Securing htdocs - How were the files and directories created?

Hi team - I need some help!

I discovered some directories in the IFS that were not there yesterday.

We are using PHP Zend server 7 to provide a web portal for our 
application.

Today I found directories in /www/zendphp7/htdocs     including 

Object            Type        Owner               Size  Data 
amzn.zip          *STMF       QTMHHTTP         3145728  Yes 
amznbvn           *DIR        QTMHHTTP            8192  Yes 
hehe.php          *STMF       QTMHHTTP           32768  Yes 
hte.php           *STMF       QTMHHTTP           32768  Yes 
subanus           *DIR        QTMHHTTP            8192  Yes
us.php            *STMF       QTMHHTTP           16384  Yes
xcbxcb            *DIR        QTMHHTTP            8192  Yes


on a system. 

These are in the directory /www/zendphp7/htdocs/

The authorities are as follows.

Directory /www

*PUBLIC     *RWX
QSYS        *RWX
QTMHHTTP    *RWX

Directory /www/zendphp7
*PUBLIC     *EXCLUDE 
QTMHHTTP    *RWX 

Directory /www/zendphp7/htdocs
*PUBLIC     *EXCLUDE 
QTMHHTTP    *RX 

I found in the access_log

host-156.210.234.190-static.tedata.net - - [08/Aug/2023:00:05:33 +1000] 
"GET //xcbxcb/all_result/FULLZ.HTML HTTP/1.1" 404 196 "-" "Mozilla/5.0 
(X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"
156.210.190.234 - - [08/Aug/2023:00:05:35 +1000] "GET /favicon.ico 
HTTP/1.1" 404 196 "
https://xxxxxxxaccounts.xxx.net.au//xcbxcb/all_result/FULLZ.HTML" 
"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"

156.210.190.234 - - [08/Aug/2023:00:19:18 +1000] "GET 
/hte.php?d=2f7777772f7a656e64706870372f6874646f63732f49544d41532f7863627863622
2f616c6c5f726573756c74 HTTP/1.1" 200 3371 "
https://xxxxxxxaccounts.xxx.net.au/hte.php?d=2f7777772f7a656e64706870372f6874646f63732f4954
4d41532f7863627863622f616c6c5f726573756c74" "Mozilla/5.0 (X11; Linux 
x86_64; rv:109.0) Gecko/20100101 Firefox/116.0"

And a whole heap more related messages.

I have blocked address 156.210.190.234 in the firewall - but I am sure 
this is not a fix.

I have deleted the files and directories that were owned by QTMHHTTP above 
but I do not understand how these were installed based on QTMHHTTP not 
having Write authority to the htdocs directory ?

I do not know what security changes I should be implementing or where to 
get the information on how to implement these changes.

Any suggestions gratefully appreciated.

Thanks

Don 


--
This email has been scanned for computer viruses. Although MSD has taken reasonable precautions to ensure no viruses are present in this email, MSD cannot accept responsibility for any loss or damage arising from the use of this email or attachments..
-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: [email protected]
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request-+hD5IHI5Xscn3HwCXmMcX9BPR1lH4CV8@public.gmane.org
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support-FMtJrHiV//lnDLsaKlm4mFaTQe2KTcn/@public.gmane.org for any subscription related questions.