I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports?
netstat -lntup | grep nc
After further investigation through chat, the problem was identified with a specific crontab on OP's system. This was identified using the parent PID of the
nc process, which showed the following connection:
nc -l -p 45454 -e /usr/sbin/link ->
/bin/sh -c nc -l -p 45454 -e /usr/sbin/link ->
The user account associated with the
nc process was named 'link', and had a crontab associated with it. This crontab contained a cron job with the same
nc command, scheduled to be run every minute. Since the
nc command had been specified to listen indefinitely, new
nc processes were being created every minute.
The issue was resolved by commenting out the specific entry in the crontab file.