{"id":153,"date":"2015-12-23T14:10:26","date_gmt":"2015-12-23T06:10:26","guid":{"rendered":"http:\/\/blog.md5.red\/?p=153"},"modified":"2015-12-24T01:42:50","modified_gmt":"2015-12-23T17:42:50","slug":"mac-osx%e8%bf%9b%e5%85%a5%e5%8d%95%e7%94%a8%e6%88%b7%e6%a8%a1%e5%bc%8f","status":"publish","type":"post","link":"https:\/\/blog.md5.red\/?p=153","title":{"rendered":"Mac OSX\u8fdb\u5165\u5355\u7528\u6237\u6a21\u5f0f"},"content":{"rendered":"<p><a href=\"http:\/\/blog.md5.red\/wp-content\/uploads\/2015\/12\/singleusermode.png\" class=\"highslide-image\" onclick=\"return hs.expand(this);\" rel=\"attachment wp-att-157\"><img decoding=\"async\" class=\"alignnone wp-image-157 size-full\" src=\"http:\/\/blog.md5.red\/wp-content\/uploads\/2015\/12\/singleusermode.png\" alt=\"singleusermode\" width=\"778\" height=\"429\" srcset=\"https:\/\/blog.md5.red\/wp-content\/uploads\/2015\/12\/singleusermode.png 778w, https:\/\/blog.md5.red\/wp-content\/uploads\/2015\/12\/singleusermode-300x165.png 300w, https:\/\/blog.md5.red\/wp-content\/uploads\/2015\/12\/singleusermode-768x423.png 768w\" sizes=\"(max-width: 778px) 100vw, 778px\" \/><\/a><\/p>\n<p>Mac OSX\u8fdb\u5165\u5355\u7528\u6237\u6a21\u5f0f\u540e\u662froot\u6743\u9650\uff0c\u53ef\u4ee5\u6267\u884c\u4e00\u4e9b\u5217\u9ad8\u6743\u9650\u64cd\u4f5c\uff0c\u5305\u62ec\u4fee\u6539\u5bc6\u7801\uff0c\u690d\u5165rootkit\u7b49\u3002<\/p>\n<p>&nbsp;<\/p>\n<p>\u4fee\u6539\u5bc6\u7801\uff1a<\/p>\n<p>1\u3001\u5f00\u673a\u6309Command+S\u8fdb\u5165\u5355\u7528\u6237\u6a21\u5f0f<\/p>\n<p>2\u3001\u68c0\u67e5\u78c1\u76d8 \/sbin\/fsck -fy\u00a0 \u663e\u793aThe volume (name_of_volume) appears to be OK<\/p>\n<p>3\u3001\u52a0\u8f7d\u78c1\u76d8 \/sbin\/mount -uw \/<\/p>\n<p>4\u3001\u4fee\u6539\u7528\u6237\u5bc6\u7801 passwd username (\u4e0d\u80fd\u76f4\u63a5\u4fee\u6539root\u5bc6\u7801)<\/p>\n<p>\u5982\u679c\u9700\u8981\u4fee\u6539root\u5bc6\u7801\uff0c\u8fdb\u5165\u7cfb\u7edf\u540e\u518d\u7ec8\u7aef\u8f93\u5165sudo passwd root<\/p>\n<p>&nbsp;<\/p>\n<p>\u690d\u5165rootkit\uff1a<\/p>\n<p>\u5f00\u673a\u6309Command+s\u8fdb\u5165single user\u6a21\u5f0f<\/p>\n<p>1\u3001\/sbin\/fsck \u2013fy<\/p>\n<p>2\u3001\/sbin\/mount \u2013uw \/<\/p>\n<p>3\u3001ls \/dev\/disk*<\/p>\n<p>4\u3001\u63d2\u5165U\u76d8<\/p>\n<p>5\u3001ls \/dev\/disk*\u00a0 \u4f1a\u591a\u51fadisk\u76d8<\/p>\n<p>6\u3001mount_msdos \/dev\/disk1s1\u00a0\/tmp\u00a0 U\u76d8\u4e3aFAT\u683c\u5f0f\uff0c\u52a0\u8f7d\u591a\u51fa\u6765\u7684\u540e\u9762\u7684\u90a3\u4e2a\u76d8\uff0c\u6302\u8f7d\u5230\u4efb\u610f\u6587\u4ef6\u5939\u4e0b\u6bd4\u5982\/tmp\uff08\u5982\u679cU\u76d8\u662fNTFS\u683c\u5f0f\u6539\u4e3amount_ntfs\uff09<\/p>\n<p>7\u3001\u5207\u6362\u5230\/tmp\u6587\u4ef6\u5939\u4e0bcd \/tmp \u8fd0\u884c\u7a0b\u5e8f \u6267\u884c.\/xxx_rootkit<\/p>\n<p>9\u3001reboot<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mac OSX\u8fdb\u5165\u5355\u7528\u6237\u6a21\u5f0f\u540e\u662froot\u6743\u9650\uff0c\u53ef\u4ee5\u6267\u884c\u4e00\u4e9b\u5217\u9ad8\u6743\u9650\u64cd\u4f5c\uff0c\u5305\u62ec\u4fee\u6539\u5bc6\u7801\uff0c\u690d\u5165rootkit\u7b49\u3002  ...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[18,36],"class_list":["post-153","post","type-post","status-publish","format-standard","hentry","category-1","tag-osx","tag-36"],"_links":{"self":[{"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=153"}],"version-history":[{"count":4,"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/153\/revisions"}],"predecessor-version":[{"id":188,"href":"https:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/153\/revisions\/188"}],"wp:attachment":[{"href":"https:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}