Web shell

A web shell is a shell-like interface that facilitates remote access to a web server, commonly exploited for cyberattacks.^[1] Unlike traditional shells, it is accessed via a web browser, making it a versatile tool for malicious activities.^[2][3]

Web shells can be coded in any programming language supported by a server, with PHP being the most prevalent due to its widespread use in web applications. Other languages, such as Active Server Pages, ASP.NET, Python, Perl, Ruby, and Unix shell scripts, are also employed.^[1][2][3]

Attackers identify vulnerabilities often in web server application using network monitoring tools, which can be exploited to deploy a web shell.^[2]

Once installed, a web shell allows attackers to execute shell commands, perform privilege escalation, and manage files by uploading, deleting, downloading, or executing them on the server.^[2]

General usage

Web shells are favored in cyberattacks for their versatility and elusiveness.^[4] Common applications include:

• Data theft^[4]
• Infecting visitors through watering hole attacks^[5]
• Website defacement by altering files with malicious intent
• Launching DDoS attacks^[2]
• Relaying commands to inaccessible network segments^[2]
• Serving as a command and control hub, such as in botnet systems or to compromise external networks^[2]

Web shells enable hackers to extract data, corrupt systems, and deploy more damaging malware. The threat intensifies when compromised servers are used to infiltrate additional systems. They are also employed in cyber espionage targeting sectors like government, finance, and defense. A notable example is the "China Chopper" web shell.^[6]

Delivery of web shells

Web shells are deployed by exploiting vulnerabilities in web applications or weak server configurations, including:^[2][4]

• SQL injection
• Flaws in applications and services (e.g., web server software like NGINX or content management systems like WordPress)^[7][8]
• File processing and upload vulnerabilities (mitigated by restricting file types)^[8]
• Remote file inclusion (RFI) and local file inclusion (LFI) vulnerabilities
• Remote code execution
• Exposed administration interfaces^[2]

Attackers may also spoof the Content-Type header during file uploads to bypass weak file validation, enabling shell deployment.

Example

The following is a basic PHP web shell that executes a shell command and displays the output:

<?=`$_GET[x]`?>

With a filename of example.php, the command to display the /etc/passwd file could be:

https://example.com/example.php?x=cat%20%2Fetc%2Fpasswd

This executes the command cat /etc/passwd. Such risks can be mitigated by disabling PHP shell functions to prevent arbitrary command execution.

Prevention and mitigation

Preventing web shell installation requires addressing server vulnerabilities. Key measures include:^[2][3]

• Regularly updating applications and the host server's operating system to patch known bugs
• Implementing a demilitarized zone (DMZ) between web-facing servers and internal networks
• Securing web server configurations^[2]
• Closing unused ports and services^[2]
• Validating user input to limit local and remote file inclusion vulnerabilities^[2]
• Using a reverse proxy to restrict administrative URLs to legitimate sources^[2]
• Conducting frequent vulnerability scans (though ineffective against zero-day attacks)^[2]
• Deploying a firewall^[2]
• Disabling directory browsing^{[citation needed]}
• Avoiding default passwords^[2]

Detection

Web shells are challenging to detect due to their modifiability, often evading antivirus software.^[2][9]

Indicators of a web shell include:^[2][3]

• Unusually high web server activity from downloading/uploading^[2][9]
• Files with abnormal timestamps (e.g., newer than last modification)^[9]
• Unknown files on the server
• Suspicious references (e.g., cmd.exe or eval)
• Unusual connections in server logs

For instance, a PNG file with POST parameters or dubious logins between DMZ servers and internal subnets may signal a web shell.^{[2][10][11][12]}

Web shells may include disguised login forms, such as fake error pages.^{[2][13][14][15]}

Attackers can modify the .htaccess file (on Apache HTTP Server) to redirect search engine queries to malware or spam pages, often tailoring content based on user-agent detection. Identifying the shell may require altering the crawler's user-agent, after which it can be easily removed.^[2]

Analyzing server logs can pinpoint the web shell's location, as legitimate users typically have diverse user-agents and referers, while attacker access is more uniform.^[2]

See also

• Backdoor (computing)
• Cyberwarfare
• Internet security
• Network security
• China Chopper
• Privacy
• Web-based SSH