This question already has an answer here:
- How do I deal with a compromised server? 13 answers
I have a web server, due to an outdated Wordpress some hacker uploaded a webshell. Throught it, he launched a process but the ps command is not showing any name for the process:
root@serv ~ # ps aux|grep " 326 " us432 326 0.0 0.0 25032 4476 ? S Aug27 0:16 root 3334 0.0 0.0 16656 2092 pts/2 S+ 14:58 0:00 grep 326
Due to that fact I couldn't discover the problem until today.
The server OS is Debian 8, with Apache and PHP 7. The website is running under a non-privileged user.
I've search how to launch a process without name or how can I delete it's name during the execution but I didn't find anything.
Does anyone know how is this possible?
Thanks in advanced.