- Ubuntu 20.02
- PHP 7.4.3
I am running a simple web server that will accept file uploads, store them and catalog them in a database.
When I check
/var/log/apache2/error.log, I see
--2022-06-01 00:07:44-- https://pastebin.com/raw/XV0i1huK Resolving pastebin.com (pastebin.com)... 220.127.116.11, 18.104.22.168, 22.214.171.124, ... Connecting to pastebin.com (pastebin.com)|126.96.36.199|:443... connected. HTTP request sent, awaiting response... 200 OK Length: unspecified [text/plain] Saving to: '/tmp/.update.py' 0K 10.0M=0s 2022-06-01 00:07:45 (10.0 MB/s) - '/tmp/.update.py' saved 
Contents of the .py file it downloads:
How is it possible that this happens? I assume it's because of my file permissions (I set 777 to all .php scripts and folders in /www/) I've set 744 permissions for now, but without write permissions, I can't copy the files where they need to be.
How do I protect against this attack?
And I've killed the connection and python process that was giving a remote shell