cpu ramps up 100% (possible hack)

[lazaros]

Hello guys,
My proxmox server acts wird since yesterday... cpu utilization is 100%, my vm stops and server restarts
The only thing i changed the same day is some themes i found online for proxmox.
My server was public exposed on port 8006
also a docker service was running on the same machine with portainer installed
when i saw my sever shutting down the vms, I also noticed an alpine docker container I have never installed
i tried to stop and delete it but it was coming up again by it self. then i stop the docker service on the server, but cpu was still at 100%
I blocked any access from the internet at the server.
I am thinking of reinstalling proxmox but I thought to ask here first.

Thanks in advance!

 

[H4R0]

How strong was your password ?

Was portainer exposed as well ?

Wipe it completely, be careful with backups they are likely compromised as well.

CPU usage comes from kvm which is your running pfsense.

The theme doesn't even change much, where did you get it from ?

 

[lazaros]

Password Unfortunately not strong at all 6-digit numeric (i know my bad)

Portainer was not exposed

Themes from git://git.proxmox.com/git/extjs.git

I also updated pfsense on latest 2.6 development the same day I think so I checked (top) on pfsense and ntopng plugin was ramping up the cpu, I uninstalled it

Still, this does not explain the docker situation

Im going to wait and see

 

[H4R0]

Password Unfortunately not strong at all 6-digit numeric (i know my bad)

That's brute forced in less then 10 minutes.

Im going to wait and see

Bad idea.


You can check gui logins with: zcat /var/log/syslog*gz | grep "successful auth"

But they probably purged logs, so it doesn't help much.