Info xui.one hackers activity continues

[dreambox2011]

open putty

cat /etc/passwd

If you have something like this, your server is at risk

samba11:!$1$zdsApF31$TMW3MrJ3vFjX5ovwqW2Ve/:0:0:root:/root:/bin/bash


ps -u samba11

PID TTY TIME CMD
1 ? 00:00:04 systemd
2 ? 00:00:00 kthreadd
3 ? 00:00:00 rcu_gp
4 ? 00:00:00 rcu_par_gp
6 ? 00:00:00 kworker/0:0H-kblockd
8 ? 00:00:00 mm_percpu_wq
9 ? 00:00:00 ksoftirqd/0
10 ? 00:00:02 rcu_sched
11 ? 00:00:00 migration/0
12 ? 00:00:00 idle_inject/0
14 ? 00:00:00 cpuhp/0
15 ? 00:00:00 cpuhp/1
16 ? 00:00:00 idle_inject/1
17 ? 00:00:00 migration/1
18 ? 00:00:01 ksoftirqd/1
20 ? 00:00:00 kworker/1:0H-kblockd
21 ? 00:00:00 cpuhp/2
22 ? 00:00:00 idle_inject/2
23 ? 00:00:00 migration/2
24 ? 00:00:00 ksoftirqd/2
26 ? 00:00:00 kworker/2:0H-kblockd
27 ? 00:00:00 cpuhp/3
28 ? 00:00:00 idle_inject/3
29 ? 00:00:00 migration/3
30 ? 00:00:00 ksoftirqd/3
32 ? 00:00:00 kworker/3:0H-kblockd
33 ? 00:00:00 cpuhp/4
34 ? 00:00:00 idle_inject/4
35 ? 00:00:00 migration/4
36 ? 00:00:01 ksoftirqd/4
38 ? 00:00:00 kworker/4:0H-kblockd
39 ? 00:00:00 cpuhp/5
40 ? 00:00:00 idle_inject/5
41 ? 00:00:00 migration/5
42 ? 00:00:01 ksoftirqd/5
44 ? 00:00:00 kworker/5:0H-kblockd
45 ? 00:00:00 cpuhp/6
46 ? 00:00:00 idle_inject/6
47 ? 00:00:00 migration/6
48 ? 00:00:00 ksoftirqd/6
50 ? 00:00:00 kworker/6:0H-kblockd
51 ? 00:00:00 cpuhp/7
52 ? 00:00:00 idle_inject/7
53 ? 00:00:00 migration/7
54 ? 00:00:00 ksoftirqd/7
56 ? 00:00:00 kworker/7:0H-kblockd
57 ? 00:00:00 kdevtmpfs
58 ? 00:00:00 netns
59 ? 00:00:00 rcu_tasks_kthre
60 ? 00:00:00 kauditd
63 ? 00:00:00 kworker/1:2-events
64 ? 00:00:00 khungtaskd
65 ? 00:00:00 oom_reaper
66 ? 00:00:00 writeback
67 ? 00:00:00 kcompactd0
68 ? 00:00:00 ksmd
69 ? 00:00:00 khugepaged
76 ? 00:00:00 kworker/3:1-rcu_par_gp
116 ? 00:00:00 kintegrityd
117 ? 00:00:00 kblockd
118 ? 00:00:00 blkcg_punt_bio
120 ? 00:00:00 tpm_dev_wq
121 ? 00:00:00 ata_sff
122 ? 00:00:00 md
123 ? 00:00:00 edac-poller
124 ? 00:00:00 devfreq_wq
126 ? 00:00:00 watchdogd
128 ? 00:00:00 kworker/5:1-rcu_par_gp
129 ? 00:00:00 kworker/5:2-rcu_gp
130 ? 00:00:00 kworker/6:1-events
132 ? 00:00:00 kswapd0
133 ? 00:00:00 ecryptfs-kthrea
135 ? 00:00:00 kthrotld
136 ? 00:00:00 acpi_thermal_pm
137 ? 00:00:02 kworker/0:3-events
142 ? 00:00:00 vfio-irqfd-clea
143 ? 00:00:00 kworker/2:2-events
145 ? 00:00:00 ipv6_addrconf
154 ? 00:00:00 kstrp
157 ? 00:00:00 kworker/u129:0
170 ? 00:00:00 charger_manager
242 ? 00:00:00 cryptd
243 ? 00:00:00 scsi_eh_0
244 ? 00:00:00 scsi_tmf_0
245 ? 00:00:00 scsi_eh_1
246 ? 00:00:00 scsi_tmf_1
247 ? 00:00:00 scsi_eh_2
248 ? 00:00:00 scsi_tmf_2
249 ? 00:00:00 scsi_eh_3
250 ? 00:00:00 scsi_tmf_3
251 ? 00:00:00 scsi_eh_4
252 ? 00:00:00 scsi_tmf_4
266 ? 00:00:00 scsi_eh_5
267 ? 00:00:00 scsi_tmf_5
273 ? 00:00:00 kworker/u128:5-events_unbound
277 ? 00:00:00 kworker/5:1H-kblockd
279 ? 00:00:00 kworker/6:3-events
286 ? 00:00:00 ttm_swap
293 ? 00:00:00 kworker/7:1H-kblockd
295 ? 00:00:00 kworker/2:1H-kblockd
297 ? 00:00:00 kworker/1:1H-kblockd
299 ? 00:00:00 kworker/4:1H-kblockd
300 ? 00:00:00 kworker/3:1H-kblockd
306 ? 00:00:00 kworker/0:1H-kblockd
317 ? 00:00:00 md0_raid1
319 ? 00:00:00 md1_raid1
325 ? 00:00:00 kworker/6:1H-kblockd
376 ? 00:00:00 raid5wq
432 ? 00:00:00 jbd2/md1p1-8
433 ? 00:00:00 ext4-rsv-conver
507 ? 00:00:01 systemd-journal
535 ? 00:00:00 ipmi-msghandler
543 ? 00:00:00 systemd-udevd
573 ? 00:00:00 kworker/3:3-events
578 ? 00:00:00 kworker/4:2-rcu_par_gp
717 ? 00:00:00 kworker/4:3-events
734 ? 00:00:00 mdadm
831 ? 00:00:00 kipmi0
833 ? 00:00:00 kaluad
834 ? 00:00:00 kmpath_rdacd
835 ? 00:00:00 kmpathd
836 ? 00:00:00 kmpath_handlerd
837 ? 00:00:00 multipathd
848 ? 00:00:00 loop0
864 ? 00:00:00 jbd2/md0p1-8
865 ? 00:00:00 ext4-rsv-conver
869 ? 00:00:00 loop1
871 ? 00:00:00 loop2
872 ? 00:00:00 loop3
873 ? 00:00:00 loop4
874 ? 00:00:00 loop5
875 ? 00:00:00 loop6
878 ? 00:00:00 loop7
879 ? 00:00:00 loop8
883 ? 00:00:00 loop9
911 ? 00:00:00 none
968 ? 00:00:00 accounts-daemon
986 ? 00:00:00 irqbalance
990 ? 00:00:00 networkd-dispat
991 ? 00:07:55 o11v2free
999 ? 00:00:00 polkitd
1009 ? 00:00:00 snapd
1021 ? 00:00:00 systemd-logind
1022 ? 00:00:00 thermald
1027 ? 00:00:00 udisksd
1031 ? 00:00:00 bash
1038 ? 00:00:00 vsftpd
1040 ? 00:00:00 ModemManager
1065 ? 00:00:00 cron
1087 ? 00:00:00 oscam1
1088 ? 00:00:02 oscam1
1149 ? 00:00:00 sshd
1186 ? 00:00:00 unattended-upgr
1251 ? 00:00:00 apache2
1292 ? 00:00:00 ntpd
1778 ? 00:00:00 sleep
1877 ? 00:00:00 dio/md1p1
1990 tty1 00:00:00 agetty
2108 ? 00:00:04 multics1
3252 ? 00:00:06 ffmpeg
3266 ? 00:00:06 ffmpeg
3592 ? 00:00:09 ffmpeg
3930 ? 00:00:06 ffmpeg
4054 ? 00:00:06 ffmpeg
4615 ? 00:00:00 systemd
4618 ? 00:00:00 (sd-pam)
5154 ? 00:00:06 ffmpeg
6518 ? 00:00:06 ffmpeg
8442 ? 00:00:06 ffmpeg
12022 ? 00:00:05 ffmpeg
14278 ? 00:00:00 sshd
14372 pts/0 00:00:00 bash
15543 ? 00:00:07 ffmpeg
15580 ? 00:00:00 kworker/1:0
16450 ? 00:00:05 ffmpeg
26991 ? 00:00:04 ffmpeg
34488 ? 00:00:00 sshd
34642 ? 00:00:00 sftp-server
39214 ? 00:00:00 kworker/7:0-events
39216 ? 00:00:00 kworker/7:3-cgroup_destroy
44640 ? 00:00:00 kworker/u128:1-events_unbound
47155 ? 00:00:00 kworker/2:0
47164 ? 00:00:00 kworker/0:1-events
53933 ? 00:00:02 ffmpeg
54002 ? 00:00:01 ffmpeg
62115 ? 00:00:00 ffmpeg
62971 ? 00:00:00 kworker/4:0-events
63096 ? 00:00:00 kworker/5:0-md
63140 ? 00:00:00 kworker/0:0-cgroup_destroy
66148 ? 00:00:00 ffmpeg
66836 ? 00:00:00 ffmpeg
69091 ? 00:00:00 ffmpeg
69494 ? 00:00:00 ffmpeg
69777 ? 00:00:00 ffmpeg
70442 ? 00:00:00 kworker/u128:0
70532 pts/0 00:00:00 ps