Web shell

An example of what a fake error page might look like in a WSO web shell.

A Web shell is a script that can be uploaded to a web server to enable remote administration of the machine. A web shell can be written in any language that the target web server supports.[1] The most commonly observed web shells are written in languages that are widely supported, such as PHP and ASP. Perl, Ruby, Python, and Unix shell scripts are also used. Once successfully uploaded, an adversary can use the web shell to leverage other exploitation techniques to escalate privileges and to issue commands remotely. These commands are directly linked to the privilege and functionality available to the web server and may include the ability to add, delete, and execute files as well as the ability to run shell commands, further executables, or scripts.[2][3]

Examples of Web shells

Web shells such as China Chopper, WSO, C99 and B374K are frequently chosen by adversaries; however these are just a small number of known used web shells.

  • b374k – A web shell written in PHP with abilities such as monitoring processes & command execution. The latest version of the b374k shell is 3.2.3.[4][5][6]
  • C99 – A version of the WSO shell with additional functionality. Can display the server’s security measures and contains a self-delete function.
  • China Chopper – A small web shell packed with features. Has several command and control features including a password brute force capability.
  • WSO – Stands for “web shell by orb” and has the ability to masquerade as an error page containing a hidden login form.
  • Web shells can be as short as just one line of code.[7][8]
<?=`$_GET[1]`?>

Web shell of size 15 bytes.

Delivery tactics

Web shells can be delivered through a number of web application exploits or configuration weaknesses such as:

  • Cross-site scripting
  • SQL injection
  • Vulnerabilities in applications/services (such as WordPress or other CMS applications)
  • File processing vulnerabilities (such as upload filtering or assigned permissions)
  • Remote file inclusion (RFI) and local file influsion (LFI) vulnerabilities
  • Exposed admin interfaces

References

  1. ↑ Wrench, P. M.; Irwin, B. V. W. (1 August 2015). "Towards a PHP webshell taxonomy using deobfuscation-assisted similarity analysis". 2015 Information Security for South Africa (ISSA). pp. 1–8. doi:10.1109/ISSA.2015.7335066. ISBN 978-1-4799-7755-0. S2CID 10056400. Retrieved 17 February 2019 – via IEEE Xplore.
  2. ↑ US Department of Homeland Security. "Web Shells – Threat Awareness and Guidance". www.us-cert.gov. Retrieved 20 December 2018. This article incorporates text from this source, which is in the public domain.
  3. ↑ admin (3 August 2017). "What is a Web shell?". malware.expert. Retrieved 20 December 2018.
  4. ↑ "Google Code Archive - Long-term storage for Google Code Project Hosting". code.google.com. Retrieved 22 December 2018.
  5. ↑ "The Webshell Game Continues". 8 July 2016. Retrieved 22 December 2018.
  6. ↑ "GitHub - b374k/b374k: PHP Webshell with handy features". GitHub.
  7. ↑ "WSO Shell: The Hack Is Coming From Inside The House!". 22 June 2017. Retrieved 22 December 2018.
  8. ↑ "Web Shells: The Criminal's Control Panel - Netcraft". news.netcraft.com. Retrieved 22 December 2018.

Read other articles:

Apart from You

Apart from YouSutradaraMikio NaruseDitulis olehMikio NarusePemeranMitsuko YoshikawaAkio IsonoSumiko MizukuboSinematograferSuketaro InokaiPerusahaanproduksiShochiku CompanyDistributorShochiku CompanyTanggal rilis 1 April 1933 (1933-04-01) (Jepang) [1]Durasi60 menit[1]NegaraJepangBahasaJepang Apart From You (君と別れてcode: ja is deprecated , Kimi to wakarete) adalah film drama bisu Jepang tahun 1933 yang ditulis dan disutradarai oleh Mikio Naruse. Referensi ^ a b ...

 

Thomas de Courtenay, 5th/13th Earl of Devon

English nobleman of the Wars of the Roses Thomas Courtenay5th or 13th Earl of Devon[2]Arms of the Courtenay earls of Devon: Or, three torteaux a label azureTenure16 June 1422 – 3 February 1458Other titles6th Lord CourtenayBaron of OkehamptonBorn3 May 1414Devon, EnglandDied3 February 1458 (aged 43)Abingdon Abbey, Oxfordshire, EnglandResidenceOkehampton CastleTiverton CastleColcombe CastleLocalityDevon, CornwallNet worth£1,516 (1422)[3]Wars and battlesHundred Years' WarB...

 

Selamanya (album The Overtunes)

Untuk kegunaan lain, lihat Selamanya. Artikel ini tidak memiliki referensi atau sumber tepercaya sehingga isinya tidak bisa dipastikan. Tolong bantu perbaiki artikel ini dengan menambahkan referensi yang layak. Tulisan tanpa sumber dapat dipertanyakan dan dihapus sewaktu-waktu.Cari sumber: Selamanya album The Overtunes – berita · surat kabar · buku · cendekiawan · JSTOR SelamanyaAlbum studio karya The OvertunesDirilis4 Juni 2015Direkam2013-201...

العلاقات البحرينية العراقية

العلاقات البحرينية العراقية البحرين العراق   البحرين   العراق تعديل مصدري - تعديل   العلاقات البحرينية العراقية هي العلاقات الثنائية التي تجمع بين البحرين والعراق.[1][2][3][4][5] لم تنقطع العلاقات بين الدولتين بعد احتلال الكويت، إذ بقيت السفار...

 

Jean-Baptiste Say

French economist and businessman (1767–1832) Jean-Baptiste SayBorn(1767-01-05)5 January 1767Lyon, Kingdom of FranceDied15 November 1832(1832-11-15) (aged 65)Paris, FranceNationalityFrenchAcademic careerFieldPolitical economySchool ortraditionFrench Liberal SchoolInfluencesRichard Cantillon, Adam Smith, Pietro VerriContributionsSay's law, entrepreneurship Jean-Baptiste Say (French: [ʒɑ̃batist sɛ]; 5 January 1767 – 15 November 1832) was a liberal French economist and b...

 

رضوى أبو شادي

هذه المقالة يتيمة إذ تصل إليها مقالات أخرى قليلة جدًا. فضلًا، ساعد بإضافة وصلة إليها في مقالات متعلقة بها. (مارس 2021) رضوى أبو شادي معلومات شخصية تاريخ الوفاة 21 مارس 2021   مواطنة مصر  الحياة العملية المهنة ممثلة،  وشخصية تلفزيونية،  وصحافية  تعديل مصدري - تعديل   ...

Liga Utama Bosnia dan Herzegovina

Liga Utama Bosnia dan HerzegovinaNegara Bosnia dan HerzegovinaKonfederasiUEFADibentuk2000Jumlah tim12Tingkat pada piramida1Degradasi keLiga Pertama Bosnia dan Herzegovina, Liga Pertama Republik SrpskaPiala domestikPiala Bosnia dan HerzegovinaPiala internasionalLiga Champions UEFALiga Eropa UEFAJuara bertahan ligaZrinjski Mostar (2021–2022)Klub tersuksesZrinjski Mostar (7 gelar)Televisi penyiarArena SportSitus webhttp://www.nfsbih.ba Liga Utama Bosnia dan Herzegovina 2021–2022 Liga Ut...

 

Ondang Sutarsa Budhi Santosa

Irjen Pol Drs. H. Ondang Sutarsa Budhi Santosa (lahir di Jakarta, 8 Mei 1954) adalah seorang Purnawirawan perwira tinggi Polri yang pernah menjabat sebagai Kapolda DIY pada tahun 2010 -2011, dan jabatan terakhir jenderal bintang dua ini adalah sebagai Widyaiswara Utama Sespimti Polri. Kapolda Daerah Istimewa Yogyakarta Nama Ondang Sutarsa tercantum dalam keputusan Kapolri surat bernomor Skep/479/VIII/2010 tertanggal 5 Agustus 2010 sebagai Kapolda DIY. Ia adalah lulusan Akademi Kepolisian ang...

 

Tembok Pemisah Israel

Peta wilayah Tembok Pemisah Israel. Tembok Pemisah Israel, adalah sebuah tembok pemisah di antara daerah Israel yang sejati dan daerah-daerah Palestina. Israel membangun tembok ini guna menanggulangi ancaman bom bunuh diri dari daerah Palestina. Tetapi tembok ini banyak dikecam dunia karena tembok ini mengganggu kehidupan bangsa Palestina serta dituduh mencaplok daerah yang statusnya belum begitu jelas. Sebenarnya dunia internasional tidak berkeberatan Israel membangun tembok ini asalkan menu...

21-Deoxycortisol

21-Deoxycortisol Names IUPAC name 11β,17α-Dihydroxypregn-4-ene-3,20-dione Systematic IUPAC name (1R,3aS,3bS,9aR,9bS,10S,11aS)-1-Acetyl-1,10-dihydroxy-9a,11a-dimethyl-1,2,3,3a,3b,4,5,8,9,9a,9b,10,11,11a-tetradecahydro-7H-cyclopenta[a]phenanthren-7-one Other names 21-Desoxycortisol; 21-Dehydrohydrocortisone; 21-Deoxyhydrocortisone; 11β,17α-Dihydroxyprogesterone Identifiers CAS Number 641-77-0 Y 3D model (JSmol) Interactive image ChEBI CHEBI:28697 ChEMBL ChEMBL1527439 ChemSpider 83796 ...

 

Giugliano Calcio 1928

S.S. Giugliano Calcio 1928Calcio Tigrotti, Gialloblù Segni distintivi Uniformi di gara Casa Trasferta Terza divisa Colori sociali Giallo, blu Simboli Tigre Inno Alè Giugliano Dati societari Città Giugliano in Campania Nazione  Italia Confederazione UEFA Federazione FIGC Campionato Serie C Fondazione 1928 Rifondazione1934Rifondazione2010Rifondazione2021 Proprietario Mazzamauro Group S.R.L.[1] Presidente Elena Annunziata Mazzamauro[2] Alfonso Mazzamauro (onorario) e Cir...

 

拉吉夫·甘地

拉吉夫·甘地राजीव गांधीRajiv Gandhi1987年10月21日，拉吉夫·甘地在阿姆斯特丹斯希普霍尔机场 第6任印度总理任期1984年10月31日—1989年12月2日总统吉亞尼·宰爾·辛格拉马斯瓦米·文卡塔拉曼前任英迪拉·甘地继任維什瓦納特·普拉塔普·辛格印度對外事務部部長任期1987年7月25日—1988年6月25日前任Narayan Dutt Tiwari（英语：Narayan Dutt Tiwari）继任納拉辛哈·拉奥任期1984年10�...

Salt Spring Island

This article is about the island. For the district, see Saltspring Island Electoral Area. Place in British Columbia, CanadaSalt Spring IslandGanges Harbour on Salt Spring island FlagNickname(s): Salt Spring, SSISalt Spring IslandLocation of Salt Spring Island within the Capital Regional DistrictSalt Spring IslandLocation of Salt Spring Island within British ColumbiaCoordinates: 48°48′24″N 123°29′31″W / 48.806637°N 123.492029°W / 48.806637; -123.492029C...

 

アプリケーションソフトウェア

「アプリケーション」はこの項目へ転送されています。英語の意味については「wikt:応用」、「wikt:application」をご覧ください。 この記事には複数の問題があります。改善やノートページでの議論にご協力ください。 出典がまったく示されていないか不十分です。内容に関する文献や情報源が必要です。（2018年4月） 古い情報を更新する必要があります。（2021年3月）出...

 

بطولة أمم إفريقيا لكرة السلة 1995

يفتقر محتوى هذه المقالة إلى الاستشهاد بمصادر. فضلاً، ساهم في تطوير هذه المقالة من خلال إضافة مصادر موثوق بها. أي معلومات غير موثقة يمكن التشكيك بها وإزالتها. (فبراير 2016) بطولة أمم إفريقيا لكرة السلة 1995 المعطيات المنطقة أفريقيا المستضيف  الجزائر العام 1995 التواريخ ديسمبر 11...

Liberal Unionist Party

British political party Liberal Unionist redirects here. For the Canadian party, see Liberal-Unionist. Liberal Unionist Party Leaders Spencer Cavendish, 8th Duke of Devonshire Joseph Chamberlain Edward Stanley, 15th Earl of Derby Henry Petty-Fitzmaurice, 5th Marquess of Lansdowne Founded1886 (1886)Dissolved1912 (1912)Split fromLiberal PartyMerged intoConservative and Unionist PartyHeadquartersLondon, EnglandIdeology Conservative liberalism British unionism Political p...

 

Leader of the Conservative Party (UK)

Head of the Conservative Party of the United Kingdom Leader of the Conservative and Unionist PartyLogo for the Conservative PartyIncumbentRishi Sunaksince 24 October 2022TypeParty leaderStatusChief executive officerInaugural holderRobert Peel (de facto) Bonar Law (de jure)Formation1834 (de facto)1922 (de jure) The leader of the Conservative Party (officially the leader of the Conservative and Unionist Party) is the highest position within the United Kingdom's Conservative Party. The curr...

 

Live oak

Group of evergreen trees in the oak genus Quercus This article is about evergreen oak trees. For live oak in the southern United States, see Southern live oak. For other uses, see Live Oak (disambiguation). Evergreen oak redirects here. Evergreen oak may also refer specifically to the Mediterranean species Quercus ilex. Sand live oak (Quercus geminata) Texas live oak (Quercus fusiformis) Live oak or evergreen oak is any of a number of oaks in several different sections of the genus Quercus th...

Campidano di Oristano

Questa voce sull'argomento Sardegna è solo un abbozzo. Contribuisci a migliorarla secondo le convenzioni di Wikipedia. Segui i suggerimenti del progetto di riferimento. Campidano di OristanosubregioneCampidano di Oristano – Veduta LocalizzazioneStato Italia Regione Sardegna Provincia Oristano TerritorioCoordinate39°46′N 8°35′E39°46′N, 8°35′E (Campidano di Oristano) Abitanti ComuniArborea, Baratili San Pietro, Bauladu, Cabras, Marrubiu, Milis, Nurachi, Olla...

 

Mushoku Tensei

Mushoku Tensei - Jobless ReincarnationGambar sampul novel ringan volume pertama無職転生 〜異世界行ったら本気だす〜(Mushoku Tensei: Isekai Ittara Honki Dasu)GenrePetualanganDramaIsekai[1] Seri novelPengarangRifujin na MagonotePenerbitShōsetsuka ni NarōTerbit22 November 2012 – 3 April 2015Volume25 (Daftar volume) Novel ringanPengarangRifujin na MagonoteIlustratorShirotakaPenerbitMedia FactoryPenerbit bahasa InggrisNA Seven Seas EntertainmentPenerbit bahasa Indonesia...