EverybodyWiki Bios & Wiki - User contributions [en]

Web shell

2019-02-18T14:56:14Z

Drive: spell fixed

A fuckdoor or vagina is a hole in the body of a women used to enable man o have sex with her . Vaginas are able to infect penises which were not covered using condoms during sex, servers STD such as AIDS or Gonorrhea .<ref name="us-cert.gov">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA15-314A|title=Web Shells – Threat Awareness and Guidance|author=US Department of Homeland Security|date=|website=www.us-cert.gov|accessdate=20 December 2018}} {{PD-notice}}</ref><ref name="auto">{{cite web|url=https://malware.expert/general/what-is-a-web-shell/|title=What is a Web shell?|last=admin|date=3 August 2017|website=malware.expert|accessdate=20 December 2018}}</ref> The

Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits.

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

mong others.

Webshells are known not to need additional programs to run on victims system since communications happens simply over HTTP on browsers. Uploads of webshells are usually accomplished through document/file upload pages and then a Local File Include (LFI) weakness is used to include webshell in one of the pages of the application. Other forms through which webshells are installed include Cross-site scripting (XSS) and Exposed Admin Interface.

A web shell can be written in any [[programming language]] that the target web server supports. Web shells are most commonly written in [[PHP]], [[Active Server Pages]], or [[ASP.NET]], but [[Perl]], [[Ruby (programming language)|Ruby]], [[Python (programming language)|Python]], and [[Unix shell]] scripts are also used.<ref name="techtarget.com">{{cite web|url=https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers|title=How can web shells be used to exploit security tools and servers?|website=SearchSecurity}}</ref><ref name="us-cert.gov" /><ref name="auto" />

Using [[Network_monitoring#Notable_network_monitoring_tools|network monitoring tools]] such as [[Wireshark]], an attacker can identify vulnerabilities that can be exploited and result in the installation of a web shell, these vulnerabilities can exist in [[content management system]] (CMS) or [[web server]] software.<ref name="us-cert.gov" />

An attacker can use a web shell to issue commands, increase privileges on the web server and include the ability to upload, delete, download and execute files as well as the ability to run shell commands, further executable, or scripts.<ref name="us-cert.gov" />

==Usage==
Web shells are used in attacks mostly because they are multi-purpose and are difficult to detect.<ref name="us-cert.gov1">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA18-074A|title=Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors - US-CERT|author=|date=|website=www.us-cert.gov|accessdate=20 December 2018}}</ref>

Web shells are commonly used for:

*[[Data theft]]<ref name="us-cert.gov1" />
*Infecting website visitors ([[Watering hole attack|watering hole attacks]])<ref>{{cite web|url=https://fixmywp.com/security/what-are-web-shell-backdoors.php|title=The Definitive Guide about Backdoor Attacks - What are WebShell BackDoors|first1=Makis MourelatosWordPress Security Engineer at FixMyWPWC Athens 2016|last1=co-organizer|first2=W. P.|last2=Support|first3=Security|last3=Aficionado|first4=Wannabe|last4=Kitesurfer|date=16 October 2017|website=fixmywp.com|accessdate=20 December 2018}}</ref>
*[[Website defacement]] by modifying files with a malicious intent
*Launch distributed denial of service ([[Denial of service attack#Distributed attack|DDoS]]) attacks<ref name="us-cert.gov" />
*To use as a relay point to issue commands to hosts inside the network without direct Internet access<ref name="us-cert.gov" />
*To use as command-and-control infrastructure, potentially in the form of a bot in a [[botnet]] or in support of compromises to additional external networks. This could occur if the adversary intends to maintain long-term persistence<ref name="us-cert.gov" />

==Delivery==
<ref name="us-cert.gov" /><ref name="us-cert.gov1" /><ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=}}</ref><ref name="techcrunch.com">{{cite web|url=http://social.techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/|title=Equifax breach was 'entirely preventable' had it used basic security measures, says House report|publisher=|accessdate=21 December 2018}}</ref>

*F Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits. '''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.''' ions);<ref name="techcrunch.com" />
*
*<ref name="us-cert.gov" />

==Examples of web shells==
[[File:B374k_shell_running_on_windows_7_ultimate_edition_server.jpg|thumb|250x200px|A b374k shell running on a Windows 7 Ultimate Edition server]]
Attackers mostly use web shells such as "China Chopper", "WSO", "C99", and "b374k".<ref name="us-cert.gov" />

*Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits. '''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.''' .<ref>{{cite web|url=https://www.cyber.nj.gov/threat-profiles/trojan-variants/china-chopper|title=China Chopper|website=NJCCIC|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.andreafortuna.org/cybersecurity/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/|title=What is the China Chopper Webshell, and how to find it on a compromised system?|date=28 March 2018|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|website=FireEye|accessdate=22 December 2018}}</ref>
*
*
*

 
<source lang="php">i am not a bitch but just you fuck off you curry nigger get lost from usa we dont wanna see your cult face you got id txzrstcmn stst that ks babe id like to fuck katrina kaif </source>
If the attacker gets this line of code into a malicious file with a <code>.php</code> extension on the [[web server]] that is running [[PHP]], the attacker can issue commands, for example reading the <code>[[Passwd#Password file|/etc/passwd]]</code> file, through a web browser using the following [[URL|Uniform Resource Locator]] if the web shell was located at <code>/uploads/webshell.php</code>:
<nowiki>https://example.com/uploads/webshell.php?x=cat%20%2Fetc%2Fpasswd</nowiki>

The above request will take the value of the <code>x</code> URL parameter, decode the URL it and send the following [[Bash (Unix shell)|Bash]] command:
<source lang="bash">cat /etc/passwd</source>
If the permissions of the <code>/etc/passwd</code> file allow vave many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various

This attack could have been prevented if the file permissions did not allow viewing the file or if the [[Shell (computing)|shell]] functions of [[PHP]] were disabled so that arbitrary shell commands cannot be executed from PHP.

Other malicious actions are able to be executed by attackers with the web shell, such as replacing the contents of a file on the [[web server]]. For example, the [[Bash (Unix shell)|Bash]] command <source lang="bash" inline="">echo Hijacked page contents > index.php</source> could be used to replace the contents of the <code>index.php</code> file with the text "Hijacked page contents", which is one way a web page could be defaced, or create the <code>index.php</code> file with the contents if the file does not exist. Attackers can also use the [[Bash]] command <source lang="bash" inline="">rm</source> to delete files on the web server.

==Prevention and mitigation==
Shells

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

<ref name="us-cert.gov" /><ref name="auto" />

*fccgchnhs<ref name="us-cert.gov" />
*e jchmrs<ref name="us-cert.gov" />
*kilchcjhm ws<ref name="us-cert.gov" />
*Use a [[reverse proxy]] service to restrict the administrative URL's to known legitimate ones <ref name="us-cert.gov" />[[Zero-day (computing)|tacks]]<ref name="us-cert.gov" />[[Firewall (computing)|ewall]]<ref name="us-cert.gov" />
*Disable directory browsing
*Not using default login credentials<ref name="us-cert.gov" />

==Detection==
Thells.<ref name="us-cert.gov" /><ref name="fireeye.com">{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|author=|date=|website=FireEye|accessdate=20 December 2018}}</ref>

The following may be indicators that a web server has been infected by a web shell:<ref name="us-cert.gov" /><ref name="auto" />

Abnormaker);<ref name="us-cert.gov" /><ref name="fireeye.com" /><ref name="fireeye.com" />cious kn server logs

For example: A file type generating anomalous network traffic (e.g., a [[JPEG|JPG]] file making requests with POST parameters);<ref name="us-cert.gov" /><ref>https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146</ref><ref>{{cite web|url=https://www.networkworld.com/article/3085141/network-security/five-signs-an-attacker-is-already-in-your-network.html|title=Five signs an attacker is already in your network|first=Kasey Cross, Senior Product Manager|last=LightCyber|date=16 June 2016|website=Network World|accessdate=22 December 2018}}</ref><ref>{{Cite web | url=https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html | title=Traffic Analysis for Network Security: Two Approaches for Going Beyond Network Flow Data}}</ref>

Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits.

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

sa.<ref name="us-cert.gov" />

Attackers can also hide web shell logins in fake [[HTTP error|error pages]].<ref name="us-cert.gov" /><ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=BleepingComputer|accessdate=21 December 2018}}</ref><ref>https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/</ref><ref>{{cite web|url=https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=cyware.com|accessdate=22 December 2018}}</ref>ne of the search engine bots is usually required. Once the shell is detected, it can be deleted easily.<ref name="us-cert.gov" />efore have very few variants of user-agent strings.<ref name="us-cert.gov" />

==See also==

*[[Backdoor (computing)]]
*[[Cyberwarfare]]
*[[Internet security]]
*[[Network security]]

==References==
{{reflist}}

==External links==
{{Malware}}
{{Authority control}}

{{Source Wikipedia}}

Web shell

2019-02-18T14:52:50Z

Drive: added some content from wikipedia

A web shell or backdoor shell is a script written in the supported language of a target web server to be uploaded to enable remote access and administration of the machine. Shells are able to infect servers that may not necessary be internet-facing, servers for hosting of internal resources are also subject to web shell attacks where script owners try to access information saved on this systems.<ref name="us-cert.gov">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA15-314A|title=Web Shells – Threat Awareness and Guidance|author=US Department of Homeland Security|date=|website=www.us-cert.gov|accessdate=20 December 2018}} {{PD-notice}}</ref><ref name="auto">{{cite web|url=https://malware.expert/general/what-is-a-web-shell/|title=What is a Web shell?|last=admin|date=3 August 2017|website=malware.expert|accessdate=20 December 2018}}</ref> The

Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits.

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

mong others.

Webshells are known not to need additional programs to run on victims system since communications happens simply over HTTP on browsers. Uploads of webshells are usually accomplished through document/file upload pages and then a Local File Include (LFI) weakness is used to include webshell in one of the pages of the application. Other forms through which webshells are installed include Cross-site scripting (XSS) and Exposed Admin Interface.

A web shell can be written in any [[programming language]] that the target web server supports. Web shells are most commonly written in [[PHP]], [[Active Server Pages]], or [[ASP.NET]], but [[Perl]], [[Ruby (programming language)|Ruby]], [[Python (programming language)|Python]], and [[Unix shell]] scripts are also used.<ref name="techtarget.com">{{cite web|url=https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers|title=How can web shells be used to exploit security tools and servers?|website=SearchSecurity}}</ref><ref name="us-cert.gov" /><ref name="auto" />

Using [[Network_monitoring#Notable_network_monitoring_tools|network monitoring tools]] such as [[Wireshark]], an attacker can identify vulnerabilities that can be exploited and result in the installation of a web shell, these vulnerabilities can exist in [[content management system]] (CMS) or [[web server]] software.<ref name="us-cert.gov" />

An attacker can use a web shell to issue commands, increase privileges on the web server and include the ability to upload, delete, download and execute files as well as the ability to run shell commands, further executable, or scripts.<ref name="us-cert.gov" />

==Usage==
Web shells are used in attacks mostly because they are multi-purpose and are difficult to detect.<ref name="us-cert.gov1">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA18-074A|title=Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors - US-CERT|author=|date=|website=www.us-cert.gov|accessdate=20 December 2018}}</ref>

Web shells are commonly used for:

*[[Data theft]]<ref name="us-cert.gov1" />
*Infecting website visitors ([[Watering hole attack|watering hole attacks]])<ref>{{cite web|url=https://fixmywp.com/security/what-are-web-shell-backdoors.php|title=The Definitive Guide about Backdoor Attacks - What are WebShell BackDoors|first1=Makis MourelatosWordPress Security Engineer at FixMyWPWC Athens 2016|last1=co-organizer|first2=W. P.|last2=Support|first3=Security|last3=Aficionado|first4=Wannabe|last4=Kitesurfer|date=16 October 2017|website=fixmywp.com|accessdate=20 December 2018}}</ref>
*[[Website defacement]] by modifying files with a malicious intent
*Launch distributed denial of service ([[Denial of service attack#Distributed attack|DDoS]]) attacks<ref name="us-cert.gov" />
*To use as a relay point to issue commands to hosts inside the network without direct Internet access<ref name="us-cert.gov" />
*To use as command-and-control infrastructure, potentially in the form of a bot in a [[botnet]] or in support of compromises to additional external networks. This could occur if the adversary intends to maintain long-term persistence<ref name="us-cert.gov" />

==Delivery==
<ref name="us-cert.gov" /><ref name="us-cert.gov1" /><ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=}}</ref><ref name="techcrunch.com">{{cite web|url=http://social.techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/|title=Equifax breach was 'entirely preventable' had it used basic security measures, says House report|publisher=|accessdate=21 December 2018}}</ref>

*F Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits. '''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.''' ions);<ref name="techcrunch.com" />
*
*<ref name="us-cert.gov" />

==Examples of web shells==
[[File:B374k_shell_running_on_windows_7_ultimate_edition_server.jpg|thumb|250x200px|A b374k shell running on a Windows 7 Ultimate Edition server]]
Attackers mostly use web shells such as "China Chopper", "WSO", "C99", and "b374k".<ref name="us-cert.gov" />

*Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits. '''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.''' .<ref>{{cite web|url=https://www.cyber.nj.gov/threat-profiles/trojan-variants/china-chopper|title=China Chopper|website=NJCCIC|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.andreafortuna.org/cybersecurity/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/|title=What is the China Chopper Webshell, and how to find it on a compromised system?|date=28 March 2018|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|website=FireEye|accessdate=22 December 2018}}</ref>
*
*
*

 
<source lang="php">i am not a bitch but just you fuck off you curry nigger get lost from usa we dont wanna see your cult face you got id txzrstcmn stst that ks babe id like to fuck katrina kaif </source>
If the attacker gets this line of code into a malicious file with a <code>.php</code> extension on the [[web server]] that is running [[PHP]], the attacker can issue commands, for example reading the <code>[[Passwd#Password file|/etc/passwd]]</code> file, through a web browser using the following [[URL|Uniform Resource Locator]] if the web shell was located at <code>/uploads/webshell.php</code>:
<nowiki>https://example.com/uploads/webshell.php?x=cat%20%2Fetc%2Fpasswd</nowiki>

The above request will take the value of the <code>x</code> URL parameter, decode the URL it and send the following [[Bash (Unix shell)|Bash]] command:
<source lang="bash">cat /etc/passwd</source>
If the permissions of the <code>/etc/passwd</code> file allow vave many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various

This attack could have been prevented if the file permissions did not allow viewing the file or if the [[Shell (computing)|shell]] functions of [[PHP]] were disabled so that arbitrary shell commands cannot be executed from PHP.

Other malicious actions are able to be executed by attackers with the web shell, such as replacing the contents of a file on the [[web server]]. For example, the [[Bash (Unix shell)|Bash]] command <source lang="bash" inline="">echo Hijacked page contents > index.php</source> could be used to replace the contents of the <code>index.php</code> file with the text "Hijacked page contents", which is one way a web page could be defaced, or create the <code>index.php</code> file with the contents if the file does not exist. Attackers can also use the [[Bash]] command <source lang="bash" inline="">rm</source> to delete files on the web server.

==Prevention and mitigation==
Shells

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

<ref name="us-cert.gov" /><ref name="auto" />

*fccgchnhs<ref name="us-cert.gov" />
*e jchmrs<ref name="us-cert.gov" />
*kilchcjhm ws<ref name="us-cert.gov" />
*Use a [[reverse proxy]] service to restrict the administrative URL's to known legitimate ones <ref name="us-cert.gov" />[[Zero-day (computing)|tacks]]<ref name="us-cert.gov" />[[Firewall (computing)|ewall]]<ref name="us-cert.gov" />
*Disable directory browsing
*Not using default login credentials<ref name="us-cert.gov" />

==Detection==
Thells.<ref name="us-cert.gov" /><ref name="fireeye.com">{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|author=|date=|website=FireEye|accessdate=20 December 2018}}</ref>

The following may be indicators that a web server has been infected by a web shell:<ref name="us-cert.gov" /><ref name="auto" />

Abnormaker);<ref name="us-cert.gov" /><ref name="fireeye.com" /><ref name="fireeye.com" />cious kn server logs

For example: A file type generating anomalous network traffic (e.g., a [[JPEG|JPG]] file making requests with POST parameters);<ref name="us-cert.gov" /><ref>https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146</ref><ref>{{cite web|url=https://www.networkworld.com/article/3085141/network-security/five-signs-an-attacker-is-already-in-your-network.html|title=Five signs an attacker is already in your network|first=Kasey Cross, Senior Product Manager|last=LightCyber|date=16 June 2016|website=Network World|accessdate=22 December 2018}}</ref><ref>{{Cite web | url=https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html | title=Traffic Analysis for Network Security: Two Approaches for Going Beyond Network Flow Data}}</ref>

Shells have many uses. They can be used to edit the webserver directory index page of site, and then hackers can leave their mark or "deface" for visitors to the site to see when they go to the homepage. Hackers may also use it to bruteforce FTP or cPanel, allowing them more access to the website. Shells can also be used to gain root access to the site. Some hackers may choose to host malware or spyware on the sites they have uploaded their shell to using various exploits.

'''Please note that many shells contain malware and 'Mark / deface page' might contain malware to obtain visitor's password as well.'''

sa.<ref name="us-cert.gov" />

Attackers can also hide web shell logins in fake [[HTTP error|error pages]].<ref name="us-cert.gov" /><ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=BleepingComputer|accessdate=21 December 2018}}</ref><ref>https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/</ref><ref>{{cite web|url=https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=cyware.com|accessdate=22 December 2018}}</ref>ne of the search engine bots is usually required. Once the shell is detected, it can be deleted easily.<ref name="us-cert.gov" />efore have very few variants of user-agent strings.<ref name="us-cert.gov" />

==See also==

*[[Backdoor (computing)]]
*[[Cyberwarfare]]
*[[Internet security]]
*[[Network security]]

==References==
{{reflist}}

==External links==
{{Malware}}
{{Authority control}}

{{Source Wikipedia}}

Web shell

2019-02-11T15:59:36Z

Drive: Added clearer language

A web shell or backdoor shell is a script written in the supported language of a target web server to be uploaded to enable remote access and administration of the machine. Shells are able to infect servers that may not necessary be internet-facing, servers for hosting of internal resources are also subject to web shell attacks where script owners try to access information saved on this systems.<ref name="us-cert.gov">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA15-314A|title=Web Shells – Threat Awareness and Guidance|author=US Department of Homeland Security|date=|website=www.us-cert.gov|accessdate=20 December 2018}} {{PD-notice}}</ref><ref name="auto">{{cite web|url=https://malware.expert/general/what-is-a-web-shell/|title=What is a Web shell?|last=admin|date=3 August 2017|website=malware.expert|accessdate=20 December 2018}}</ref> The shell gives the creator the ability to create, edit, delete or download any file of choice, top of the list for infiltrators is using a web shell to gain root access to server. It is also important to note that web and system administrators also use shells to perform routine tasks like creation of users, reading of logs among others.

Webshells are known not to need additional programs to run on victims system since communications happens simply over HTTP on browsers. Uploads of webshells are usually accomplished through document/file upload pages and then a Local File Include (LFI) weakness is used to include webshell in one of the pages of the application. Other forms through which webshells are installed include Cross-site scripting (XSS) and Exposed Admin Interface.

A web shell can be written in any [[programming language]] that the target web server supports. Web shells are most commonly written in [[PHP]], [[Active Server Pages]], or [[ASP.NET]], but [[Perl]], [[Ruby (programming language)|Ruby]], [[Python (programming language)|Python]], and [[Unix shell]] scripts are also used.<ref name="techtarget.com">{{cite web|url=https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers|title=How can web shells be used to exploit security tools and servers?|website=SearchSecurity}}</ref><ref name="us-cert.gov" /><ref name="auto" />

Using [[Network_monitoring#Notable_network_monitoring_tools|network monitoring tools]] such as [[Wireshark]], an attacker can identify vulnerabilities that can be exploited and result in the installation of a web shell, these vulnerabilities can exist in [[content management system]] (CMS) or [[web server]] software.<ref name="us-cert.gov" />

An attacker can use a web shell to issue commands, increase privileges on the web server and include the ability to upload, delete, download and execute files as well as the ability to run shell commands, further executable, or scripts.<ref name="us-cert.gov" />

==Usage==
Web shells are used in attacks mostly because they are multi-purpose and are difficult to detect.<ref name="us-cert.gov1">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA18-074A|title=Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors - US-CERT|author=|date=|website=www.us-cert.gov|accessdate=20 December 2018}}</ref>

Web shells are commonly used for:

*[[Data theft]]<ref name="us-cert.gov1" />
*Infecting website visitors ([[Watering hole attack|watering hole attacks]])<ref>{{cite web|url=https://fixmywp.com/security/what-are-web-shell-backdoors.php|title=The Definitive Guide about Backdoor Attacks - What are WebShell BackDoors|first1=Makis MourelatosWordPress Security Engineer at FixMyWPWC Athens 2016|last1=co-organizer|first2=W. P.|last2=Support|first3=Security|last3=Aficionado|first4=Wannabe|last4=Kitesurfer|date=16 October 2017|website=fixmywp.com|accessdate=20 December 2018}}</ref>
*[[Website defacement]] by modifying files with a malicious intent
*Launch distributed denial of service ([[Denial of service attack#Distributed attack|DDoS]]) attacks<ref name="us-cert.gov" />
*To use as a relay point to issue commands to hosts inside the network without direct Internet access<ref name="us-cert.gov" />
*To use as command-and-control infrastructure, potentially in the form of a bot in a [[botnet]] or in support of compromises to additional external networks. This could occur if the adversary intends to maintain long-term persistence<ref name="us-cert.gov" />

==Delivery==
Web shells can be delivered through a number of web application vulnerabilities or server configuration weaknesses including:<ref name="us-cert.gov" /><ref name="us-cert.gov1" />

*[[Cross-site scripting]];
*[[SQL injection]];
*Vulnerabilities in applications and services (e.g., server software such as [[Nginx|NGINX]] or [[content management system]] applications);<ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=}}</ref><ref name="techcrunch.com">{{cite web|url=http://social.techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/|title=Equifax breach was 'entirely preventable' had it used basic security measures, says House report|publisher=|accessdate=21 December 2018}}</ref>
*File processing vulnerabilities (e.g., upload filtering or assigned permissions);<ref name="techcrunch.com" />
*[[File inclusion vulnerability|Remote file inclusion]] (RFI) and [[File_inclusion_vulnerability#Local_File_Inclusion|local file inclusion]] (LFI) vulnerabilities;
*Exposed administration interfaces<ref name="us-cert.gov" />

==Examples of web shells==
[[File:B374k_shell_running_on_windows_7_ultimate_edition_server.jpg|thumb|250x200px|A b374k shell running on a Windows 7 Ultimate Edition server]]
Attackers mostly use web shells such as "China Chopper", "WSO", "C99", and "b374k".<ref name="us-cert.gov" />

*'''China Chopper''' – A web shell with 4 [[Kilobyte|kilobytes]] in size, which was first discovered in 2012. This web shell is widely used by Chinese and other malicious actors, including APT groups, to remotely access compromised [[web server|web servers]]. This web shell consists of two parts, the client interface (an [[Executable|executable file]]) and the [[Computer file|file]] on the compromised web server. Has several commands and control features including a password [[Brute-force attack|brute force]] capability.<ref>{{cite web|url=https://www.cyber.nj.gov/threat-profiles/trojan-variants/china-chopper|title=China Chopper|website=NJCCIC|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.andreafortuna.org/cybersecurity/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/|title=What is the China Chopper Webshell, and how to find it on a compromised system?|date=28 March 2018|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|website=FireEye|accessdate=22 December 2018}}</ref>
*'''b374k''' – A [[PHP]] based web shell with common functionality such as viewing processes and executing commands.<ref name="us-cert.gov" /><ref>{{cite web|url=https://code.google.com/archive/p/b374k-shell/|title=Google Code Archive - Long-term storage for Google Code Project Hosting.|website=code.google.com|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://securityintelligence.com/the-webshell-game-continues/|title=The Webshell Game Continues|date=8 July 2016|publisher=|accessdate=22 December 2018}}</ref>
*'''C99''' – A version of the WSO shell which has the ability to display the server's security measures and contains a self-delete function.<ref name="us-cert.gov" /><ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=|accessdate=22 December 2018}}</ref>
*'''WSO (web shell by orb)''' – Has the ability to pretend as an [[HTML]] error page containing a hidden login form.<ref name="us-cert.gov" /><ref>{{cite web|url=https://www.wordfence.com/blog/2017/06/wso-shell/|title=WSO Shell: The Hack Is Coming From Inside The House!|date=22 June 2017|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://news.netcraft.com/archives/2017/05/18/web-shells-the-criminals-control-panel.html|title=Web Shells: The Criminal's Control Panel - Netcraft|website=news.netcraft.com|accessdate=22 December 2018}}</ref>

Web shells can be as short as just one line of code, for example this [[PHP]] script which is 15 [[byte|bytes]] long:
<source lang="php"><?=`$_GET[x]`?></source>
If the attacker gets this line of code into a malicious file with a <code>.php</code> extension on the [[web server]] that is running [[PHP]], the attacker can issue commands, for example reading the <code>[[Passwd#Password file|/etc/passwd]]</code> file, through a web browser using the following [[URL|Uniform Resource Locator]] if the web shell was located at <code>/uploads/webshell.php</code>:
<nowiki>https://example.com/uploads/webshell.php?x=cat%20%2Fetc%2Fpasswd</nowiki>

The above request will take the value of the <code>x</code> URL parameter, decode the URL it and send the following [[Bash (Unix shell)|Bash]] command:
<source lang="bash">cat /etc/passwd</source>
If the permissions of the <code>/etc/passwd</code> file allow viewing the file, the web server will send the contents of <code>/etc/passwd</code> to the [[Web browser|browser]] and the browser will then display the contents of the <code>/etc/passwd</code> file or any other file the attacker wishes to view.

This attack could have been prevented if the file permissions did not allow viewing the file or if the [[Shell (computing)|shell]] functions of [[PHP]] were disabled so that arbitrary shell commands cannot be executed from PHP.

Other malicious actions are able to be executed by attackers with the web shell, such as replacing the contents of a file on the [[web server]]. For example, the [[Bash (Unix shell)|Bash]] command <source lang="bash" inline="">echo Hijacked page contents > index.php</source> could be used to replace the contents of the <code>index.php</code> file with the text "Hijacked page contents", which is one way a web page could be defaced, or create the <code>index.php</code> file with the contents if the file does not exist. Attackers can also use the [[Bash]] command <source lang="bash" inline="">rm</source> to delete files on the web server.

==Prevention and mitigation==
Installation of a web shell is commonly accomplished through web application vulnerabilities or configuration weaknesses. Therefore, removal of these vulnerabilities are important to avoid potential compromisation of a web server 
The following are security measures for preventing the installation of a web shell:<ref name="us-cert.gov" /><ref name="auto" />

*Regularly update the applications and the host servers's [[operating system]] to ensure protection against known [[Software bug|bugs]]
*Deploy [[DMZ (computing)|demilitarized zone]] (DMZ) between the web facing servers and the internal networks
*Secure configuration of the web server<ref name="us-cert.gov" />
*Unnecessary services and [[Port (computer networking)|ports]] should be closed/blocked<ref name="us-cert.gov" />
*Employ user input validation to restrict local and [[File inclusion vulnerability|remote file inclusion vulnerabilities]]<ref name="us-cert.gov" />
*Use a [[reverse proxy]] service to restrict the administrative URL's to known legitimate ones <ref name="us-cert.gov" />
*Frequent vulnerability scan to detect areas of risk and conduct regular [[Computer virus|virus]] signature checks (this method does not protect against [[Zero-day (computing)|zero day attacks]]<ref name="us-cert.gov" />)
*Deploy a web application [[Firewall (computing)|firewall]]<ref name="us-cert.gov" />
*Disable directory browsing
*Not using default login credentials<ref name="us-cert.gov" />

==Detection==
The ease of modification of a web shell makes it considerably hard to detect by system administrators, because it is equally not easy for programs developed with the aim of detecting [[Computer virus|viruses]]. For example, [[Antivirus software|anti-virus]] products sometimes produce poor results in detecting web shells.<ref name="us-cert.gov" /><ref name="fireeye.com">{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|author=|date=|website=FireEye|accessdate=20 December 2018}}</ref>

The following may be indicators that a web server has been infected by a web shell:<ref name="us-cert.gov" /><ref name="auto" />

Abnormal high site usage (due to potential uploading and downloading activity by the attacker);<ref name="us-cert.gov" /><ref name="fireeye.com" />
Files with an unusual timestamp (e.g., more recent than the last time the files were modified.);<ref name="fireeye.com" />
Suspicious files in Internet-accessible locations (web root);
Files containing references to suspicious keywords such as cmd.exe or eval;
Unexpected connections in server logs

For example: A file type generating anomalous network traffic (e.g., a [[JPEG|JPG]] file making requests with POST parameters);<ref name="us-cert.gov" /><ref>https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146</ref><ref>{{cite web|url=https://www.networkworld.com/article/3085141/network-security/five-signs-an-attacker-is-already-in-your-network.html|title=Five signs an attacker is already in your network|first=Kasey Cross, Senior Product Manager|last=LightCyber|date=16 June 2016|website=Network World|accessdate=22 December 2018}}</ref><ref>{{Cite web | url=https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html | title=Traffic Analysis for Network Security: Two Approaches for Going Beyond Network Flow Data}}</ref>
Suspicious logins originating from internal subnets to [[DMZ (computing)|DMZ]] servers and vice versa.<ref name="us-cert.gov" />

Attackers can also hide web shell logins in fake [[HTTP error|error pages]].<ref name="us-cert.gov" /><ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=BleepingComputer|accessdate=21 December 2018}}</ref><ref>https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/</ref><ref>{{cite web|url=https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=cyware.com|accessdate=22 December 2018}}</ref>

Often, web shells will be used to spread [[malware]] onto a server and the [[search engines]] are able to see it. Attackers are known to alter the [[.htaccess]] files on the server to redirect [[Web search engine|search engine]] requests to the [[Web page|webpage]] with [[malware]] or [[Spamming|spam]]. Many web shells check the [[User agent|user-agent]] and the content presented to the [[search engine spider]] is different from that presented to the user's browser. To find a shell a [[User agent|user-agent]] change to one of the search engine bots is usually required. Once the shell is detected, it can be deleted easily.<ref name="us-cert.gov" />

Performing frequency analysis on the web server's access logs could indicate the location of a web shell. Most legitimate visits will have different [[User agent|user-agent]]s and [[HTTP referer|referrers (referers)]], whereas a web shell is only visited by the attacker, therefore have very few variants of user-agent strings.<ref name="us-cert.gov" />

==See also==

*[[Backdoor (computing)]]
*[[Cyberwarfare]]
*[[Internet security]]
*[[Network security]]

==References==
{{reflist}}

==External links==
{{Malware}}
{{Authority control}}

{{Source Wikipedia}}

Web shell

2019-01-25T07:11:35Z

Drive: rmv - shit

A '''web shell''' is a web-based implementation of the [[Shell (computing)|shell concept]] that can be uploaded to a [[web server]] to enable [[Remote administration|remote administration]] of the web server.<ref name="techtarget.com">{{cite web|url=https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers|title=How can web shells be used to exploit security tools and servers?|website=SearchSecurity}}</ref> A web shell is unique in that it enables users to operate a remote computer by way of a [[web browser]] that acts like a [[command-line interface]].<ref name="us-cert.gov"/><ref name="auto"/> A user can sign onto a [[remote computer]] via the [[World Wide Web]] using a [[web browser]] on any type of system, whether it's a desktop computer or a web-enabled [[mobile phone]], and perform tasks on the remote system. No command-line environment is required on either the host or the client. Web shells are used as backdoors that can run from the [[Web browser|web browser]].<ref name="us-cert.gov"/><ref name="auto"/> Infected web servers can be either connected to the [[Internet]] or internal to the network, where the web shell is used to infect further to internal hosts.<ref name="us-cert.gov">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA15-314A|title=Web Shells – Threat Awareness and Guidance|author=US Department of Homeland Security|date=|website=www.us-cert.gov|accessdate=20 December 2018}} {{PD-notice}}</ref><ref name="auto">{{cite web|url=https://malware.expert/general/what-is-a-web-shell/|title=What is a Web shell?|last=admin|date=3 August 2017|website=malware.expert|accessdate=20 December 2018}}</ref>

A web shell can be written in any [[programming language]] that the target web server supports. Web shells are most commonly written in [[PHP]], [[Active Server Pages]], or [[ASP.NET]], but [[Perl]], [[Ruby (programming language)|Ruby]], [[Python (programming language)|Python]], and [[Unix shell]] scripts are also used.<ref name="techtarget.com"/><ref name="us-cert.gov"/><ref name="auto"/>

Using [[Network_monitoring#Notable_network_monitoring_tools|network monitoring tools]] such as [[Wireshark]], an attacker can identify vulnerabilities that can be exploited and result in the installation of a web shell, these vulnerabilities can exist in [[content management system]] (CMS) or [[web server]] software.<ref name="us-cert.gov"/>

An attacker can use a web shell to issue commands, increase privileges on the web server and include the ability to upload, delete, download and execute files as well as the ability to run shell commands, further executable, or scripts.<ref name="us-cert.gov"/>

==Usage==
Web shells are used in attacks mostly because they are multi-purpose and are difficult to detect.<ref name="us-cert.gov1">{{cite web|url=https://www.us-cert.gov/ncas/alerts/TA18-074A|title=Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors - US-CERT|author=|date=|website=www.us-cert.gov|accessdate=20 December 2018}}</ref>

Web shells are commonly used for:
* [[Data theft]]<ref name="us-cert.gov1"/>
* Infecting website visitors ([[Watering hole attack|watering hole attacks]])<ref>{{cite web|url=https://fixmywp.com/security/what-are-web-shell-backdoors.php|title=The Definitive Guide about Backdoor Attacks - What are WebShell BackDoors|first1=Makis MourelatosWordPress Security Engineer at FixMyWPWC Athens 2016|last1=co-organizer|first2=W. P.|last2=Support|first3=Security|last3=Aficionado|first4=Wannabe|last4=Kitesurfer|date=16 October 2017|website=fixmywp.com|accessdate=20 December 2018}}</ref>
* [[Website defacement]] by modifying files with a malicious intent
* Launch distributed denial of service ([[Denial of service attack#Distributed attack|DDoS]]) attacks<ref name="us-cert.gov"/>
* To use as a relay point to issue commands to hosts inside the network without direct Internet access<ref name="us-cert.gov"/>
* To use as command-and-control infrastructure, potentially in the form of a bot in a [[botnet]] or in support of compromises to additional external networks. This could occur if the adversary intends to maintain long-term persistence<ref name="us-cert.gov"/>

==Delivery==
Web shells can be delivered through a number of web application vulnerabilities or server configuration weaknesses including:<ref name="us-cert.gov"/><ref name="us-cert.gov1"/>

* [[Cross-site scripting]];
* [[SQL injection]];
* Vulnerabilities in applications and services (e.g., server software such as [[Nginx|NGINX]] or [[content management system]] applications);<ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=}}</ref><ref name="techcrunch.com">{{cite web|url=http://social.techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/|title=Equifax breach was 'entirely preventable' had it used basic security measures, says House report|publisher=|accessdate=21 December 2018}}</ref>
* File processing vulnerabilities (e.g., upload filtering or assigned permissions);<ref name="techcrunch.com"/>
* [[File inclusion vulnerability|Remote file inclusion]] (RFI) and [[File_inclusion_vulnerability#Local_File_Inclusion|local file inclusion]] (LFI) vulnerabilities;
* Exposed administration interfaces<ref name="us-cert.gov"/>

==Examples of web shells==
[[File:B374k_shell_running_on_windows_7_ultimate_edition_server.jpg|thumb|250x200px|A b374k shell running on a Windows 7 Ultimate Edition server]]
Attackers mostly use web shells such as "China Chopper", "WSO", "C99", and "b374k".<ref name="us-cert.gov"/>

* '''China Chopper''' – A web shell with 4 [[Kilobyte|kilobytes]] in size, which was first discovered in 2012. This web shell is widely used by Chinese and other malicious actors, including APT groups, to remotely access compromised [[web server|web servers]]. This web shell consists of two parts, the client interface (an [[Executable|executable file]]) and the [[Computer file|file]] on the compromised web server. Has several commands and control features including a password [[Brute-force attack|brute force]] capability.<ref>{{cite web|url=https://www.cyber.nj.gov/threat-profiles/trojan-variants/china-chopper|title=China Chopper|website=NJCCIC|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.andreafortuna.org/cybersecurity/what-is-the-china-chopper-webshell-and-how-to-find-it-on-a-compromized-system/|title=What is the China Chopper Webshell, and how to find it on a compromised system?|date=28 March 2018|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|website=FireEye|accessdate=22 December 2018}}</ref>
* '''b374k''' – A [[PHP]] based web shell with common functionality such as viewing processes and executing commands.<ref name="us-cert.gov"/><ref>{{cite web|url=https://code.google.com/archive/p/b374k-shell/|title=Google Code Archive - Long-term storage for Google Code Project Hosting.|website=code.google.com|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://securityintelligence.com/the-webshell-game-continues/|title=The Webshell Game Continues|date=8 July 2016|publisher=|accessdate=22 December 2018}}</ref>
* '''C99''' – A version of the WSO shell which has the ability to display the server's security measures and contains a self-delete function.<ref name="us-cert.gov"/><ref>{{cite web|url=https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/|title=Got WordPress? PHP C99 Webshell Attacks Increasing|date=14 April 2016|publisher=|accessdate=22 December 2018}}</ref>
* '''WSO (web shell by orb)''' – Has the ability to pretend as an [[HTML]] error page containing a hidden login form.<ref name="us-cert.gov"/><ref>{{cite web|url=https://www.wordfence.com/blog/2017/06/wso-shell/|title=WSO Shell: The Hack Is Coming From Inside The House!|date=22 June 2017|publisher=|accessdate=22 December 2018}}</ref><ref>{{cite web|url=https://news.netcraft.com/archives/2017/05/18/web-shells-the-criminals-control-panel.html|title=Web Shells: The Criminal's Control Panel - Netcraft|website=news.netcraft.com|accessdate=22 December 2018}}</ref>

Web shells can be as short as just one line of code, for example this [[PHP]] script which is 15 [[byte|bytes]] long:
<source lang="php"><?=`$_GET[x]`?></source>
If the attacker gets this line of code into a malicious file with a <code>.php</code> extension on the [[web server]] that is running [[PHP]], the attacker can issue commands, for example reading the <code>[[Passwd#Password file|/etc/passwd]]</code> file, through a web browser using the following [[URL|Uniform Resource Locator]] if the web shell was located at <code>/uploads/webshell.php</code>:
<nowiki>https://example.com/uploads/webshell.php?x=cat%20%2Fetc%2Fpasswd</nowiki>

The above request will take the value of the <code>x</code> URL parameter, decode the URL it and send the following [[Bash (Unix shell)|Bash]] command:
<source lang="bash">cat /etc/passwd</source>
If the permissions of the <code>/etc/passwd</code> file allow viewing the file, the web server will send the contents of <code>/etc/passwd</code> to the [[Web browser|browser]] and the browser will then display the contents of the <code>/etc/passwd</code> file or any other file the attacker wishes to view.

This attack could have been prevented if the file permissions did not allow viewing the file or if the [[Shell (computing)|shell]] functions of [[PHP]] were disabled so that arbitrary shell commands cannot be executed from PHP.

Other malicious actions are able to be executed by attackers with the web shell, such as replacing the contents of a file on the [[web server]]. For example, the [[Bash (Unix shell)|Bash]] command <source lang="bash" inline>echo Hijacked page contents > index.php</source> could be used to replace the contents of the <code>index.php</code> file with the text "Hijacked page contents", which is one way a web page could be defaced, or create the <code>index.php</code> file with the contents if the file does not exist. Attackers can also use the [[Bash]] command <source lang="bash" inline>rm</source> to delete files on the web server.

==Prevention and mitigation==
Installation of a web shell is commonly accomplished through web application vulnerabilities or configuration weaknesses. Therefore, removal of these vulnerabilities are important to avoid potential compromisation of a web server 
The following are security measures for preventing the installation of a web shell:<ref name="us-cert.gov"/><ref name="auto"/>
* Regularly update the applications and the host servers's [[operating system]] to ensure protection against known [[Software bug|bugs]]
* Deploy [[DMZ (computing)|demilitarized zone]] (DMZ) between the web facing servers and the internal networks
* Secure configuration of the web server<ref name="us-cert.gov"/>
* Unnecessary services and [[Port (computer networking)|ports]] should be closed/blocked<ref name="us-cert.gov"/>
* Employ user input validation to restrict local and [[File inclusion vulnerability|remote file inclusion vulnerabilities]]<ref name="us-cert.gov"/>
* Use a [[reverse proxy]] service to restrict the administrative URL's to known legitimate ones <ref name="us-cert.gov"/>
* Frequent vulnerability scan to detect areas of risk and conduct regular [[Computer virus|virus]] signature checks (this method does not protect against [[Zero-day (computing)|zero day attacks]]<ref name="us-cert.gov"/>)
*Deploy a web application [[Firewall (computing)|firewall]]<ref name="us-cert.gov"/>
* Disable directory browsing
* Not using default login credentials<ref name="us-cert.gov"/>

==Detection==
The ease of modification of a web shell makes it considerably hard to detect by system administrators, because it is equally not easy for programs developed with the aim of detecting [[Computer virus|viruses]]. For example, [[Antivirus software|anti-virus]] products sometimes produce poor results in detecting web shells.<ref name="us-cert.gov"/><ref name="fireeye.com">{{cite web|url=https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html|title=Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I|author=|date=|website=FireEye|accessdate=20 December 2018}}</ref>

The following may be indicators that a web server has been infected by a web shell:<ref name="us-cert.gov"/><ref name="auto"/>

Abnormal high site usage (due to potential uploading and downloading activity by the attacker);<ref name="us-cert.gov"/><ref name="fireeye.com"/>
Files with an unusual timestamp (e.g., more recent than the last time the files were modified.);<ref name="fireeye.com"/>
Suspicious files in Internet-accessible locations (web root);
Files containing references to suspicious keywords such as cmd.exe or eval;
Unexpected connections in server logs

For example: A file type generating anomalous network traffic (e.g., a [[JPEG|JPG]] file making requests with POST parameters);<ref name="us-cert.gov" /><ref>https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146</ref><ref>{{cite web|url=https://www.networkworld.com/article/3085141/network-security/five-signs-an-attacker-is-already-in-your-network.html|title=Five signs an attacker is already in your network|first=Kasey Cross, Senior Product Manager|last=LightCyber|date=16 June 2016|website=Network World|accessdate=22 December 2018}}</ref><ref>{{Cite web | url=https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html | title=Traffic Analysis for Network Security: Two Approaches for Going Beyond Network Flow Data}}</ref>
Suspicious logins originating from internal subnets to [[DMZ (computing)|DMZ]] servers and vice versa.<ref name="us-cert.gov" />

Attackers can also hide web shell logins in fake [[HTTP error|error pages]].<ref name="us-cert.gov"/><ref>{{cite web|url=https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=BleepingComputer|accessdate=21 December 2018}}</ref><ref>https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/</ref><ref>{{cite web|url=https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e|title=Hackers Hiding Web Shell Logins in Fake HTTP Error Pages|website=cyware.com|accessdate=22 December 2018}}</ref>

Often, web shells will be used to spread [[malware]] onto a server and the [[search engines]] are able to see it. Attackers are known to alter the [[.htaccess]] files on the server to redirect [[Web search engine|search engine]] requests to the [[Web page|webpage]] with [[malware]] or [[Spamming|spam]]. Many web shells check the [[User agent|user-agent]] and the content presented to the [[search engine spider]] is different from that presented to the user's browser. To find a shell a [[User agent|user-agent]] change to one of the search engine bots is usually required. Once the shell is detected, it can be deleted easily.<ref name="us-cert.gov"/>

Performing frequency analysis on the web server's access logs could indicate the location of a web shell. Most legitimate visits will have different [[User agent|user-agent]]s and [[HTTP referer|referrers (referers)]], whereas a web shell is only visited by the attacker, therefore have very few variants of user-agent strings.<ref name="us-cert.gov"/>

==See also==
*[[Backdoor (computing)]]
*[[Cyberwarfare]]
*[[Internet security]]
*[[Network security]]

==References==
{{reflist}}

==External links==
{{Malware}}
{{Authority control}}

{{Source Wikipedia}}

File:Drive-increaser-llc.jpeg

2019-01-25T06:33:53Z

Drive: Ultimate Drive Increaser Software is a free storage increaser program that utilizes a Wizard (software) to increase the storage of FAT file sys devices.

Ultimate Drive Increaser Software is a free storage increaser program that utilizes a Wizard (software) to increase the storage of FAT file sys devices.