A web shell is a script placed on a web server that gives an attacker a way to run commands on that server from a remote location. MITRE ATT&CK says adversaries use web shells to keep persistent backdoor access to a system.
- Also Called2other nameswebshell · web backdoor script
- Related Terms3linked entriesPersistence · Remote code execution (RCE) · Lateral movement
What is a web shell?
MITRE ATT&CK describes a web shell as a web script placed on an accessible web server. MITRE says it lets an adversary use the web server as a gateway into a network, and it can provide command execution or remote shell functions. MITRE lists it as technique T1505.003, Web Shell.
How does a web shell work?
MITRE says a web shell may have a client interface program that is used to talk to the web server, and it names the China Chopper web shell client as an example. The script on the server is the server part, and the attacker’s tool talks to it.
MITRE also says adversaries use web shells to keep a persistent backdoor. A backdoor is a hidden way back into a system. Persistence means staying in a system after the first break-in, so the attacker does not need to break in again.
Why does it matter?
MITRE says a web shell is placed on an openly accessible web server, and it can give its owner command execution on that server. MITRE describes it as persistent access, so it can remain in place until someone finds and removes it. Reasoning cautiously, a server that has been patched after an intrusion could still be controlled if a web shell was left behind.
How can you detect a web shell?
MITRE lists detection ideas that focus on behavior on the server.
- Watch for unexpected files being created in web directories, followed by the web server starting command shells or script interpreters.
- Watch for unauthorized script files appearing in standard web folders, followed by system utilities being run.
- Alert when a web server starts unusual processes after a file upload into a normal web directory.
How can you reduce the risk?
MITRE gives two mitigations.
- Disable or remove risky features. MITRE gives the example of the PHP eval() function, which may be abused for web shells.
- Use user account management and least privilege. Restrict permissions so that only authorized users can change web directories. This reduces the chance that an unauthorized shell can be placed there.
Is a web shell the same as a backdoor?
Not exactly. A backdoor is the general idea of a hidden way into a system. MITRE describes a web shell as one way to get persistent backdoor access, specifically through a script on a web server.
Is a web shell the same as a normal command shell?
No. A command shell is a text interface on a computer. A web shell is a web script that gives an attacker that kind of control on a web server, from a distance.
Related pages in the Knowledge Hub
Also Called.
- Namewebshell
- Nameweb backdoor script
Questions.
-
What is a web shell?
A web shell is a web script placed on an openly accessible web server. MITRE says it lets an adversary use the server as a gateway into a network, and it can provide command execution or remote shell functions.
-
How does a web shell work?
MITRE says a web shell may have a client interface program used to talk to the web server, such as the China Chopper client. The script on the server is the server part, and the attacker's tool talks to it.
-
Why do attackers use web shells?
MITRE says adversaries use web shells to keep a persistent backdoor. A backdoor is a hidden way back into a system, so the attacker does not need to break in again.
-
How can you detect a web shell?
MITRE's detection ideas focus on server behavior: unexpected files created in web directories, unauthorized scripts in standard web folders, and a web server starting command shells or unusual processes after a file upload.