Alright, let’s get rolling here. I’m not alone eh… let’s look at what’s running again.

$ ps -aux
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  37228  5304 ?        Ss   Jul07   0:45 /sbin/init
root        38  0.0  0.0  52032 15412 ?        Ss   Jul07  10:31 /lib/systemd/systemd-journald
root        84  0.0  0.0  28980  2924 ?        Ss   Jul07   0:02 /usr/sbin/cron -f
syslog      86  0.0  0.0 256392  4208 ?        Ssl  Jul07   2:11 /usr/sbin/rsyslogd -n
root       156  0.0  0.0  65508  6528 ?        Ss   Jul07   2:39 /usr/sbin/sshd -D
root       159  0.0  0.0   4504  1608 ?        S    Jul07   0:10 /bin/sh /root/files/backup.sh -u trinity -p Flag-7e0cfcf090a2fe53c97ea3edd3883d0d
root       172  0.0  0.0  15752  2212 pts/2    Ss+  Jul07   0:00 /sbin/agetty --noclear --keep-baud pts/2 115200 38400 9600 vt220
root       175  0.0  0.0  15752  2212 pts/0    Ss+  Jul07   0:00 /sbin/agetty --noclear --keep-baud pts/0 115200 38400 9600 vt220
root       176  0.0  0.0  15752  2212 ?        Ss+  Jul07   0:00 /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt220
root       177  0.0  0.0  15752  2212 pts/3    Ss+  Jul07   0:00 /sbin/agetty --noclear --keep-baud pts/3 115200 38400 9600 vt220
root       179  0.0  0.0  15752  2212 pts/1    Ss+  Jul07   0:00 /sbin/agetty --noclear --keep-baud pts/1 115200 38400 9600 vt220
mysql      182  0.0  0.2 1282828 190004 ?      Ssl  Jul07   3:56 /usr/sbin/mysqld
root     10146  0.0  0.0  90488  6840 ?        SNs  00:30   0:00 sshd: morpheus [priv]
morpheus 10157  0.0  0.0  90488  4292 ?        SN   00:31   0:00 sshd: [email protected]/4
morpheus 10158  0.0  0.0  21180  3736 pts/4    SNs  00:31   0:00 -bash
root     10181  0.0  0.0  49932  3416 pts/4    SN   00:31   0:00 su trinity
trinity  10185  0.0  0.0  21180  3740 pts/4    SN   00:31   0:00 bash
root     12416  0.0  0.0  49932  3416 pts/4    SN   00:58   0:00 su neo
neo      12420  0.0  0.0  21172  3516 pts/4    SN   00:58   0:00 bash
root     12439  0.0  0.0   7288   640 ?        S    00:59   0:00 sleep 10
root     12446  0.0  0.0  65508  6264 ?        Ss   00:59   0:00 sshd: [accepted]
root     12447  0.0  0.0  90340  6816 ?        Ss   00:59   0:00 sshd: unknown [priv]
sshd     12448  0.0  0.0  65508  3336 ?        S    00:59   0:00 sshd: [net]
sshd     12449  0.0  0.0  65508  3336 ?        S    00:59   0:00 sshd: unknown [net]
root     12450  0.0  0.0  65508  6264 ?        Ss   00:59   0:00 sshd: [accepted]
sshd     12451  0.0  0.0  65508  3336 ?        S    00:59   0:00 sshd: [net]
neo      12452  0.0  0.0  37364  3320 pts/4    RN+  00:59   0:00 ps -aux
root     30389  0.0  0.0  49932  3404 ?        SN   Jul13   0:00 su neo -c /bin/monitor
neo      30391  0.0  0.0   4216   612 ?        SNs  Jul13   0:00 /bin/monitor

I guess that elevated monitor service is pretty suspect…

Let’s inspect it shall we? Can we strace?

$ strace
strace: must have PROG [ARGS] or -p PID
Try 'strace -h' for more information.
$ strace 
$ strace 30391
strace: Can't stat '30391': No such file or directory
[email protected]:/home/trinity$ strace -p 30391
strace: Process 30391 attached
restart_syscall(<... resuming interrupted nanosleep ...>) = 0
write(-1, "telnet 127.0.0.1 23\n", 20)  = -1 EBADF (Bad file descriptor)
write(-1, "user\n", 5)                  = -1 EBADF (Bad file descriptor)
write(-1, "FLAG-xxxx\n", 31) = -1 EBADF (Bad file descriptor)
write(-1, "get-cpuinfo\n", 12)          = -1 EBADF (Bad file descriptor)
nanosleep({10, 0},

Oh shit that was too easy!!