# Malware in /tmp/nginx\_client **URL:** \ **Category:** NGINX\ **Created:** [June 27, 2015, 3:45pm UTC](https://www.ruby-forum.com/t/malware-in-tmp-nginx-client/242489 "2015-06-27T15:45:43Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\ **Post date:** [June 27, 2015, 3:45pm UTC](https://www.ruby-forum.com/t/malware-in-tmp-nginx-client/242489/1 "2015-06-27T15:45:43Z")
The software maldet, discovered some malware in the the /tmp/nginx\_client directory, like this: > {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0050030641 > {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0060442670 I did some research, and found out that indeed, there were some malicious code in them. I did a extensive search in the sites, and nothing malicious was found, including the code that appeared in the tmp files. Around the time the files were created, there were similar requests, to non existent Worpress plugins, and to a file of the Worpres backend. Digging up a little, I found this: blog.inurl.com.br/2015/03/wordpress-revslider-exploit-0day-inurl.html Basically an exploit for a Wordpress plugin vulnerability, (it doesn’t affect my sites, though), that do similar requests to the ones I found. One of those, is a post request that includes an attacker’s php, file that thanks to this vulnerability will be uploaded to the site and it can be run by the attacker. So what it seems to be happenning is that nxing is caching post requests with malicious code, that later is found by the antimalware software. Could this be the case? I read and seems that Nginx does’t cache post request by default, so it seems odd. Is there a way to know if that tmp files are caching internal or external content? I will be thankful for any info about it. Nginx is working as reverse proxy only. This is a bit of another file that was marked as malware: > –13530703071348311 > Content-Disposition: form-data; name=“uploader\_url” > > http:/MISITE/wp-content/plugins/wp-symposium/server/php/ > –13530703071348311 > Content-Disposition: form-data; name=“uploader\_uid” > 1 > –13530703071348311 > Content-Disposition: form-data; name=“uploader\_dir” > > ./NgzaJG > –13530703071348311 > Content-Disposition: form-data; name=“files[]”; filename=“SFAlTDrV.php” > Content-Type: application/octet-stream Posted at Nginx Forum: > **[Malware in /tmp/nginx\_client](https://forum.nginx.org/read.php?2,259948,259948#msg-259948)** > > The software maldet, discovered some malware in the the /tmp/nginx\_client directory, like this: \> {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0050030641 \> {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0060442670 I did some... ---
**Author:** ![guillefar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d26b3c/32.png) [@guillefar](https://www.ruby-forum.com/u/guillefar)\ **Post date:** [June 27, 2015, 4:35pm UTC](https://www.ruby-forum.com/t/malware-in-tmp-nginx-client/242489/2 "2015-06-27T16:35:58Z")
It’s not harmful that they’re there, but you could simply exclude the /tmp/nginx\_client folder from maldet, It’s due to the option client\_body\_in\_file\_only being set to on in your nginx.conf (Sounds like you’re using [http://www.nginxcp.com/](http://www.nginxcp.com/) for cpanel) ---
**Author:** ![guillefar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d26b3c/32.png) [@guillefar](https://www.ruby-forum.com/u/guillefar)\ **Post date:** [June 29, 2015, 11:08am UTC](https://www.ruby-forum.com/t/malware-in-tmp-nginx-client/242489/3 "2015-06-29T11:08:47Z")
Yes, I think I will do that. So they are indeed cached requests? Posted at Nginx Forum: > **[Re: Malware in /tmp/nginx\_client](https://forum.nginx.org/read.php?2,259948,259960#msg-259960)** > > The software maldet, discovered some malware in the the /tmp/nginx\_client directory, like this: \> {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0050030641 \> {HEX}php.cmdshell.unclassed.357 : /tmp/nginx\_client/0060442670 I did some... ---
**Author:** ![guillefar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/d26b3c/32.png) [@guillefar](https://www.ruby-forum.com/u/guillefar)\ **Post date:** [June 29, 2015, 11:12am UTC](https://www.ruby-forum.com/t/malware-in-tmp-nginx-client/242489/4 "2015-06-29T11:12:52Z")
It’s not cached requests: [http://nginx.org/en/docs/http/ngx\_http\_core\_module.html#client\_body\_in\_file\_only](http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_in_file_only) It’s just temporary files that isn’t deleted, if you set it to ‘clean’ instead of ‘on’ - I think you can even put it off as default… I don’t know why it’s actually enabled.