Web Shell

Introduction

A web shell is a malicious script uploaded to a web server that provides the attacker with remote command execution via a web browser. Web shells are lightweight, stealthy, and extremely persistent — they blend into server directories as normal-looking files (e.g., image.php, wp-update.php, config.asp).

History

Milestone	Year	Details
Early PHP shells	2000s	c99, r57 in hacking forums
c99 shell	2000s	Feature-rich PHP shell
r57 shell	2000s	Competitor to c99
China Chopper	2000s+	22-byte ASP/ASPX/PHP; APT staple
WSO Shell	2000s+	Feature-rich; criminal use
ProxyLogon shells	2021	Exchange zero-day; mass deployment

How It Works

1. UPLOAD
   └─ File upload vuln, RCE, RFI/LFI, compromised creds

2. DISGUISE
   └─ Named: image.php, wp-update.php, config.asp, license.txt

3. COMMAND EXECUTION
   └─ Attacker accesses shell URL → OS commands via browser

4. FILE MANAGEMENT
   └─ Upload, download, edit, delete, permission changes

5. LATERAL MOVEMENT
   └─ Pivot to internal network, SMB, RDP, SSH

6. PERSISTENCE
   └─ Survives patching (original vuln fixed, shell remains)

Notable Web Shells

Shell	Language	Size	Notable
c99	PHP	~20KB	Feature-rich; early 2000s
r57	PHP	~25KB	Competitor to c99
China Chopper	ASP/PHP/JSP	22 bytes	APT; used by Chinese groups
WSO	PHP	~50KB	Feature-rich; criminals
b374k	PHP	~30KB	Modern, feature-rich
ProxyLogon shells	ASPX	Various	2021 Exchange; HAFNIUM

Detection

Indicator	Detection
File Anomalies	Unexpected .php/.asp/.jsp in static dirs
File Integrity	FIM alerts on new/modified files
Web Logs	POST to unusual files; high entropy params
Process Tree	w3wp.exe → cmd.exe / powershell.exe
Network	Outbound from web server to unusual IPs
YARA Rules	Web shell signatures (PHP, ASP, JSP)

Prevention

• ✅ Validate uploads — Type, size, storage outside web root
• ✅ Disable script execution in upload dirs (php_flag engine off)
• ✅ WAF — Block known shells, suspicious patterns
• ✅ File Integrity Monitoring — FIM on web directories
• ✅ Least Privilege — Web server as unprivileged user
• ✅ Disable unused extensions — .asp, .php, .jsp if not needed
• ✅ Log monitoring — POST to static files, unusual UAs

Notable: China Chopper

ASP: <%eval request("cmd")%>
PHP: <?eval($_POST[cmd]);?>
JSP: <%Runtime.getRuntime().exec(request.getParameter("cmd"));%>

• 22 bytes — Smallest functional web shell
• Usage — Chinese APT groups (APT10, APT41, etc.)
• Detection — Extremely difficult; minimal footprint

Prevention (Extended)

• ✅ File upload validation — MIME, extension, content scan
• ✅ Store uploads outside web root — No script execution
• ✅ WAF rules — Known shells, eval, exec, system, passthru
• ✅ FIM — Tripwire, AIDE, OSSEC, Wazuh on web dirs
• ✅ Least privilege — Web server user, no shell access
• ✅ Regular audits — find /var/www -type f -name "*.php" -newer /tmp/marker

MITRE ATT&CK

Technique	ID	Description
Web Shell	T1505.003	Web server backdoor
Server Software Component	T1505	Persistence via components
Command and Scripting Interpreter	T1059	Command execution

Related

• Backdoor — Persistent access
• Supply-Chain Malware — Web shell via supply chain
• APT Malware — APT web shell usage