<jupyter_start><jupyter_text>T1505.003 - Server Software Component: Web ShellAdversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)   Atomic Tests<jupyter_code>#Import the Module before running the tests.
# Checkout Jupyter Notebook at https://github.com/cyb3rbuff/TheAtomicPlaybook to run PS scripts.
Import-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force<jupyter_output><empty_output><jupyter_text>Atomic Test 1 - Web Shell Written to DiskThis test simulates an adversary leveraging Web Shells by simulating the file modification to disk.Idea from APTSimulator.cmd.aspx source - https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/asp/cmd.aspx**Supported Platforms:** windows Dependencies:  Run with `powershell`! Description: Web shell must exist on disk at specified location ({web_shells}) Check Prereq Commands:```powershellif (Test-Path PathToAtomicsFolder\T1505.003\src\) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellNew-Item -Type Directory (split-path PathToAtomicsFolder\T1505.003\src\) -ErrorAction ignore | Out-NullInvoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/b.jsp" -OutFile "PathToAtomicsFolder\T1505.003\src\/b.jsp"Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/tests.jsp" -OutFile "PathToAtomicsFolder\T1505.003\src\/test.jsp"Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1505.003/src/cmd.aspx" -OutFile "PathToAtomicsFolder\T1505.003\src\/cmd.aspx"```<jupyter_code>Invoke-AtomicTest T1505.003 -TestNumbers 1 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `command_prompt````command_promptxcopy PathToAtomicsFolder\T1505.003\src\ C:\inetpub\wwwroot```<jupyter_code>Invoke-AtomicTest T1505.003 -TestNumbers 1<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.10224948875255624, 'fraction_numerical': 0.04130879345603272, 'mean_word_length': 5.7569060773480665, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 6, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '3', 'dir': 'jupyter-structured-clean-dedup', 'id': '41471', 'license': 'MIT', 'n_tokens_mistral': 868, 'n_tokens_neox': 766, 'n_words': 208, 'path': 'playbook/tactics/persistence/T1505.003.ipynb', 'repo_name': 'haresudhan/The-AtomicPlaybook', 'size': '2445'}