2

I got a compromised server, most likely a crypto miner or something, htop reports this:

30393 geauxsmar  20   0  5328  3984  2540 R 100.  0.1 21h26:45 [sync_supers]

I locked it with:

sudo usermod --expiredate 1 geauxsmar
sudo passwd -l geauxsmar

Killed the process yesterday, I come back next day and it's up and running at 100% CPU usage while user is locked?

Server running Apache with dozen of outdated Drupal websites (since Drupalgeddon I assume that's via what hackers got into the server, but there's zero chance to trace which site, which file, even after patching it up, they probably already left backdoors, custom files and injected the databases).

updated:

root@www1 / # ls -al /proc/30393/
total 0
dr-xr-xr-x   9 geauxsmart geauxsmart 0 Apr 29 16:09 .
dr-xr-xr-x 156 root       root       0 Apr 26 11:39 ..
dr-xr-xr-x   2 geauxsmart geauxsmart 0 May  2 08:15 attr
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 auxv
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 cgroup
--w-------   1 geauxsmart geauxsmart 0 May  2 08:15 clear_refs
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 cmdline
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 comm
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 coredump_filter
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 cpuset
lrwxrwxrwx   1 geauxsmart geauxsmart 0 May  2 08:15 cwd -> /run/shm/.FILE (deleted)
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 environ
lrwxrwxrwx   1 geauxsmart geauxsmart 0 May  2 08:15 exe -> /usr/bin/perl
dr-x------   2 geauxsmart geauxsmart 0 May  2 08:15 fd
dr-x------   2 geauxsmart geauxsmart 0 May  2 08:15 fdinfo
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 gid_map
-r--------   1 geauxsmart geauxsmart 0 May  1 07:55 io
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 limits
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 loginuid
dr-x------   2 geauxsmart geauxsmart 0 May  2 08:15 map_files
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:09 maps
-rw-------   1 geauxsmart geauxsmart 0 May  2 08:15 mem
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 mountinfo
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 mounts
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 mountstats
dr-xr-xr-x  13 geauxsmart geauxsmart 0 May  2 08:15 net
dr-x--x--x   2 geauxsmart geauxsmart 0 May  2 08:15 ns
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 numa_maps
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 oom_adj
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 oom_score
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 oom_score_adj
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 pagemap
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 personality
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 projid_map
lrwxrwxrwx   1 geauxsmart geauxsmart 0 May  2 08:15 root -> /
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 schedstat
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 sessionid
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 setgroups
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 smaps
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 smaps_rollup
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 stack
-r--r--r--   1 geauxsmart geauxsmart 0 Apr 29 16:18 stat
-r--r--r--   1 geauxsmart geauxsmart 0 May  1 07:55 statm
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 status
-r--------   1 geauxsmart geauxsmart 0 May  2 08:15 syscall
dr-xr-xr-x   3 geauxsmart geauxsmart 0 May  2 08:05 task
-rw-rw-rw-   1 geauxsmart geauxsmart 0 May  2 08:15 timerslack_ns
-rw-r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 uid_map
-r--r--r--   1 geauxsmart geauxsmart 0 May  2 08:15 wchan

And

root@www1 / # cat /proc/30393/cmdline
[sync_supers]root@www1 / #
  • You have apache running on that machine? More than likely you have more problems. Do a ls -al /proc/30393/ and a cat /proc/30393/cmdline to find out where it is from. Add it to the q if there is no sensitive data in there ;) – Rinzwind May 2 '18 at 13:03
  • @Rinzwind updated. I'm scanning with ClamAV and it already deleted lots of files, also ran rkhunter but it just scanned and that was it, log contained warnings but nothing keyword 'infected', not sure what to do with rkhunter. – user3108268 May 2 '18 at 13:18
  • I would format the server and restore a backup (but I know that is easier said than done ;-) ). – Rinzwind May 2 '18 at 13:25
  • Forensics is complex and as you can see locking a user in this situation has no meaningful effect. By default the apache and root accounts are locked and they both run processes in the background ...... – Panther May 2 '18 at 14:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.