TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Web Shells: Understanding Attackers’ Tools and Techniques

2023-07-06 · Read original ↗

ATT&CK techniques detected

8 predictions
T1505.003Web Shell
100%
“web shells : understanding attackers ’ tools and techniques introduction disclosures of breaches often include mention of a “ web shell ” to further attacker ends. as one example, the clop ransomware group ( also known as ' lace tempest, ' ta505, and fin11 ) has used web shells a…”
T1505.003Web Shell
99%
“web language, there ’ s very little that can ’ t be accomplished using the language ’ s common features, without having to execute system commands. conclusion despite their simplicity, web shells are a common way for attackers to gain the ability to run commands on a server and a…”
T1505.003Web Shell
99%
“. additionally, web shell traffic appears to be legitimate website traffic ; a client requests a url, and a response is returned. further, as most sites now run https / tls, this traffic is also encrypted. finally, http is by far the most used protocol, and any site with a lot of…”
T1505.003Web Shell
97%
“example web shell, written in php : <! doctype html > < html > < head > < title > example webshell < / title > < / head > < body > <? php system ( $ _ get [ ' cmd ' ] ) ;? > < / body > < / html > assuming this script was placed in the web root directory of example. com, a request…”
T1505.003Web Shell
95%
“file upload - file download - archive creation and download - database query execution - database table dumping - executing code to create a network connection back to an attacker - controlled machine ( a “ reverse shell ” ) this list, however, is by no means comprehensive. an at…”
T1505.003Web Shell
83%
“the difference is that they are designed to give their users a means of executing arbitrary commands on the webserver. they are placed on the webserver without the permission of the owners of the site. a web shell may be considered an illicit script which intentionally introduces…”
T1505.003Web Shell
62%
“the contents of the web root directory. a screenshot of the results of running the “ ls ” command via our example web shell. other commands may of course be run, which allows attackers to read files, navigate the file system, start processes, and possibly other things, all with t…”
T1059.006Python
41%
“the contents of the web root directory. a screenshot of the results of running the “ ls ” command via our example web shell. other commands may of course be run, which allows attackers to read files, navigate the file system, start processes, and possibly other things, all with t…”

Summary

Explore the concept of web shells, their usage by attackers, and effective defenses against this post-exploit activity in this article by F5 Labs.