Web shells explained

- Jaimin Gohel

About Speaker

 

  • InfoSec Enthusiast
  • Developer @Qloo IT Solutions
  • Speaker @MozillaGujarat

Shell

In computing, a shell is a user interface for access to an operating system's services. In general, operating system shells use either a command-line interface (CLI) or graphical user interface (GUI), depending on a computer's role and particular operation.

A web shell is a script that can be uploaded to a web server to enable remote administration of the machine.

 

Why to use an webshell?

Webshell

  • Persistent Remote Access

  • Privilege Escalation
  • Pivoting and Launching Attacks

  • Zombie

 

What can we do with it?

  • File Management
  • Command line access
  • Database server access
  • Network Scanning

                        Versions

  • PHP, ASP.NET, JSP etc.
  • RAT(Remote Access Tool) for the web

Ways to upload a shell

  • File upload vulnerabilities
  • Insecure FTP
  • Command injection
  • Remote file included
  • SQL injection
  • Vulnerable services

Popular shells

  • C99
  • C100
  • r57
  • Fx29Shell
  • PLaToShell
  • b374k
  • WSO
  • Weevely

Shell via command injection

Shell via unrestricted file upload

Shell via SQLi

Tools to find web shells

  • PHP-shell-detector
    •  https://github.com/emposha/PHP-Shell-Detector
  • NeoPI
    • https://github.com/Neohapsis/NeoPI

Sources

  • http://r57.gen.tr/
  • http://www.r57c99.com/
  • https://github.com/b374k/b374k
  • Kali linux
    • usr/share/webshells language wise folders

Questions?

Made with Slides.com