Web Shell PHPspy

PHPspy is a web shell authored by the Chinese hacker 4ngel and later by S4T (Security Angel Team). A range of decoded samples have been found which show the development of the tool over time. The earliest versions offer file/directory management, SQL database access, and OS command execution. Successive releases added new functionality, the ability to download plugins, and eventually the obfuscation of request parameters.

Exploitation

Stages

1. The attacker sends an HTTP POST with commands to the PHPspy web shell on the infected server.
2. PHPspy on the infected server replies with an HTTP 200 OK response containing the web shell HTML page.

Prerequisites

The malicious files must have become resident on the victim host utilizing some other exploit or entry vector.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to allow the malicious files to become resident on the victim machine. Ensure that all software on internet-facing machines is up-to-date.