Solve Problems Related to LNMP Trojans in CentOS

Solve Problems Related to LNMP Trojans in CentOS

In the past few days, the project was busy. The server went online and the product was not yet online. The old client complained that the server could not connect. At first, I thought the php-fpm went down, but it wasn't that fun, only a few people are using it, and the time is really tight and there is no time to consider it. Directly service xxx restart, it seems like you can .... it may not be long before I receive a complaint again. I thought it was a big problem, network? Trojan? You can browse other websites immediately, and the network can be ruled out.

Next, scan the trojan and run the top command to check whether a ghost is consuming server resources. Install iftop to check the traffic, which means a large number of packets are sent to ip addresses of unknown origins. What should I do? Prohibit external packet sending first:

Vi/etc/sysconfig/iptables

# Services that allow UDP packet sending (DNS)
-I OUTPUT-p udp -- dport 53-d 8.8.8.8-j ACCEPT
-I OUTPUT-p udp -- dport 53-d XXX. XXX-j ACCEPT
# Disable php-ddos to send udp packets externally
-A output-p udp-j DROP

Save and exit, and the service iptables restart will return to iftop again for observation, without sending a large number of external packets.

View it with top, and find the corresponding cmd file in the/proc/process id directory based on the process id, shit! I even suspected that mysql was running, killed it decisively, and found the corresponding trojan file based on the physical path of the process, and saved it directly to the mysql DATA DIRECTORY ~~, There are a lot of executable files that you don't know about. If you have any mistakes, you can delete them all !! Come back and check whether the top load has been lowered.

Think about it. How can it be infected with Trojans and vulnerabilities? We have the file upload code. check it now. The upload code does not strictly limit the types of files that can be uploaded, And the upload directory location permission is not done now .... sad... block it now! ~