command-line-murders/i-01696afa160eb1ead
by SadServersMore by SadServers
admin@i-0e2c9c64a6cc5b706:~$ ls agent webserver.py admin@i-0e2c9c64a6cc5b706:~$ ls agent/ check.sh sadagent sadagent.txt admin@i-0e2c9c64a6cc5b706:~$ ls agent/sadagent agent/sadagent admin@i-0e2c9c64a6cc5b706:~$ file agent/sadagent agent/sadagent: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, Go BuildID=H6A8cVluPFUvaNojVwMi/C5t-5rNiA5GJLWeSm5Qz/KXfivG_lDFnrqPGrWEJo/K_OQEFevUZEPr4lPEnoe, not stripped admin@i-0e2c9c64a6cc5b706:~$ ./agent/check.sh md5sum: /home/admin/mysolution: No such file or directory NOadmin@i-0e2c9c64a6cc5b706:~$ ./agent/
paris/i-0e2c9c64a6cc5b706 01:06
by SadServersadmin 801 0.0 4.1 98188 19424 pts/0 S<l+ 10:11 0:00 /usr/bin/pythec -t kihei/i-025570eb46de4c5ab -q -i 2 /var/log/cast/i-025570eb46de4c5ab admin 804 0.0 3.0 24456 14368 pts/0 S<+ 10:11 0:00 /usr/bin/pythec -t kihei/i-025570eb46de4c5ab -q -i 2 /var/log/cast/i-025570eb46de4c5ab admin 953 0.0 0.1 5264 640 pts/1 S<+ 10:16 0:00 grep kihei admin@i-025570eb46de4c5ab:~$ kill 801 admin@i-025570eb46de4c5ab:~$ ps aux | grep kihei admin 987 2.0 4.1 98188 19436 pts/0 S<l+ 10:16 0:00 /usr/bin/pythec -t kihei/i-025570eb46de4c5ab --append -q -i 2 /var/log/cast/i-025570eb46de4c5admin 990 0.0 3.1 24456 14872 pts/0 S<+ 10:16 0:00 /usr/bin/pythec -t kihei/i-025570eb46de4c5ab --append -q -i 2 /var/log/cast/i-025570eb46de4c5admin 996 0.0 0.1 5264 640 pts/1 S<+ 10:16 0:00 grep kihei admin@i-025570eb46de4c5ab:~$ ls -al /var/log/cast/i-025570eb46de4c5ab -rw-r--r-- 1 admin admin 19241 Nov 5 10:17 /var/log/cast/i-025570eb46de4c5ab admin@i-025570eb46de4c5ab:~$ l /var/log/cast/i-025570eb46de4c5ab
kihei/i-025570eb46de4c5ab 05:17
by SadServersroot 587 0.0 1.4 13352 6828 ? Ss 21:55 0:00 sshd: /usr/sbroot 588 0.0 0.3 2872 1664 tty1 Ss+ 21:55 0:00 /sbin/agetty root 589 0.0 0.4 4396 2144 ttyS0 Ss+ 21:55 0:00 /sbin/agetty _chrony 591 0.0 0.7 10852 3664 ? S 21:55 0:00 /usr/sbin/chr_chrony 592 0.0 0.1 10724 548 ? S 21:55 0:00 /usr/sbin/chrroot 610 0.0 3.7 26612 17404 ? Ss 21:55 0:00 /usr/bin/pythroot 683 0.0 0.0 0 0 ? I 21:55 0:00 [kworker/1:3-admin 714 0.0 0.9 6740 4368 pts/0 S<s+ 21:56 0:00 bash -l admin 718 0.2 4.1 98320 19392 pts/0 R<l+ 21:56 0:00 /usr/bin/pythadmin 721 0.0 3.1 24456 14836 pts/0 R<+ 21:56 0:00 /usr/bin/pythadmin 722 0.0 0.1 2480 508 pts/1 S<s 21:56 0:00 sh -c /bin/baadmin 723 0.0 0.9 6820 4500 pts/1 S< 21:56 0:00 /bin/bash admin 819 0.0 0.6 8648 3260 pts/1 R<+ 21:59 0:00 ps aux admin@i-0cdefb94500ecc5ae:~$ vim log admin@i-0cdefb94500ecc5ae:~$ netsstat