I discovered a script running on my server. Reading through apache log files, attacker used cms login vulnerability and downloaded script from this site Can anybody identify what does it do? After hitting htop I could see:

sh -c chmod 777 sysd && ./sysd -c 2.cf

which is now gone ang all I can see is remaining process

./sysd -c apache.cf -t 1

This I can not find on server so I have no idea what does it do. Cpu is normal. Thank you

  • @jsotola it is a simple text file, here you go pastebin.com/qGTy6Qb2 – user1031742 Nov 7 '19 at 21:25
  • 5
    It appears to be a DDOS client, used in distributed attacks for overloading other machines. You have a compromised server and you are helping in malicious behaviour (against your will). Take it down and rebuild it. See also How to deal with a compromised server at ServerFault. – Kusalananda Nov 8 '19 at 9:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.