I have an issue on my server where some hole is allowing malicious PHP files to be written to any world-writable directories beneath the web root. It is not currently causing any harm, as I have all these directories blocked from serving php scripts (or anything else unless images/videos for some of them), and get an email notice as soon as anything is created in them, but I obviously want to get it fixed.
I have taken various measures, such as ensuring the Joomla and Wordpress installations on the server are up to date, but still it continues. There is a client site on the server running a fairly old version of an eCommerce system, which I suspect may be the culprit.
So I have set up
auditd to monitor all of these world-writable directories, and await the problem occurring again to gather some logs, but I already have some log entries to look at from normal activity that has occurred.
It is as I suspected, and of course when a PHP script writes to a file all
auditd shows for the exe is
/usr/sbin/httpd. See sample output below. It is potentially possible to get an idea of which site the problem is coming from based on the
CWD, but that could be changed and is not reliable. Also knowing the specific script would be useful.
So I am wondering, is it possible to have
auditd log the script name (edit: or perhaps the call stack) that is generating the action through
/usr/sbin/httpd, or anything close to that information?
time->Wed Nov 30 14:36:30 2016
type=PATH msg=audit(1480516590.911:180239): item=1 name="/home/web/www.example.com/html/cache/example.php" inode=539842913 dev=08:05 mode=0100644 ouid=48 ogid=48 rdev=00:00 objtype=CREATE
type=PATH msg=audit(1480516590.911:180239): item=0 name="/home/web/www.example.com/html/cache/" inode=539833631 dev=08:05 mode=040777 ouid=634 ogid=634 rdev=00:00 objtype=PARENT
type=CWD msg=audit(1480516590.911:180239): cwd="/home/web/www.example.com/html"
type=SYSCALL msg=audit(1480516590.911:180239): arch=c000003e syscall=2 success=yes exit=36 a0=7f9baf272550 a1=241 a2=1b6 a3=9 items=2 ppid=26483 pid=30957 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" key="write_to_open_web_directories"