER BY data_length DESC LIMIT 15;

SELECT bo_table, bo_subject, bo_write_level, bo_use_captcha, bo_count_write
FROM g5_board ORDER BY bo_count_write DESC;

qa      | 이거 안 써요        | write_level 1 | captcha 0 | 615,094
people  | 함께하는 사람들     | write_level 1 | captcha 0 |      44
email   | 이것도 지워도 되나요 | write_level 1 | captcha 0 |    -531

SELECT DATE_FORMAT(wr_datetime,'%Y-%m') AS ym, COUNT(*) FROM g5_write_qa GROUP BY ym ORDER BY ym;
SELECT mb_id, COUNT(*) AS cnt FROM g5_write_qa GROUP BY mb_id ORDER BY cnt DESC LIMIT 10;

-- 1. 보존 대상 백업
CREATE TABLE bak_qa_admin AS SELECT * FROM g5_write_qa WHERE mb_id='admin';
SELECT COUNT(*) FROM bak_qa_admin;

-- 2. 비우기 (초 단위)
TRUNCATE TABLE g5_write_qa;

-- 3. 복원
INSERT INTO g5_write_qa SELECT * FROM bak_qa_admin;

DELETE FROM g5_board_new  WHERE bo_table='qa';
DELETE FROM g5_board_file WHERE bo_table='qa';
UPDATE g5_board SET bo_count_write=5 WHERE bo_table='qa';
TRUNCATE TABLE g5_uniqid;   -- 중복방지용 임시 데이터
TRUNCATE TABLE g5_point;    -- 포인트 미사용 시

SELECT wr_id, mb_id, wr_name, wr_datetime, LEFT(wr_subject,40) FROM g5_write_people ORDER BY wr_id;
SELECT COUNT(*) FROM g5_write_people WHERE wr_id >= 47;   -- 먼저 세어본다
DELETE FROM g5_write_people WHERE wr_id >= 47;
DELETE FROM g5_board_new  WHERE bo_table='people' AND wr_id >= 47;
DELETE FROM g5_board_file WHERE bo_table='people' AND wr_id >= 47;

UPDATE g5_board SET bo_count_write =
  (SELECT COUNT(*) FROM g5_write_people WHERE wr_is_comment=0)
WHERE bo_table='people';

# 기간으로 후보 추출 후 시드 목록 확인
find /사이트경로/data/file/people -type f -newermt "2026-07-10" -printf "%f\n" \
  | sed 's/^thumb-//' | cut -d_ -f1 | sort -u

# 정상 시드가 섞이지 않았는지 검증 (0이어야 함)
find /사이트경로/data/file/people -type f -newermt "2026-07-10" \
  | grep -cE "정상시드1|정상시드2|정상시드3"

# 삭제
find /사이트경로/data/file/people -type f -newermt "2026-07-10" -delete

mkdir -p ~/removed_files
find /사이트경로/data/file/qa -type f ! -name "index.php" -exec mv {} ~/removed_files/ \;

DELETE FROM g5_member WHERE mb_id LIKE 'zx%' AND mb_name='김도현';
DELETE FROM g5_member WHERE mb_id IN ('봇계정1','봇계정2', ...);

-- 핵심
UPDATE g5_board SET bo_write_level=10, bo_use_captcha=1
WHERE bo_table IN ('qa','people','email','free');

cd /사이트경로/bbs
mv register.php register.php.disabled
mv register_form.php register_form.php.disabled

curl -s -o /dev/null -w "%{http_code}\n" "https://도메인/bbs/board.php?bo_table=qa&wr_id=12345"

<?php
if (strpos($_SERVER["SCRIPT_NAME"], "/adm/") !== false) return;
if (!isset($_GET["bo_table"])) return;
$bo = $_GET["bo_table"];
$wr = isset($_GET["wr_id"]) ? (int)$_GET["wr_id"] : 0;
$gone = ($bo === "qa") || ($bo === "people" && $wr >= 47 && $wr <= 68);
if (!$gone) return;
header("HTTP/1.1 410 Gone");
header("X-Robots-Tag: noindex");
header("Content-Type: text/html; charset=utf-8");
echo "<h1>삭제된 페이지입니다</h1>";
exit;

curl -s -o /dev/null -w "qa글: %{http_code}\n"     "https://도메인/bbs/board.php?bo_table=qa&wr_id=12345"
curl -s -o /dev/null -w "메인: %{http_code}\n"      "https://도메인/"
curl -s -o /dev/null -w "정상게시판: %{http_code}\n" "https://도메인/bbs/board.php?bo_table=people"

# 붙여넣기 사고 방지: printf로 한 줄씩
printf '%s\n' '<?php' > _gone.php
printf '%s\n' 'if (!isset($_GET["bo_table"])) return;' >> _gone.php

# 적용 전 반드시 검증
php -l _gone.php    # No syntax errors detected

# 무결성 대조 (서버)
md5sum ~/backup_20260813.tar.gz
# PowerShell
# Get-FileHash -Algorithm MD5 H:\backup\backup_20260813.tar.gz

rm ~/backup_20260813.tar.gz ~/db_20260813.sql

-- 신규 유입 확인
SELECT COUNT(*) FROM g5_write_people WHERE wr_datetime > '2026-08-14';

-- 게시판 권한 정기 점검
SELECT bo_table, bo_subject, bo_write_level, bo_use_captcha, bo_count_write FROM g5_board;

-- 신규 회원
SELECT mb_id, mb_name, mb_datetime FROM g5_member ORDER BY mb_datetime DESC LIMIT 10;

# 신규 업로드 파일
find /사이트경로/data/file -type f -newermt "2026-08-14" | wc -l