PHP Web Shell b374k v3.2.3

The b374k web shell acts as a backdoor that allows attackers to bypass authentication, maintain access to the server, and re-infect files. This will affect any PHP-based website including WordPress, Joomla, Drupal, and Magento. An attacker can initially compromise the server by uploading the shell via a vulnerability or some other misconfigured upload mechanism.

Exploitation

Stages

1. The attacker uploads a shell to a vulnerable or misconfigured system.
2. The attacker attempts to access the b374k web shell functionality to carry out malicious objectives.
3. The server responds by indicating its presence and the result of the attacker’s request.

Prerequisites

The attacker must be able to inject the malicious code onto the web server through another vulnerability or exploit.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.