-2

I think my VPS is hacked - there are multiple instances of curl process running and pointing to a Jpg file of some IP address. How to stop that process from getting created over and over?

There are multiple such processes running simultaneously, deleting one of them doesn't delete the other. I have tried deleting all but they get recreated.

New contributor
Gaurang Agrawal is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
5
  • It probably was hacked. Something is re-spawning them. What is the parent process? What is the URL and IP?
    – forest
    Aug 6 at 3:06
  • How to know the parent process of multiple similar processes? Aug 6 at 4:09
  • Have you read the ps manpage?
    – forest
    Aug 6 at 5:44
  • 1
    You should read How do I deal with a compromised server?
    – roaima
    Aug 6 at 7:36
  • 1
    When you have a compromised server, dealing with the symptom of the fact that someone is using your system should be a secondary concern. Your first concern should be to remove the server from any network. See the link that roaima posted in the previous comment.
    – Kusalananda
    Aug 7 at 6:17

2 Answers 2

1

If something is spawning processes, kill that something (not just those processes).

If I run ps -ef, I get a list of processes running on my machine. I've only included the processes I'm interested in below:

$ ps -ef --forest
UID          PID    PPID  C STIME TTY          TIME CMD
...
stew      909382       1  0 08:36 ?        00:00:00 /bin/sh -c i3-sensible-terminal
stew      909383  909382  0 08:36 ?        00:00:04  \_ x-terminal-emulator
stew      909386  909383  0 08:36 pts/0    00:00:00      \_ /bin/bash
stew      910033  909386  0 08:46 pts/0    00:00:00          \_ curl https://unix.stackexchange.com/questions/712603/is-there-any-way
stew      910034  909386  0 08:46 pts/0    00:00:00          \_ ps -ef --forest

Indeed curl is running (I started it myself). Here I can see:

  • CMD: I know the command-line arguments to curl. This could include the URL or IP of the location you are sending data or getting instructions. You could also be part of a DDOS in which case, that's the info of the victim.
  • PPID: This is the parent process who launched curl. In my case, that's 909386.
  • UID is stew. That's an unprivileged user, so my whole system doesn't seem to be compromised, just that user.

If I follow the chain of PPIDs, I can see that this was run via bash which was run in a terminal in my desktop environment. None of that is weird, and that's what I've done.

Figure out what curl's PPID is, and follow that chain until you figure out the main process. It's possible that this is part of a legitimate process.

If you see the PPID belongs to sshd, then this is someone who is actively logged into your machine. Changing passwords and clearing authorized keys is necessary.

If you see that this is from a systemd service, you can see what that service is actually supposed to do and disable it if necessary.

2
  • +1 adding that it could also be caused by a bug in a recently modified web app. Therefore, right after having archived the result of the ps, I would close whatever http / php or like / database server if any prior to investigating.
    – MC68020
    Aug 6 at 7:09
  • The system could still be compromised, with the attacker having chosen to run their downloads from your unprivileged account. There are also root kits that will hide particular processes from user inspection
    – roaima
    Aug 6 at 10:04
1

While I had tried ps, ss, and other related commands, they could show that independent curl commands were running. There was no parent-child processes.

What hacker did was - it ran a cron job every minute using the Apache web server’s www-data user. Once I killed that cron job and rest of the running compromised curl processes no new processes got created.

Although I have deleted that instance of VPS - do share what else could have been done to prevent such instances from happening.

New contributor
Gaurang Agrawal is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • Other things might also have been done, do not assume. Do you have key only ssh, and a properly set up firewall? It is a very bad idea to continue to use a machine that was once compromised.
    – dakini
    Aug 8 at 7:30

Your Answer

Gaurang Agrawal is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.