PS PHP Web Shell

The PS PHP web shell is a lightweight web shell that receives and executes OS commands. This shell could be used as an initial dropper before establishing persistence with a larger web shell or by exfiltrating credentials for another service such as SSH.

Exploitation

Stages

1. An attacker uploads a shell to a vulnerable or misconfigured system.
2. The attacker attempts to access web shell functionality to carry out objectives.
3. The web shell responds with the output from the command.

Prerequisites

The attacker must be able to send crafted packets to the target system.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.