You can do a self pen-testing by:
- Executing that
php file in your case the arbitrary
jpeg file in your browser and see if it displays or execute a simple Linux command say
Example: say the jpeg file is in your
<path>/uploads/ you shoulbe be able to get a shell from your browser if you enter
- You can also detect such web malware by analysing your HTTP access logs. Because these malwares depends on the HTTP protocol having your ewb server serving the requests; it should log all access and errors. For Nginx your logs should be under
cat /var/log/nginx/access.log | grep -i 'name_of_file.jpeg.php'
Note: You do not want to remove the web malware until you see what the uploader has done or doing to your server, so you can recover from any damage.
Post Mitigation: After you mitigate the damage, fix your application vulnerability by updating to restricting who can upload files, in addition you may want to disable PHP execution entirely in you
/uploads/ folder (how?)