1

A users account have been hacked on one of my servers, where the hacker have started some spam binaries. Before I kill the processes would I like to make a copy of them, but when I

tar czf 30333.tar.gz /proc/30333

all files are empty.

Question

How do I make a copy of /proc/30333?

2

Here is one script that allows you to cap the size of files to be saved (here 32 or 64 MiB depending on the shell ) :

PID=30333
ulimit -f 65536
cd /proc/$PID || exit 1
find . -type d -exec sh -c 'mkdir -p /tmp/proc/$PID/$1' sh {} \;
find . -type f -exec sh -c 'cat $1 > /tmp/proc/'$PID'/$1' sh {} \;
tar czf /tmp/$PID.tgz /tmp/proc/$PID
rm -rf /tmp/proc/$PID
1

/proc is a virtual file system and doesn't have any actual files, but rather contains information on the processes running on the system.

  • 4
    I can read the files, so there must be a way to copy them. – Jasmine Lognnes Jun 5 '14 at 19:31
  • 1
    If /proc contains information, and Jasmine is looking for a way to copy that information. If I can cat files in /proc then there must be a way to save that information elsewhere, somehow. – Stefan Lasiewski Jun 5 '14 at 21:17
1

Solution

cp -r /proc/30333 /root
tar czf /root/30333.tar.gz /root/30333
  • 1
    What do you hope to accomplish with this? – Sven Jun 5 '14 at 19:51
  • 1
    Given that the server has been hacked, "forensically analyze a hostile binary" would be my guess. – Gerald Combs Jun 5 '14 at 20:25
1

Make sure that /proc/30333/exe is included in what you copy. Not just the symlink, but the actual executable that it is pointing to.

A memory image might be useful too. You can create a core dump by typing:

gdb
attach 30333
gcore

Not the answer you're looking for? Browse other questions tagged or ask your own question.