root@f7307:/home/ubuntu/.configrc5# crontab -u ubuntu -e
5 6 * * 0 /home/ubuntu/.configrc5/a/upd>/dev/null 2>&1
@reboot /home/ubuntu/.configrc5/a/upd>/dev/null 2>&1
5 8 * * 0 /home/ubuntu/.configrc5/b/sync>/dev/null 2>&1
@reboot /home/ubuntu/.configrc5/b/sync>/dev/null 2>&1
0 0 */3 * * /tmp/.X291-unix/.rsync/c/aptitude>/dev/null 2>&1
脚本1：
root@f7307:/home/ubuntu/.configrc5# cat /home/ubuntu/.configrc5/a/upd
#!/bin/sh
cd /home/ubuntu/.configrc5/a
if test -r /home/ubuntu/.configrc5/a/bash.pid; then
pid=$(cat /home/ubuntu/.configrc5/a/bash.pid)
if $(kill -CHLD $pid >/dev/null 2>&1)
then
exit 0
fi
fi
./run &>/dev/null
脚本2：
root@f7307:/home/ubuntu/.configrc5# cat /home/ubuntu/.configrc5/b/sync
#!/bin/sh
cd /home/ubuntu/.configrc5/b
./run
脚本3：
root@f7307:/home/ubuntu/.configrc5# cat /tmp/.X291-unix/.rsync/c/aptitude
#!/bin/sh
cd /tmp/.X291-unix/.rsync/c
./run &>/dev/null
看看那个目录：
root@f7307:/home/ubuntu/.configrc5# ll
total 24
drwxrwxr-x 4 ubuntu ubuntu 4096 Apr 8 15:12 ./
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 9 08:05 ../
drwxrwxr-x 3 ubuntu ubuntu 4096 Apr 9 06:05 a/
drwxrwxr-x 2 ubuntu ubuntu 4096 Apr 9 08:05 b/
-rw-rw-r-- 1 ubuntu ubuntu 279 Apr 8 15:12 cron.d
-rw-rw-r-- 1 ubuntu ubuntu 24 Apr 8 15:12 dir2.dir
root@f7307:/home/ubuntu/.configrc5# cat cron.d
5 6 * * 0 /home/ubuntu/.configrc5/a/upd>/dev/null 2>&1
@reboot /home/ubuntu/.configrc5/a/upd>/dev/null 2>&1
5 8 * * 0 /home/ubuntu/.configrc5/b/sync>/dev/null 2>&1
@reboot /home/ubuntu/.configrc5/b/sync>/dev/null 2>&1
0 0 */3 * * /tmp/.X291-unix/.rsync/c/aptitude>/dev/null 2>&1
root@f7307:/home/ubuntu/.configrc5# cat dir2.dir
/home/ubuntu/.configrc5
root@f7307:/home/ubuntu/.configrc5# ll a
total 2232
drwxrwxr-x 3 ubuntu ubuntu 4096 Apr 9 06:05 ./
drwxrwxr-x 4 ubuntu ubuntu 4096 Apr 8 15:12 ../
-rwxrwxrwx 1 ubuntu ubuntu 2080 Apr 8 15:12 a*
-rw-rw-r-- 1 ubuntu ubuntu 6 Apr 9 06:05 bash.pid
-rw-rw-r-- 1 ubuntu ubuntu 1704 Apr 8 15:12 cert_key.pem
-rw-rw-r-- 1 ubuntu ubuntu 964 Apr 8 15:12 cert.pem
-rwxrwxrwx 1 ubuntu ubuntu 26 Apr 9 06:05 dir.dir*
-rwxrwxrwx 1 ubuntu ubuntu 9318 Apr 8 15:12 init0*
-rwxrwxrwx 1 ubuntu ubuntu 2225980 Apr 8 15:12 kswapd0*
-rwxrwxrwx 1 ubuntu ubuntu 338 Apr 8 15:12 run*
-rwxrwxrwx 1 ubuntu ubuntu 703 Apr 8 15:12 stop*
drwxrwxrwx 6 ubuntu ubuntu 4096 Apr 8 15:12 tors/
-rwxrwxrwx 1 ubuntu ubuntu 211 Apr 8 15:12 upd*
root@f7307:/home/ubuntu/.configrc5# ll b/
total 76
drwxrwxr-x 2 ubuntu ubuntu 4096 Apr 9 08:05 ./
drwxrwxr-x 4 ubuntu ubuntu 4096 Apr 8 15:12 ../
-rwxr-xr-x 1 ubuntu ubuntu 157 Apr 8 15:12 a*
-rw-rw-r-- 1 ubuntu ubuntu 26 Apr 8 15:12 dir.dir
-rwxr-xr-x 1 ubuntu ubuntu 50087 Apr 8 15:12 run*
-rwxr-xr-x 1 ubuntu ubuntu 1030 Apr 8 15:12 stop*
-rwxrw-r-- 1 ubuntu ubuntu 45 Apr 8 15:12 sync*
实际最后运行的就是这个了，占用CPU高达 75%，使正常业务进程异常。top就能看到这个进程。
看看temp目录下是啥：
root@f7307:/home/ubuntu/.configrc5# ll /tmp/.X291-unix/
total 10756
drwxrwxr-x 3 ubuntu ubuntu 4096 Apr 8 14:52 ./
drwxrwxrwt 13 root root 12288 Apr 10 08:17 ../
-rwx------ 1 ubuntu ubuntu 10993017 Apr 8 14:52 dota3.tar.gz*
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 8 15:12 .rsync/
root@f7307:/home/ubuntu/.configrc5# ll /tmp/.X291-unix/.rsync/
total 132
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 8 15:12 ./
drwxrwxr-x 3 ubuntu ubuntu 4096 Apr 8 14:52 ../
-rwxrwxrwx 1 ubuntu ubuntu 5169 Apr 8 15:12 1*
drwxrwxrwx 3 ubuntu ubuntu 4096 Feb 27 18:14 a/
drwxrwxrwx 2 ubuntu ubuntu 4096 Nov 28 21:12 b/
drwxrwxrwx 2 ubuntu ubuntu 4096 Apr 8 15:12 c/
-rwxrwxrwx 1 ubuntu ubuntu 23 Apr 8 15:12 dir.dir*
-rwxrwxrwx 1 ubuntu ubuntu 2349 Feb 27 20:05 init*
-rwxrwxrwx 1 ubuntu ubuntu 88607 Feb 27 20:06 init0*
-rwxrwxrwx 1 ubuntu ubuntu 1756 Feb 27 20:06 init2*
-rwxrwxrwx 1 ubuntu ubuntu 1912 Feb 27 20:06 initall*
-rw-rw-r-- 1 ubuntu ubuntu 0 Apr 8 15:12 .out
root@f7307:/home/ubuntu/.configrc5# ll /tmp/.X291-unix/.rsync/a
total 2212
drwxrwxrwx 3 ubuntu ubuntu 4096 Feb 27 18:14 ./
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 8 15:12 ../
-rwxr-xr-x 1 ubuntu ubuntu 2080 Feb 27 18:28 a*
-rwxr-xr-x 1 ubuntu ubuntu 9318 Dec 10 01:10 init0*
-rwxr-xr-x 1 ubuntu ubuntu 2225980 Feb 27 18:08 kswapd0*
-rwxr-xr-x 1 ubuntu ubuntu 338 Dec 8 02:20 run*
-rwxr-xr-x 1 ubuntu ubuntu 703 Dec 6 03:17 stop*
drwxr-xr-x 4 ubuntu ubuntu 4096 Sep 4 2020 tors/
root@f7307:/home/ubuntu/.configrc5# ll /tmp/.X291-unix/.rsync/b
total 68
drwxrwxrwx 2 ubuntu ubuntu 4096 Nov 28 21:12 ./
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 8 15:12 ../
-rwxr-xr-x 1 ubuntu ubuntu 157 Apr 11 2019 a*
-rwxr-xr-x 1 ubuntu ubuntu 50087 Nov 28 21:12 run*
-rwxr-xr-x 1 ubuntu ubuntu 1030 Nov 22 02:01 stop*
root@f7307:/home/ubuntu/.configrc5# ll /tmp/.X291-unix/.rsync/c
total 2164
drwxrwxrwx 2 ubuntu ubuntu 4096 Apr 8 15:12 ./
drwxr-xr-x 5 ubuntu ubuntu 4096 Apr 8 15:12 ../
-rwxrwxrwx 1 ubuntu ubuntu 87 Apr 8 15:00 1*
-rwxrwxrwx 1 ubuntu ubuntu 56 Apr 8 15:12 aptitude*
-rwxrwxrwx 1 ubuntu ubuntu 190 Dec 8 23:01 blitz*
-rwxrwxrwx 1 ubuntu ubuntu 1073756 Dec 14 16:28 blitz32*
-rwxrwxrwx 1 ubuntu ubuntu 1084016 Dec 14 19:48 blitz64*
-rwxrwxrwx 1 ubuntu ubuntu 32 Dec 9 02:17 c*
-rwxrwxrwx 1 ubuntu ubuntu 42 Dec 9 02:18 d*
-rwxrwxrwx 1 ubuntu ubuntu 25 Apr 8 15:12 dir.dir*
-rwxrwxrwx 1 ubuntu ubuntu 836 Dec 10 17:17 go*
-rwxrwxrwx 1 ubuntu ubuntu 2 Apr 8 15:12 n*
-rwxrwxrwx 1 ubuntu ubuntu 489 Dec 24 2019 run*
-rwxrwxrwx 1 ubuntu ubuntu 203 Nov 28 2019 start*
-rwxrwxrwx 1 ubuntu ubuntu 1038 Dec 8 03:18 stop*
-rwxrwxrwx 1 ubuntu ubuntu 0 Mar 19 2020 v*
这个用户 ubuntu:x:1000:1000:ubuntu,,,:/home/ubuntu:/usr/sbin/nologin 还被加了一个authorized_keys实现了自动登录
