perl - 该perl恶意软件与更改 “$0”有什么关系？

Question

周末我们入侵了我们的服务器，我试图追踪入侵者的踪迹。看来他们运行了一个perl脚本，导致名为init的www-data进程以100％的速度运行。不幸的是，我没有perl专业知识，所以我不知道这是怎么做的:

 6 my $processo =("atd","sendmail: accepting connections","rpc.idmapd","syslogd -m 0","/sbin/udevd -d","/sbin/init");
# ...
24 use IO::Socket;
25 use Socket;
26 use IO::Select;
27 chdir("/tmp");
28 $servidor="$ARGV[0]" if $ARGV[0];
29 $0="$processo"."\0"x16;;
30 my $pid=fork;
31 exit if $pid;

在我看来，第29行的指令旨在以某种方式隐藏该过程。它到底是做什么的？

Answer 1

从perldoc perlvar:

On some (but not all) operating systems assigning to $0 modifies the argument area that the ps program sees. On some platforms you may have to use special ps options or a different ps to see the changes. Modifying the $0 is more useful as a way of indicating the current program state than it is for hiding the program you're running.

是的，您的主张是正确的。它希望掩盖它在 ps中的显示方式。