个人博客：https://www.islandlxl.com（MySQL被黑，勒索）

islandlxl

昨天晚上写了博客，在11点左右还能登陆，在今天早上就不能登陆了500
报错信息如下

Caused by: java.sql.SQLSyntaxErrorException: Unknown database 'halodb'
	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:120) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:97) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:122) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:827) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:447) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:237) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:199) ~[mysql-connector-java-8.0.17.jar!/:8.0.17]
	at com.zaxxer.hikari.util.DriverDataSource.getConnection(DriverDataSource.java:136) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.pool.PoolBase.newConnection(PoolBase.java:369) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.pool.PoolBase.newPoolEntry(PoolBase.java:198) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.pool.HikariPool.createPoolEntry(HikariPool.java:467) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.pool.HikariPool.checkFailFast(HikariPool.java:541) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.pool.HikariPool.<init>(HikariPool.java:115) ~[HikariCP-3.2.0.jar!/:na]
	at com.zaxxer.hikari.HikariDataSource.getConnection(HikariDataSource.java:112) ~[HikariCP-3.2.0.jar!/:na]
	at org.springframework.jdbc.datasource.DataSourceUtils.fetchConnection(DataSourceUtils.java:157) ~[spring-jdbc-5.1.9.RELEASE.jar!/:5.1.9.RELEASE]
	at org.springframework.jdbc.datasource.DataSourceUtils.doGetConnection(DataSourceUtils.java:115) ~[spring-jdbc-5.1.9.RELEASE.jar!/:5.1.9.RELEASE]
	at org.springframework.jdbc.datasource.DataSourceUtils.getConnection(DataSourceUtils.java:78) ~[spring-jdbc-5.1.9.RELEASE.jar!/:5.1.9.RELEASE]
	... 131 common frames omitted

没有数据库，查看一下，确实没有halodb这个库，但是之前是创建好的，为什么一夜之间就没了呢？

johnniang

islandlxl 确定你的 MySQL 正常运行

Ryan Wang 🚀

这个异常只会在启动的时候发生吧。

提供一下你部署的详细信息，一般来说应用没有权限删除数据库。

islandlxl

johnniang mysql运行正常，但是在库中新增了一条黑客勒索记录

To recover your lost Database send 0.03 Bitcoin (BTC) to our Bitcoin address: 
1C4QpRZRYaBscz9VGZgiLR5gmG1LCW8niA 

After this, contact us by email with your Server IP or Domain Name and a Proof of Payment (Payment ID). 

Your Database is downloaded and backed up on our servers. 

Backups that we have right now: 
- halodb 
- jeeplus_schema_dev  

Any email without your server IP Address or Domain Name and a Proof of Payment together will be ignored. 
If we dont receive your payment in the next 10 Days, we will delete  or leak your sensitive information. | 1C4QpRZRYaBscz9VGZgiLR5gmG1LCW8niA | backupsql33@protonmail.com |

Ryan Wang 🚀

islandlxl what？那既然这样，建议用 h2吧

islandlxl

但是caddy每次重启都失败

[0m caddy.service - Caddy HTTP/2 web server
   Loaded: loaded (/usr/lib/systemd/system/caddy.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Tue 2020-01-21 18:10:44 CST; 10min ago
     Docs: https://caddyserver.com/docs
  Process: 4553 ExecStart=/usr/bin/caddy -conf /etc/caddy/caddy.conf -root /tmp -agree (code=exited, status=1/FAILURE)
  Process: 4549 ExecStartPre=/usr/bin/caddy -conf /etc/caddy/caddy.conf -validate (code=exited, status=0/SUCCESS)
 Main PID: 4553 (code=exited, status=1/FAILURE)

Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz systemd[1]: Starting Caddy HTTP/2 web server...
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz systemd[1]: Started Caddy HTTP/2 web server.
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz caddy[4553]: Activating privacy features... done.
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz caddy[4553]: 2020/01/21 18:10:44 Listen: listen tcp :80: bind: address already in use
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz systemd[1]: caddy.service: main process exited, code=exited, status=1/FAILURE
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz systemd[1]: Unit caddy.service entered failed state.
Jan 21 18:10:44 izwz92ujq5zpxw3v4vxv5vz systemd[1]: caddy.service failed.

Ryan Wang 🚀

islandlxl 这是80被占用了，检查一下还有哪个应用在用80端口

johnniang

不建议给对方汇款

islandlxl

johnniang 我的博客本身是用于学习的而且服务器的配置也比较低，还没有什么比较有价值的数据😂

islandlxl

Ryan Wang 🚀 好的

islandlxl

Ryan Wang 🚀 解决了是nginx不知道为什么是启动状态

Ryan Wang 🚀

islandlxl h2 默认禁用远程登陆，所以还是比较安全。

CodeLunatic

也许不是MySQL远程登录的问题，难道是服务器上面运行的哪个程序有了SQL注入？这样的骚操作SQLMap就可以做到，看到这个帖子心咯噔了一下。