A shell with a web server for a parent

An interactive bash on wp-02 is connected to an outside address. Walk the process tree back to the web stack, then find the request that started it.

Briefing

EDR on wp-02 raised a low-confidence alert: bash -i with a network socket on standard input. The site runs WordPress on nginx and php-fpm.

An interactive shell whose ancestor is php-fpm was started by PHP code. The nginx access log will show which script ran just before.

analyst@wp-02

wp-02 · Processes and ports

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@wp-02:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.