type=PROCTITLE msg=audit(1792627044.448:26725): proctitle=2F7573722F7362696E2F61706163686532002D6B007374617274002D44464F524547524F554E44
type=PATH msg=audit(1792627044.448:26725): item=0 name="/var/log/php2shell-lab/php-error.log" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1792627044.448:26725): cwd="/var/www/php2shell-lab/apache"
type=SYSCALL msg=audit(1792627044.448:26725): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=7fb612009018 a2=441 a3=1a4 items=1 ppid=1578 pid=1694 auid=4294967295 uid=33 gid=33 euid=33 suid=33 fsuid=33 egid=33 sgid=33 fsgid=33 tty=(none) ses=4294967295 comm="apache2" exe="/usr/sbin/apache2" subj=unconfined key="unauthedfileaccess_system"
type=PROCTITLE msg=audit(1792627044.448:26726): proctitle=7368002D63002D2D006964
type=PATH msg=audit(1792627044.448:26726): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2754043 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1792627044.448:26726): item=0 name="/bin/sh" inode=2753016 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1792627044.448:26726): cwd="/var/www/php2shell-lab/apache"
type=EXECVE msg=audit(1792627044.448:26726): argc=4 a0="sh" a1="-c" a2="--" a3="id"
type=SYSCALL msg=audit(1792627044.448:26726): arch=c000003e syscall=59 success=yes exit=0 a0=7fb6127db799 a1=7fff1ae4c760 a2=7fff1ae4f660 a3=8 items=2 ppid=1694 pid=4853 auid=4294967295 uid=33 gid=33 euid=33 suid=33 fsuid=33 egid=33 sgid=33 fsgid=33 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/dash" subj=unconfined key="process_creation"
type=PROCTITLE msg=audit(1792627060.962:27084): proctitle=7368002D63002D2D006964203E202F7661722F746D702F7263655F70726F6F662E74787420323E2631
type=PATH msg=audit(1792627060.962:27084): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2754043 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1792627060.962:27084): item=0 name="/bin/sh" inode=2753016 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1792627060.962:27084): cwd="/var/www/php2shell-lab/fpm/api"
type=EXECVE msg=audit(1792627060.962:27084): argc=4 a0="sh" a1="-c" a2="--" a3=6964203E202F7661722F746D702F7263655F70726F6F662E74787420323E2631
type=SYSCALL msg=audit(1792627060.962:27084): arch=c000003e syscall=59 success=yes exit=0 a0=7e0a0e3db799 a1=7ffea9f69e00 a2=6522099c1770 a3=8 items=2 ppid=1732 pid=4872 auid=4294967295 uid=33 gid=33 euid=33 suid=33 fsuid=33 egid=33 sgid=33 fsgid=33 tty=(none) ses=4294967295 comm="sh" exe="/usr/bin/dash" subj=unconfined key="process_creation"
type=PROCTITLE msg=audit(1792627060.966:27088): proctitle=7068702D66706D3A20706F6F6C20706870327368656C6C
type=PATH msg=audit(1792627060.966:27088): item=0 name="/var/log/php2shell-lab/fpm-error.log" nametype=UNKNOWN cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1792627060.966:27088): cwd="/var/www/php2shell-lab/fpm/api"
type=SYSCALL msg=audit(1792627060.966:27088): arch=c000003e syscall=257 success=no exit=-13 a0=ffffffffffffff9c a1=6522099c0f68 a2=441 a3=1a4 items=1 ppid=1587 pid=1732 auid=4294967295 uid=33 gid=33 euid=33 suid=33 fsuid=33 egid=33 sgid=33 fsgid=33 tty=(none) ses=4294967295 comm="php-fpm8.5" exe="/usr/sbin/php-fpm8.5" subj=unconfined key="unauthedfileaccess_system"
type=SYSCALL msg=audit(1793285687.033:3001831): arch=c000003e syscall=59 success=yes exit=0 a0=5a7056122980 a1=5a7056122a30 a2=5a7056122040 a3=31 items=2 ppid=146251 pid=146253 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=948 comm="php" exe="/usr/bin/php8.5" subj=unconfined key="process_creation"
type=EXECVE msg=audit(1793285687.033:3001831): argc=3 a0="php" a1="-r" a2=6563686F202270687020636C69223B
type=CWD msg=audit(1793285687.033:3001831): cwd="/home/localuser"
type=PATH msg=audit(1793285687.033:3001831): item=0 name="/usr/bin/php" inode=2765047 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1793285687.033:3001831): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=2754043 dev=08:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PROCTITLE msg=audit(1793285687.033:3001831): proctitle=706870002D72006563686F202270687020636C69223B