Modern cyberattacks are becoming a significant challenge for businesses. However, conventional web shell attacks are still a threat. According to Microsoft, more than 140,000 web shell encounters are registered during 2020-2021. Further, these researchers indicated that such attacks are prevalent due to the simplicity of execution.
In other words, web shell attacks constitute a significant threat, and you need effective security measures to protect your servers. Hackers deploy web shell malware on the web servers to gain access to vital data. They use content management systems as targets or leverage backdoors to create a chain of web shells for multiple compromised systems.
So, what are these web shells, and what protection do you need for your servers? Here is a comprehensive guide on detecting such attacks, preventing them, and ensuring server security.
Let us begin by understanding the web shell attacks and their reasons.
What is a Web Shell Attack?
According to the National Security Agency of the Australian Government, web shell malware is a kind of software attackers deploy on the target web server. Cyber attackers deploy web shells through vulnerabilities in web applications. They can also upload specific codes, which help hackers gain access to the administrative rights of servers.
How Does a Web Shell Attack Work?
Web shell attack begins with the installation of a shell into the system. The installation process is executed differently depending on the attack type and actors. Some of the most common ways to install a web shell into the target system are,
- Hackers can expose backdoor vulnerability to install web shells
- Root access through a server software vulnerability
- Leveraging the configurational errors to install web shells
Once the web shell is installed, attackers can execute commands through the newly gained root access. Further attackers exploit the vulnerable systems to access sensitive information.
One of the most significant misconceptions about such attacks is that they will only target internet-facing systems. However, internal web applications in the organization or intra-network devices are far more susceptible to web shell attacks.
However, it is essential to understand the term “web shells.” This term is also associated with web-based system management tools that server administrators use. Therefore, it is necessary to differentiate between a legitimate web shell and a malicious attack. This is why you need to have an understanding of the reasons, which cause such attacks.
Reasons for web shell attack
Web shell attacks provide hackers with persistent backdoors, which help them compromise systems. There are many reasons for such attacks, from problems in the core programming language to lack of security patches. For example, PHP is one of the most common languages used for writing web shells.
Issues in PHP can lead to web shell attacks. Apart from the programming language, obsolete WordPress plugins or lack of security updates to such plugins can cause such attacks. Let us converse some of the key details.
Remote access to backdoors
Remote access takes place outside the system environment, allowing hackers to control the admin rights. It happens due to vulnerable backdoors in web applications. However, backdoors are a common thing in any web app. Therefore, the presence of backdoors is not an issue, but security is the key to avoiding web shell attacks.
One common way to execute remote web shell attacks is to generate a file remotely accessing the vulnerable backdoor of a web application. Further, the attacker will install the generated web shell on the system remotely and create an HTTP post request.
It is sent to the web shell and embedded commands allows remote execution. Besides remote, access attacks, hackers also target web apps with delayed security patches.
Lack of security patching
Security patches are critical to the protection of your websites and software. These updates ensure your sites are up to date with the security measures for protection against modern cyberattacks.
Take an example of Ericsson’s 2018 outage. Due to an expired software patch, more than 32 million customers across the UK lost access to 4G services. Similarly, a lack of security patches in your web app versions or WordPress plugins can lead to web shell attacks.
Leveraging user access
Systems across organizations have specific user access policies. Therefore, users can access data and files in a system to a threshold. However, hackers leverage the privilege escalation approach using web shell attacks to gain access to the root of a system. There are two main types of escalation used by cyber attackers,
- Vertical escalation – It is a process of using web shells to gain access to higher-level privileges from low-level privileges.
- Horizontal escalation – It is a type of escalation attack where hackers use another low-level account with similar privileges to execute an “account takeover.”
Bot network connection
Many attackers install web shells to target high-level and valuable assets using your resources through a bot network. A network that is under hackers’ control that connects with your servers and uses resources to execute commands for high-value targets.
Such attacks need intensive bandwidth, and attackers leverage the system resources for command execution.
Now that we know the reasons behind web shell attacks let’s understand their types,
Types of Web Shell Attacks
Hackers like China Chopper, B374K, and WSO have used several web shell attacks. Each of these attacks has made a significant impact on the way web shells are perceived.
China chopper
It is a web shell attack devised by a team of hackers from China known as Hafnium. They executed four zero-day exploits such as,
- CVE-2021-26855
- CVE-2021-26857
- CVE-2021-26858
- CVE-2021-27065
China Chopper is just 4kb in size and is a significant type of web shell attack that has been prevalent for many years.
Web Shell by Orb (WSO)
WSO attacks are like a hidden Trojan in your family that is hard to identify. Once a hacker installs WSO, the admin rights to your website and sensitive information are accessible. Most attackers leverage web shells encoded through Base64 and compressed through Gunzip for WSO attacks.
A significant reason for which most hackers prefer using WSO is password protection capabilities. They can password protect the compromised backdoor of your systems. Therefore, they can reuse it for further exploits.
C99
C99 is a type of web shell attack that allows the attackers to gain access to a web server through an interface. Hackers can use the interface and execute commands leveraging the account under which PHP is running.
B374K
It is a PHP-based web shell with process visualization and command execution for remote access. Admins can access the systems remotely without the need for CPanel. Unfortunately, this is where hackers use them to inject malicious code remotely and gain access to servers.
Understanding the types can help identify the nature of a web shell attack but detecting it is not that simple. Here is an example,
Example of a Web Shell Attack
In June 2022, Atlassian’s confluence server detected a web shell attack. According to a report, the zero-day vulnerability became known due to an investigation of an incident. It was the same web shell used in the Microsoft Exchange server attack in 2021- CVE-2022-26134.
Further, Atlassian released a security warning for users and a patch for major confluence servers. However, many servers remain vulnerable. Here the detection of vulnerability happened due to an incident report. Therefore, you need specific measures for web shell detection.
How to Detect Web Shell Attacks?
Detecting a web shell attack is difficult because they are mostly hidden. Web shells are often embedded into a file or attached to commands executed remotely. Here you need an automated detection system that checks every log for incidents.
Similarly, there are many other ways to detect vulnerabilities and configurational gaps that hackers leverage for web shell attacks.
- Vulnerability scanners help in scanning vulnerabilities across the web application.
- Log monitoring systems will enable you to track any incident that can lead to the installation of web shells.
- Auto configuration software ensures no configurational gaps and detects if there is one in the system.
- Access control policy helps define the specific threshold of user’s accessibility and detect if there is access beyond the restricted limit or privilege level.
How to Prevent Web Shell Attack?
There are several ways to prevent your server from exploitation by hackers due to web shell attacks. From deploying an Endpoint Detection and Response (EDR) solution to using an SSL certificate to secure server communication, you can use different methods according to the type of attack.
Endpoint Detection and Response (EDR)
EDR solutions can monitor system calls and logs to find anomalies. Especially such solutions allow you to find specific malicious patterns related to web shells. Therefore, you can adjust the security policies and ensure the right configurations for protection against such attacks.
SSL Certificates
Secure Socket Layer (SSL) certificate is an encryption-based digital certification that helps secure communication between a user’s device and server. In addition, it allows your data exchange to stay anonymous from hackers.
Such a security measure can help you protect the server against man-in-the-middle attacks. For example, hackers can use such attacks to install web shells, and SSL certificates can help prevent it.
Web Application Firewall (WAF)
One of the steps in a web shell attack that hackers take after gaining access to a backdoor is to send HTTP traffic to the host server. WAF filters and monitors the traffic to avoid HTTP requests sent by hackers. It builds a firewall between traffic sources and your web server for enhanced protection.
Conclusion for Web Shell Attacks
Web shell attacks are not cyber threats in the past and are still popular among hackers. One of the reasons for their popularity is how simple it is to install a web shell into the server. All cyber attackers need is a backdoor into your system.
This is why it is crucial to have specific security measures to protect your servers. Here we have discussed some tips to detect such attacks and secure your servers. However, which method to use depends on the specific requirements of your system.
Recommended Reading:
