• 处理kdevtmpfsi挖矿病毒


     发现CPU直接100%

    [root@hadoop002 tmp]# systemctl status 25177
    ● session-5772.scope - Session 5772 of user root
       Loaded: loaded (/run/systemd/system/session-5772.scope; static; vendor preset: disabled)
      Drop-In: /run/systemd/system/session-5772.scope.d
               └─50-After-systemd-logindx2eservice.conf, 50-After-systemd-user-sessionsx2eservice.conf, 50-Description.conf, 50-SendSIGHUP.conf, 50-Slice.conf, 50-TasksMax.conf
       Active: active (abandoned) since Wed 2020-01-22 16:06:01 CST; 1h 21min ago
       CGroup: /user.slice/user-0.slice/session-5772.scope
               ├─19331 /var/tmp/kinsing
               └─25177 /tmp/kdevtmpfsi
    
    Jan 22 16:06:17 hadoop002 crontab[19353]: (root) REPLACE (root)
    Jan 22 16:06:17 hadoop002 crontab[19354]: (root) LIST (root)
    Jan 22 16:06:17 hadoop002 crontab[19366]: (root) LIST (root)
    Jan 22 16:06:17 hadoop002 crontab[19374]: (root) REPLACE (root)
    Jan 22 16:06:17 hadoop002 crontab[19375]: (root) LIST (root)
    Jan 22 16:06:17 hadoop002 crontab[19383]: (root) REPLACE (root)
    Jan 22 16:06:17 hadoop002 crontab[19389]: (root) REPLACE (root)
    Jan 22 16:06:17 hadoop002 crontab[19390]: (root) LIST (root)
    Jan 22 16:06:17 hadoop002 crontab[19392]: (root) REPLACE (root)
    Jan 22 16:06:17 hadoop002 crontab[19393]: (root) LIST (root)
    [root@hadoop002 tmp]# ps -ef|grep kinsing
    root     19331     1  0 16:06 ?        00:00:04 /var/tmp/kinsing
    root     25190 23274  0 17:27 pts/0    00:00:00 grep --color=auto kinsing
    [root@hadoop002 tmp]# ps -ef|grep kdevtmpfsi
    root     25177     1 99 17:27 ?        00:01:47 /tmp/kdevtmpfsi
    root     25197 23274  0 17:28 pts/0    00:00:00 grep --color=auto kdevtmpfsi
    [root@hadoop002 tmp]# kill -9 19331
    [root@hadoop002 tmp]# kill -9 25177
    [root@hadoop002 tmp]# rm -rf kdevtmpfsi
    [root@hadoop002 tmp]# cd /var/tmp/
    [root@hadoop002 tmp]# ll
    total 16692
    -rw-r--r-- 1 root root        0 Jan 13 19:45 aliyun_assist_update.lock
    -rwxr-xr-x 1 root root    13176 Dec 20 02:14 for
    -rwxr-xr-x 1 root root 17072128 Jan 19 17:43 kinsing
    drwx------ 3 root root     4096 Jan 13 19:50 systemd-private-f3342ea6023044bda27f0261d2582ea3-chronyd.service-O7aPIg
    [root@hadoop002 tmp]# rm -rf kinsing

  • 相关阅读:
    Day12——提权学习之第三方软件Radmin提权
    Day11——提权学习之第三方软件VNC提权
    Day10——提权学习之第三方软件FlashFXP及pcAnywhere提权
    Day9——提权学习之第三方软件FileZilla提权
    Day8——提权学习之第三方软件G6-FTP提权
    Day7——提权学习之第三方软件serv-u提权
    Day6——提权学习之Oracle数据库提权学习总结
    Memcached 未授权访问漏洞 CVE-2013-7239
    恭喜tes获得夏季赛冠军
    有关xss的小日记
  • 原文地址:https://www.cnblogs.com/dalianpai/p/12229099.html
Copyright © 2020-2023  润新知