How to successfully intrude into Linux servers

Andre'dimino, a security researcher at the University of Washington, noticed that multiple IP addresses were trying to use a fixed PHP vulnerability to hijack a Linux server. He was curious about how attackers successfully controlled a Linux server and therefore set up a honeypot, run the old version of PHP to allow attackers to hijack and observe. DiMino found that the attacker was indeed very embarrassed. He sent an http post request containing multiple commands, downloaded a Perl script disguised as a PDF file, and deleted it after execution.

To ensure the success, attackers use curl, fetch, and lwp-get requests to repeat the preceding steps. The Perl script program sleep for a period of time, probably avoiding the Administrator's ears. The infected machine connects to a relay chat channel and downloads and executes another script. Attackers installed Multiple applications on the server, including Bitcoin and prime coin mining programs, DDoS tools, and other tools that Scan Machines with known vulnerabilities. With the popularity of Linux servers, like Windows PC, it has become an attractive target for attackers.