\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Moderate<\/p>\n
<\/p>\n
Malware names<\/strong><\/h3>\n\n- Backdoor.PHP.WebShell.Indosec (Padvish)<\/li>\n
- PHP \/ Webshell.NHE (ESET-NOD32)<\/li>\n
- HEUR:Backdoor.PHP.WebShell.gen (Kaspersky)<\/li>\n<\/ul>\n
<\/p>\n
What is WebShell?<\/h3>\n
WebShell is a malicious script written in scripting languages such as ASP, Python, PHP, or JSP. When injected onto the victim’s web server, these webshells grant the attacker complete control over the website. These attacks typically exploit security vulnerabilities in vulnerable web servers.
\nAttackers easily discover and target servers accessible on the Internet. By injecting the web shell into the web server, organizations face serious and sometimes irreparable risks. Therefore, organizations must prioritize these warnings and implement robust security measures.<\/p>\n
<\/p>\n
What is Backdoor.PHP.WebShell.Indosec?<\/h3>\n
This report discusses a sample from the Indosec family of web shells. Using this webshell, intruders can execute a range of malicious actions on the victim’s server.<\/p>\n
<\/p>\n
The capabilities of this malware:<\/strong><\/p>\n\n- Uploading files to specific paths<\/li>\n
- Encrypting files and demanding ransom<\/li>\n
- Defacing the victim’s website<\/li>\n
- Creating files and folders, and modifying them<\/li>\n<\/ul>\n
<\/p>\n
Technical Review<\/h2>\nPerformance Description<\/h3>\n
To access the Webshell admin panel, the attacker creates a login page with the username admin<\/span><\/em>, as depicted in the image below the login page.<\/p>\n![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-1-%D8%B5%D9%81%D8%AD%D9%87-login.png\")
<\/p>\n
Figure 1-\u00a0\u00a0login Page<\/em><\/p>\nUpon successful login<\/span>, the following page is displayed. As illustrated, the IndoSec<\/span> Shell<\/span> <\/em>equips attackers with various capabilities.<\/p>\n![\"\u0646\u0645\u0627\u06cc\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-2-%D9%86%D9%85%D8%A7%DB%8C%DB%8C-%D8%A7%D8%B2-%D8%B3%D8%B1%D8%A8%D8%B1%DA%AF-home.png\")
<\/p>\n
Figure 2 – A view of\u00a0\u00a0home tab<\/em><\/p>\n\n- Within the terminal section, as shown in the subsequent figures, this webshell can execute Windows and Linux commands based on the victim’s server’s operating system.
\nIn the following two figures, you can observe a command executed under the Windows terminal while the web shell operates in the Windows environment, and a command executed under the Linux terminal while the web shell operates in the Linux environment:<\/li>\n<\/ul>\n\u25ab\ufe0fResult of executing ipconfig<\/span>\u00a0<\/em>in a Windows environment:<\/p>\n![\"\u0627\u062c\u0631\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-3-%D8%A7%D8%AC%D8%B1%D8%A7%DB%8C-%D8%AF%D8%B3%D8%AA%D9%88%D8%B1-%D9%88%DB%8C%D9%86%D8%AF%D9%88%D8%B2%DB%8C-%D8%AF%D8%B1-%D8%AA%D8%B1%D9%85%DB%8C%D9%86%D8%A7%D9%84.png\")
<\/p>\n
Figure 3 – Executing a Windows command in the terminal<\/p>\n
<\/p>\n
\u25ab\ufe0fResult of executing uname -a<\/em><\/span> command in a Linux environment:<\/p>\n![\"\u0627\u062c\u0631\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-4-%D8%A7%D8%AC%D8%B1%D8%A7%DB%8C-%D8%AF%D8%B3%D8%AA%D9%88%D8%B1-%D9%84%DB%8C%D9%86%D9%88%DA%A9%D8%B3%DB%8C-%D8%AF%D8%B1-%D8%AA%D8%B1%D9%85%DB%8C%D9%86%D8%A7%D9%84.png\")
<\/p>\n
Figure 4: Executing a Linux command in the terminal<\/p>\n
<\/p>\n
\n- The informasi<\/em> section displays details about the current system.<\/li>\n<\/ul>\n
![\"\u0627\u0637\u0644\u0627\u0639\u0627\u062a](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-5-%D8%A7%D8%B7%D9%84%D8%A7%D8%B9%D8%A7%D8%AA-%D9%85%D8%B1%D8%A8%D9%88%D8%B7-%D8%A8%D9%87-%D8%B3%DB%8C%D8%B3%D8%AA%D9%85.png\")
<\/p>\n
Figure 5 – System Information<\/p>\n
<\/p>\n
\n- In the subsequent section, the outcomes of each action are displayed. For instance, in the initial login mode, details such as files in the current directory, access types, and actions on the files are displayed, or after running commands in the terminal, the outputs are shown in this field.<\/li>\n<\/ul>\n
![\"\u0646\u0645\u0627\u06cc\u0634](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-6-%D9%86%D9%85%D8%A7%DB%8C%D8%B4-%D8%AF%D8%A7%DB%8C%D8%B1%DA%A9%D8%AA%D9%88%D8%B1%DB%8C-%D8%AC%D8%A7%D8%B1%DB%8C.png\")
<\/p>\n
Figure 6 – Displaying the current directory<\/p>\n
<\/p>\n
The various capabilities of the malware are outlined in the table below:<\/strong><\/p>\n\n\n\n\nFeature Name<\/strong><\/td>\n Feature Description<\/strong><\/td>\n<\/tr>\n\nupload<\/em><\/td>\nEnables file uploads to desired paths.<\/td>\n<\/tr>\n \nBautfile<\/em><\/td>\nEnables creating new files and adding content to it.<\/td>\n<\/tr>\n \nBautfolder<\/em><\/td>\nEnables creating new folders in desired paths.<\/td>\n<\/tr>\n \nMass deface<\/em><\/td>\nEnables the attacker to batch changes index files, resulting in defaced websites on the victim’s server. This section enables simultaneous content changes to multiple files, so that the target path and file name determined by the attacker. As a result, the content of all files with the specified name (by default index.php ) located in the corresponding path will be changed.<\/td>\n<\/tr>\n \nMass delete<\/em><\/td>\n\u00a0Deletes multiple files simultaneously.<\/td>\n<\/tr>\n \njumping<\/em><\/td>\nChecks for the existence of host management control panels in the system and displays files in associated paths.<\/td>\n<\/tr>\n \nconfig<\/em><\/td>\n\nPut path configuration files of various content management systems (CMS) into a file named ‘$user_con-$nama_config.txt,’ providing critical information to the attacker including database name and password. Reviewed CMS platforms:<\/p>\n
Hostbills, Zencart, BoxBilling, WHMCS, Joomla, WordPress, IPB, OsCommerce, MyBB, Vbulletin, Ellislab, OpenCart, Magento, PrestaShop, Drupal, phpBB, Lokomedia, cPanel.<\/em><\/td>\n<\/tr>\n\nadminer<\/em><\/td>\nOpens the database management page if an ‘adminer’ file is present, allowing viewing and modification of databases using the username and password.<\/td>\n<\/tr>\n \nsymlink<\/em><\/td>\nIn this part of the code, the contents of the file named.conf or named.txt name are displayed as a table consisting of Domains, Users, and symlink columns, and three different links are created, each of which is for a specific application that will be mentioned in Further Details.<\/td>\n<\/tr>\n \nAuto reset cPanel<\/td>\n Resets the password for cPanel in the case that it is used in managing the targeted website.<\/td>\n<\/tr>\n \nransomware<\/em><\/td>\nThis module encrypts files in desired directories, appending ‘.indsc’ extension to file names and adding a payment-related ‘index.php’ file next to the files. Encryption currently inactive due to the unavailability of the encryption address: http:\/\/encrypt.indsc.me\/api.php?type=encrypt.<\/td>\n<\/tr>\n \nsmtpgrabber<\/em><\/td>\nDisplays SMTP information such as SMTP Host, Port, User, Pass, Auth, Secure.<\/td>\n<\/tr>\n \nBypass cloud flare<\/em><\/td>\nIf the website is equipped with cdn cloudflare, different parts of this could be bypassed and the actual IP of each of the webmail, ftp, cpanel and other servers can be obtained.<\/td>\n<\/tr>\n \nkeluar<\/em><\/td>\nExit the program and returns to the login page.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/h4>\nFurther Details<\/h4>\n
?\u00a0Mass deface<\/strong><\/em><\/p>\nUpon selection of this option, the replacement content intended for the original file will be written in the respective directory files. Subsequently, the contents of all files with the specified name in the NamaFile<\/em><\/span> section within the directory will be altered.<\/p>\n![\"\u0645\u062d\u062a\u0648\u0627\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-7-%D9%85%D8%AD%D8%AA%D9%88%D8%A7%DB%8C-%D8%B5%D9%81%D8%AD%D9%87-Mass-deface.png\")
<\/p>\n
Figure 7 – Contents of Mass Deface page<\/p>\n
<\/p>\n
![\"\u0644\u06cc\u0633\u062a](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-8-%D9%84%DB%8C%D8%B3%D8%AA-%D9%81%D8%A7%DB%8C%D9%84%E2%80%8C%D9%87%D8%A7%DB%8C-%D8%AA%D8%BA%DB%8C%DB%8C%D8%B1-%D8%AF%D8%A7%D8%AF%D9%87-%D8%B4%D8%AF%D9%87-%D8%A8%D9%87-%D9%88%D8%B3%DB%8C%D9%84%D9%87-Mass-deface.png\")
<\/p>\n
Figure 8 – List of files changed by Mass deface<\/p>\n
<\/p>\n
![\"\u0635\u0641\u062d\u0647](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-9-%D8%B5%D9%81%D8%AD%D9%87-deface-%D8%B4%D8%AF%D9%87.png\")
<\/p>\n
Figure 9 \u2013 The defaced page<\/p>\n
<\/p>\n
?\u00a0Jumping<\/strong><\/em><\/p>\nIn the Jumping section, the presence of host management control panels in the system is checked, and the associated path files are displayed. This section operates as follows:
\n\u2022 If an H-sphere control panel exists on the system, a jump link will be established for the following path based on system user numbers and existing URLs:<\/p>\n
hsphere\/local\/home\/$user\/$url<\/span><\/p>\n\u2022 If H-sphere is not present on the system, it will navigate to the vhosts directory and create a jump link for different URLs for the following path:<\/p>\n
\/var\/www\/vhosts\/$url\/httpdocs<\/span><\/p>\n\u2022 Lastly, a jump link is created for each user for home\/$user_pro_jump\/public_html\/<\/span>. The executed sample displayed below, highlighted in green, has read-only access type.<\/p>\n <\/p>\n
![\"\u062e\u0631\u0648\u062c\u06cc](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-10-%D8%AE%D8%B1%D9%88%D8%AC%DB%8C-jumping.png\")
<\/p>\n
Figure 10 – Jump Output<\/p>\n
<\/p>\n
?\u00a0Adminer<\/em><\/strong><\/p>\nAdminer is a database management tool. The malware checks for its presence on the system and, if present, it displays the database login page. In this section, the attacker gains easy access to the database if login credentials are obtained:<\/p>\n
![\"\u0646\u0645\u0627\u06cc\u0634](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-11-%D9%86%D9%85%D8%A7%DB%8C%D8%B4-%D8%B5%D9%81%D8%AD%D9%87-adminer.png\")
<\/p>\n
Figure 11 \u2013 Displaying the Adminer Page<\/p>\n
<\/p>\n
?\u00a0Symlink<\/strong><\/p>\nSymlinks are files that act as pointers to other files, containing no content of their own but pointing to the original files. Deleting the original file renders the symlink unusable.<\/p>\n
![\"\u0645\u0627\u0698\u0648\u0644](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/1111%D9%85%D8%A7%DA%98%D9%88%D9%84-Symlink-%D8%A7%DB%8C%D9%86-%D8%A8%D8%AF%D8%A7%D9%81%D8%B2%D8%A7%D8%B1-%D8%B4%D8%A7%D9%85%D9%84-%D9%85%D9%88%D8%A7%D8%B1%D8%AF-%D8%B2%DB%8C%D8%B1-%D8%A7%D8%B3%D8%AA.png\")
<\/p>\n
Figure 12: Malware Symlink Module<\/p>\n
<\/h4>\nAccording to the above figure the Symlink module of this malware includes:<\/h4>\n
1\ufe0f\u20e3\u00a0Bypass Read<\/strong><\/em>: Selecting this option displays named.conf<\/em> file contents with read access in the output. Pressing save key, saves this content in named.txt<\/em> in the path to execute the original file.<\/p>\n![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/Bypass-Read.png\")
<\/p>\n
Figure 13: Bypass Read in the Symlink module<\/p>\n
2\ufe0f\u20e3\u00a0Symlink404<\/strong><\/em>:\u00a0 A symlink file can be created from the target file in the indosec_sym404<\/em> directory with the desired name. To Test the path one of the WordPress<\/em> files entered as the Target<\/em> file and\u00a0txt.12<\/em> as the symlink file name and is displayed upon clicking on the link >>Sukses<<.<\/em><\/p>\n <\/p>\n
![\"\u0628\u062e\u0634](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-12-%D8%A8%D8%AE%D8%B4-Symlink404.png\")
<\/p>\n
Figure 14- Symlink404 Section<\/p>\n
<\/p>\n
![\"\u0627\u0645\u06a9\u0627\u0646](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-13-%D8%A7%D9%85%DA%A9%D8%A7%D9%86-%D9%86%D9%85%D8%A7%DB%8C%D8%B4-%D9%85%D8%AD%D8%AA%D9%88%D8%A7%DB%8C-%D9%81%D8%A7%DB%8C%D9%84-Target.png\")
<\/p>\n
Figure 15 – Ability to display the contents of the Target<\/em> file<\/p>\n <\/p>\n
3\ufe0f\u20e3\u00a0Symlink Bypass<\/strong><\/em>: This displays etc\/passwd<\/em> file contents, containing system account information. Choosing Symlink<\/em> saves its content as passwd.txt<\/em> in the current path.<\/p>\n![\"Symlink](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/Symlink-Bypass.png\")
<\/p>\n
Figure 16 – Symlink Bypass<\/p>\n
<\/p>\n
?\u00a0Ransomware<\/strong>:<\/p>\nThis refers to the ability to execute ransomware. for this section, as depicted in the red box 1 below, the target file is read from the chosen path, encoded with the base64<\/em> algorithm, and sent to the attacker’s server. The returned packet includes an encrypted file, decoded and placed in $_ENC variable.<\/p>\nFollowing this step, the INDSC<\/em><\/span>. extension is added to the file name, and a SUCCESS<\/em> message appears in the output. However, actual encryption and extension changes were not performed during malware analysis due to server unavailability.<\/p>\nIn box 2, the operation related to displaying the PAYMENT<\/em> page is preformed, and an INDEX.HTML<\/em> file is created as PAYMENT<\/em>, with the content displayed below.<\/p>\n![\"\u0645\u062d\u062a\u0648\u0627\u06ccHTML](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-14-%D9%85%D8%AD%D8%AA%D9%88%D8%A7%DB%8CHTML-%D9%85%D8%B1%D8%A8%D9%88%D8%B7-%D8%B5%D9%81%D8%AD%D9%87-payment-1.png\")
<\/p>\n
<\/p>\n
![\"\u0645\u062d\u062a\u0648\u0627\u06ccHTML](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-144-%D9%85%D8%AD%D8%AA%D9%88%D8%A7%DB%8CHTML-%D9%85%D8%B1%D8%A8%D9%88%D8%B7-%D8%B5%D9%81%D8%AD%D9%87-payment.png\")
<\/p>\n
Figure 17: The HTML<\/em> content of the payment<\/em> page<\/p>\n <\/p>\n
![\"\u0635\u0641\u062d\u0647](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/05\/%D8%AA%D8%B5%D9%88%DB%8C%D8%B1-15-%D8%B5%D9%81%D8%AD%D9%87-payment.png\")
<\/p>\n
Figure 18 – The payment<\/em> page<\/p>\n <\/p>\n
How to deal with and clean the system?<\/h2>\n
Padvish Antivirus detects this malware. To avoid infection by such malware, it is recommended to:<\/p>\n
\u2705 Fully and securely configure your web server.<\/p>\n
\u2705 Block unused ports and services.<\/p>\n
\u2705 Use complex passwords and change them regularly.<\/p>\n
\u2705 Consistently apply security updates.<\/p>\n
<\/p>\n
What is WebShell?<\/h3>\n
WebShell is a malicious script written in scripting languages such as ASP, Python, PHP, or JSP. When injected onto the victim’s web server, these webshells grant the attacker complete control over the website. These attacks typically exploit security vulnerabilities in vulnerable web servers.
\nAttackers easily discover and target servers accessible on the Internet. By injecting the web shell into the web server, organizations face serious and sometimes irreparable risks. Therefore, organizations must prioritize these warnings and implement robust security measures.<\/p>\n
<\/p>\n
What is Backdoor.PHP.WebShell.Indosec?<\/h3>\n
This report discusses a sample from the Indosec family of web shells. Using this webshell, intruders can execute a range of malicious actions on the victim’s server.<\/p>\n
<\/p>\n
The capabilities of this malware:<\/strong><\/p>\n <\/p>\n To access the Webshell admin panel, the attacker creates a login page with the username admin<\/span><\/em>, as depicted in the image below the login page.<\/p>\n Figure 1-\u00a0\u00a0login Page<\/em><\/p>\n Upon successful login<\/span>, the following page is displayed. As illustrated, the IndoSec<\/span> Shell<\/span> <\/em>equips attackers with various capabilities.<\/p>\n Figure 2 – A view of\u00a0\u00a0home tab<\/em><\/p>\n \u25ab\ufe0fResult of executing ipconfig<\/span>\u00a0<\/em>in a Windows environment:<\/p>\n Figure 3 – Executing a Windows command in the terminal<\/p>\n <\/p>\n \u25ab\ufe0fResult of executing uname -a<\/em><\/span> command in a Linux environment:<\/p>\n Figure 4: Executing a Linux command in the terminal<\/p>\n <\/p>\n Figure 5 – System Information<\/p>\n <\/p>\n Figure 6 – Displaying the current directory<\/p>\n <\/p>\n The various capabilities of the malware are outlined in the table below:<\/strong><\/p>\n Put path configuration files of various content management systems (CMS) into a file named ‘$user_con-$nama_config.txt,’ providing critical information to the attacker including database name and password. Reviewed CMS platforms:<\/p>\n Hostbills, Zencart, BoxBilling, WHMCS, Joomla, WordPress, IPB, OsCommerce, MyBB, Vbulletin, Ellislab, OpenCart, Magento, PrestaShop, Drupal, phpBB, Lokomedia, cPanel.<\/em><\/td>\n<\/tr>\n ?\u00a0Mass deface<\/strong><\/em><\/p>\n Upon selection of this option, the replacement content intended for the original file will be written in the respective directory files. Subsequently, the contents of all files with the specified name in the NamaFile<\/em><\/span> section within the directory will be altered.<\/p>\n Figure 7 – Contents of Mass Deface page<\/p>\n <\/p>\n Figure 8 – List of files changed by Mass deface<\/p>\n <\/p>\n Figure 9 \u2013 The defaced page<\/p>\n <\/p>\n ?\u00a0Jumping<\/strong><\/em><\/p>\n In the Jumping section, the presence of host management control panels in the system is checked, and the associated path files are displayed. This section operates as follows: hsphere\/local\/home\/$user\/$url<\/span><\/p>\n \u2022 If H-sphere is not present on the system, it will navigate to the vhosts directory and create a jump link for different URLs for the following path:<\/p>\n \/var\/www\/vhosts\/$url\/httpdocs<\/span><\/p>\n \u2022 Lastly, a jump link is created for each user for home\/$user_pro_jump\/public_html\/<\/span>. The executed sample displayed below, highlighted in green, has read-only access type.<\/p>\n <\/p>\n Figure 10 – Jump Output<\/p>\n <\/p>\n ?\u00a0Adminer<\/em><\/strong><\/p>\n Adminer is a database management tool. The malware checks for its presence on the system and, if present, it displays the database login page. In this section, the attacker gains easy access to the database if login credentials are obtained:<\/p>\n Figure 11 \u2013 Displaying the Adminer Page<\/p>\n <\/p>\n ?\u00a0Symlink<\/strong><\/p>\n Symlinks are files that act as pointers to other files, containing no content of their own but pointing to the original files. Deleting the original file renders the symlink unusable.<\/p>\n Figure 12: Malware Symlink Module<\/p>\n 1\ufe0f\u20e3\u00a0Bypass Read<\/strong><\/em>: Selecting this option displays named.conf<\/em> file contents with read access in the output. Pressing save key, saves this content in named.txt<\/em> in the path to execute the original file.<\/p>\n Figure 13: Bypass Read in the Symlink module<\/p>\n 2\ufe0f\u20e3\u00a0Symlink404<\/strong><\/em>:\u00a0 A symlink file can be created from the target file in the indosec_sym404<\/em> directory with the desired name. To Test the path one of the WordPress<\/em> files entered as the Target<\/em> file and\u00a0txt.12<\/em> as the symlink file name and is displayed upon clicking on the link >>Sukses<<.<\/em><\/p>\n <\/p>\n Figure 14- Symlink404 Section<\/p>\n <\/p>\n Figure 15 – Ability to display the contents of the Target<\/em> file<\/p>\n <\/p>\n 3\ufe0f\u20e3\u00a0Symlink Bypass<\/strong><\/em>: This displays etc\/passwd<\/em> file contents, containing system account information. Choosing Symlink<\/em> saves its content as passwd.txt<\/em> in the current path.<\/p>\n Figure 16 – Symlink Bypass<\/p>\n <\/p>\n ?\u00a0Ransomware<\/strong>:<\/p>\n This refers to the ability to execute ransomware. for this section, as depicted in the red box 1 below, the target file is read from the chosen path, encoded with the base64<\/em> algorithm, and sent to the attacker’s server. The returned packet includes an encrypted file, decoded and placed in $_ENC variable.<\/p>\n Following this step, the INDSC<\/em><\/span>. extension is added to the file name, and a SUCCESS<\/em> message appears in the output. However, actual encryption and extension changes were not performed during malware analysis due to server unavailability.<\/p>\n In box 2, the operation related to displaying the PAYMENT<\/em> page is preformed, and an INDEX.HTML<\/em> file is created as PAYMENT<\/em>, with the content displayed below.<\/p>\n <\/p>\n Figure 17: The HTML<\/em> content of the payment<\/em> page<\/p>\n <\/p>\n Figure 18 – The payment<\/em> page<\/p>\n <\/p>\n Padvish Antivirus detects this malware. To avoid infection by such malware, it is recommended to:<\/p>\n \u2705 Fully and securely configure your web server.<\/p>\n \u2705 Block unused ports and services.<\/p>\n \u2705 Use complex passwords and change them regularly.<\/p>\n \u2705 Consistently apply security updates.<\/p>\n\n
Technical Review<\/h2>\n
Performance Description<\/h3>\n
<\/p>\n<\/p>\n\n
\nIn the following two figures, you can observe a command executed under the Windows terminal while the web shell operates in the Windows environment, and a command executed under the Linux terminal while the web shell operates in the Linux environment:<\/li>\n<\/ul>\n<\/p>\n<\/p>\n\n
<\/p>\n\n
<\/p>\n\n\n
\n Feature Name<\/strong><\/td>\n Feature Description<\/strong><\/td>\n<\/tr>\n \n upload<\/em><\/td>\n Enables file uploads to desired paths.<\/td>\n<\/tr>\n \n Bautfile<\/em><\/td>\n Enables creating new files and adding content to it.<\/td>\n<\/tr>\n \n Bautfolder<\/em><\/td>\n Enables creating new folders in desired paths.<\/td>\n<\/tr>\n \n Mass deface<\/em><\/td>\n Enables the attacker to batch changes index files, resulting in defaced websites on the victim’s server. This section enables simultaneous content changes to multiple files, so that the target path and file name determined by the attacker. As a result, the content of all files with the specified name (by default index.php ) located in the corresponding path will be changed.<\/td>\n<\/tr>\n \n Mass delete<\/em><\/td>\n \u00a0Deletes multiple files simultaneously.<\/td>\n<\/tr>\n \n jumping<\/em><\/td>\n Checks for the existence of host management control panels in the system and displays files in associated paths.<\/td>\n<\/tr>\n \n config<\/em><\/td>\n \n \n adminer<\/em><\/td>\n Opens the database management page if an ‘adminer’ file is present, allowing viewing and modification of databases using the username and password.<\/td>\n<\/tr>\n \n symlink<\/em><\/td>\n In this part of the code, the contents of the file named.conf or named.txt name are displayed as a table consisting of Domains, Users, and symlink columns, and three different links are created, each of which is for a specific application that will be mentioned in Further Details.<\/td>\n<\/tr>\n \n Auto reset cPanel<\/td>\n Resets the password for cPanel in the case that it is used in managing the targeted website.<\/td>\n<\/tr>\n \n ransomware<\/em><\/td>\n This module encrypts files in desired directories, appending ‘.indsc’ extension to file names and adding a payment-related ‘index.php’ file next to the files. Encryption currently inactive due to the unavailability of the encryption address: http:\/\/encrypt.indsc.me\/api.php?type=encrypt.<\/td>\n<\/tr>\n \n smtpgrabber<\/em><\/td>\n Displays SMTP information such as SMTP Host, Port, User, Pass, Auth, Secure.<\/td>\n<\/tr>\n \n Bypass cloud flare<\/em><\/td>\n If the website is equipped with cdn cloudflare, different parts of this could be bypassed and the actual IP of each of the webmail, ftp, cpanel and other servers can be obtained.<\/td>\n<\/tr>\n \n keluar<\/em><\/td>\n Exit the program and returns to the login page.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n <\/h4>\n
Further Details<\/h4>\n
<\/p>\n<\/p>\n<\/p>\n
\n\u2022 If an H-sphere control panel exists on the system, a jump link will be established for the following path based on system user numbers and existing URLs:<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/h4>\n
According to the above figure the Symlink module of this malware includes:<\/h4>\n
<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\n<\/p>\nHow to deal with and clean the system?<\/h2>\n