1

I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site http://217.61.107.9/wes. Can anybody identify what does it do? After hitting htop I could see:

sh -c chmod 777 sysd && ./sysd -c 2.cf

which is now gone ang all I can see is remaining process

./sysd -c apache.cf -t 1

This I can not find on server so I have no idea what does it do. Cpu is normal. Thank you

  • @jsotola it is a simple text file, here you go pastebin.com/qGTy6Qb2 – user1031742 Nov 7 '19 at 21:25
  • 5
    It appears to be a DDOS client, used in distributed attacks for overloading other machines. You have a compromised server and you are helping in malicious behaviour (against your will). Take it down and rebuild it. See also How to deal with a compromised server at ServerFault. – Kusalananda Nov 8 '19 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.