Can a hacker start uploading a file and specify when should it be done?

Question

so we got hacked and from that we raised a question based on our logs. Can a hacker start uploading a file at one point and specify when should it stop uploading. I.e. we got a HIT from an IP address at 06:50:52 2020-06-19 and the file uploaded later on 2020-06-20. The file is 2Mb so no way it actually took a full day to upload or does it depend on PHP configuration. Also there is no indication on when the file was uploaded only the first HIT was logged.

score 1 · Answer 1 · answered Jul 10 '20 at 14:01

1

The client may influence the speed the file is being uploaded. It depends on the configuration of your server whether you timeout such long lasting requests or not. See the slow loris attack example to see how things may work.

answered Jul 10 '20 at 14:01

Marek Puchalski

3,286
2
26
35

thank you for your input, i will check it out!! – Marius Slovikas Jul 10 '20 at 14:17

score 0 · Answer 2 · answered Jul 10 '20 at 12:05

0

you have to find which vulnerabity got exploited. It can be anything from a reverse shell to the webserver gained throu some php vulnerable scripts ...to some WordPress bug. Look thru all the logs

answered Jul 10 '20 at 12:05

Ionut Dinca

22
3

Can a hacker start uploading a file and specify when should it be done?

2 Answers2