我们在周末侵入了我们的服务器,我正试图追踪入侵者的踪迹.它们似乎运行了一个perl脚本,导致名为init的www数据进程以100%运行.不幸的是我没有perl专业知识,所以我不知道这是做什么的:
- 6 my $processo =("atd","sendmail: accepting connections","rpc.idmapd","syslogd -m 0","/sbin/udevd -d","/sbin/init");
- # ...
- 24 use IO::Socket;
- 25 use Socket;
- 26 use IO::Select;
- 27 chdir("/tmp");
- 28 $servidor="$ARGV[0]" if $ARGV[0];
- 29 $0="$processo"."\0"x16;;
- 30 my $pid=fork;
- 31 exit if $pid;
在我看来,第29行的指令旨在以某种方式隐藏过程.它究竟做了什么?
@H_403_6@解决方法
从
perldoc perlvar开始:
On some (but not all) operating systems assigning to
$0
modifies the argument area that theps
program sees. On some platforms you may
have to use specialps
options or a differentps
to see the changes.
Modifying the$0
is more useful as a way of indicating the current
program state than it is for hiding the program you’re running.
所以是的,你的断言是正确的.它正在寻找掩盖它在ps中的显示方式.
@H_403_6@ @H_403_6@