Web shell

A web shell is a malicious web-based shell-like interface that enables remote access and control to a web server by allowing the execution of arbitrary commands. A web shell can be uploaded to a web server to enable remote access to the web server, such as the web server's file system. A web shell is unique in that it enables users to access a web server by way of a web browser that acts like a command-line interface.
A user can access a remote computer via the World Wide Web using a web browser on any type of system, whether it's a desktop computer or a mobile phone, and perform tasks on the remote system. No command-line environment is required on either the host or the client. A web shell is often considered a remote access trojan.
A web shell could be programmed in any language that the target server supports. Web shells are most commonly written in PHP due to the widespread use of PHP. However, Active Server Pages, ASP.NET, Python, Perl, Ruby, and Unix shell scripts are also used, although not as common because it is not very common for web servers to support these languages.
Using network monitoring tools such as Wireshark, an attacker can find vulnerabilities that are exploited, resulting in a web shell installation. These vulnerabilities may be present in content management system applications or the web server's software.
An attacker can use a web shell to issue commands, perform privilege escalation on the web server, and the ability to upload, delete, download, and execute files on the web server.
General usage.
Web shells are used in attacks mostly because they are multi-purpose and difficult to detect.
Web shells are commonly used for:
Delivery of web shells.
Web shells are installed through vulnerabilities in web application or weak server security configuration including the following:
An attacker may also modify (spoof) the codice_1 header to be sent by the attacker in a file upload to bypass improper file validation (validation using MIME type sent by the client), which will result in a successful upload of the attacker's shell.
Examples of notable web shells.
Web shells can be as short as just one line of code. The following example PHP script is 15 bytes in size:
 <?=`$_GET[x]`?>
If an attacker inserts this line of code into a malicious file with a PHP filename extension (such as codice_2) on a web server that is running PHP, the attacker can issue commands, for example reading the codice_3 file, through a web browser using the following Uniform Resource Locator if the web shell was located at codice_4:
 http://example.com/uploads/webshell.php?x=cat%20%2Fetc%2Fpasswd
The above request will take the value of the codice_5 URL parameter, decode the URL and send the following shell command:
cat /etc/passwd
If the permissions of the codice_3 file allow viewing the file, the web server will send the contents of codice_3 to the web browser and the browser will then display the contents of the codice_3 file or any other file the attacker wishes to view.
This attack could have been prevented if the file permissions did not allow viewing the file or if the shell functions of PHP were disabled so that arbitrary shell commands cannot be executed from PHP.
Other malicious actions are able to be executed by attackers with that web shell, such as replacing the contents of a file on the web server. For example, consider the following command:
echo x > index.php
The above command could be used to replace the contents of the codice_9 file with the text "x", which is one way a web page could be defaced, or create the codice_9 file with the contents if the file does not exist. Attackers can also use the command rm to delete files on the web server and mv to move files.
Prevention and mitigation.
A web shell is usually installed by taking advantage of vulnerabilities present in the web server's software. That is why removal of these vulnerabilities are important to avoid the potential risk of a compromised web server.
The following are security measures for preventing the installation of a web shell:
Detection.
Web shells can be easily modified, so it's not easy to detect web shells and antivirus software are often not able to detect web shells.
The following are common indicators that a web shell is present on a web server:
For example, a file generating suspicious traffic (e.g. a PNG file requesting with POST parameters);
Dubious logins from DMZ servers to internal sub-nets and vice versa.
Web shells may also contain a login form, which is often disguised as an error page.
Using web shells, adversaries can modify the .htaccess file (on servers running the Apache HTTP Server software) on web servers to redirect search engine requests to the web page with malware or spam. Often web shells detect the user-agent and the content presented to the search engine spider is different from that presented to the user's browser. To find a web shell a user-agent change of the crawler bot is usually required. Once the web shell is identified, it can be deleted easily.
Analyzing the web server's log could specify the exact location of the web shell. Legitimate users/visitor usually have different user-agents and referers (referrers), on the other hand, a web shell is usually only visited by the attacker, therefore have very few variants of user-agent strings.