A malicious script located on the Apps server that is taking up diskspace

Step 1: Locate the malicious script running on the Apps server

It is located in

/usr/local/bin/tmp

Here we can see the script

stat /usr/local/bin/tmp/sim_disk_attack.sh

This command verifies that it is running

It has a process ID of 557544 showing it is active

Step 2: Stop the malicious script running

Run the command

sudo kill -9 557544

The -9 denotes forcefully killing a process

557544 is the process ID of the script we want to stop running

The script is designed to re-start automatically

As shown by running

pgrep -a -f sim_disk_attack.sh

The script now has a new process ID even after killing its old one

This command reveals that it is running as a service

sudo grep -r sim_disk_attack /etc/systemd/system/

Stop the service using the command

sudo systemctl stop simdiskattack.service

Disable the service using the command

sudo systemctl disable simdiskattack.service

Step 3: Removing the service file

Run these commands to remove the service file

sudo rm /etc/systemd/system/simdiskattack.service

sudo systemctl daemon-reload

sudo systemctl mask simdiskattack.service

Step 4: Deleting the Scripts

Run these commands to delete both scripts

sudo rm -f /usr/local/bin/sim_disk_attack.sh

sudo rm -f /usr/local/bin/tmp/sim_disk_attack.sh

This command removes the directory the script was in

sudo rmdir /usr/local/bin/tmp

Step 5: Removing Diskbom

The diskbom directory also needs to be removed as it is filling the diskspace

This command will delete it

sudo rm -rf /var/tmp/diskbom/

Disk Space Check is now displayed as 'OK' in Nagios

OwnCloud redirection from login

The ownCloud configuration has been altered to redirect users to the default Apache2 page and it showing a critical error in Nagios

Troubleshooting

The owncloud.conf file appears to be altered

sudo nano /etc/apache2/sites-available/owncloud.conf

The port number of the virtual host has been changed to 443, it should be 80

After this has been remedied restart the service

sudo systemctl restart apache2.service

This has not fixed the issue

Looking at the logs shows there are permission issues with the config file

An attempt to change the permissions of this file was not successful

The file appears to be immutable, this can be changed with the command

chattr -i /var/www/owncloud/config/config.php

The file permissions can now be changed and the system restarted

OwnCloud is now accessible

Nagios is showing the service status as 'OK'

Ticket Reference

https://rt.dataraster.com/Ticket/Display.html?id=345&results=d3285ed05718aaa80f48585d83af00eb