{"id":34620,"date":"2020-04-23T19:15:12","date_gmt":"2020-04-23T19:15:12","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31145\/NSA-Shares-List-Of-Vulnerabilities-Commonly-Exploited-To-Plant-Web-Shells.html"},"modified":"2020-04-23T19:15:12","modified_gmt":"2020-04-23T19:15:12","slug":"nsa-shares-list-of-vulnerabilities-commonly-exploited-to-plant-web-shells","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/nsa-shares-list-of-vulnerabilities-commonly-exploited-to-plant-web-shells\/","title":{"rendered":"NSA Shares List Of Vulnerabilities Commonly Exploited To Plant Web Shells"},"content":{"rendered":"

\"NSA\"<\/span>Image: ZDNet<\/span> <\/p>\n

The US National Security Agency (NSA) and the Australian Signals Directorate (ASD) have published a security advisory this week warning companies to search web-facing and internal servers for common web shells.<\/p>\n

Web shells are one of today’s most popular forms of malware. The term “web shell” refers to a malicious program or script that’s installed on a hacked server.<\/p>\n

Web shells provide a visual interface that hackers can use to interact with the hacked server and its filesystem. Most web shells come with features to let hackers rename, copy, move, edit, or upload new files on a server. They can also be used to change file and directory permissions, or archive and download (steal) data from the server.<\/p>\n

Hackers install web shells by exploiting vulnerabilities in internet-facing servers or web applications (such as CMS, CMS plugins, CMS themes, CRMs, intranets, or other enterprise apps, etc.).<\/p>\n

Web shells can be written in any programming language, from Go to PHP. This allows hackers to hide web shells inside any website’s code under generic names (like index.asp or uploader.php), which makes detection by a human operator almost impossible without the aid of a web firewall or web malware scanner.<\/p>\n

In a report published in February this year, Microsoft said it detects around 77,000 active web shells on a daily basis<\/a>, making this web shells one of today’s most prevalent malware types.<\/p>\n

Web shells can act as backdoors into internal networks<\/h3>\n

However, many companies don’t fully understand the danger of having a web shell installed on their systems. Web shells, basically, act as backdoors, and need to be treated with the utmost importance and urgency.<\/p>\n

\n<\/section>\n

In a security advisory published this week, the NSA and ASD raised awareness towards this often ignored attack vector.<\/p>\n

“Web shells can serve as persistent backdoors or as relay nodes to route attacker commands to other systems,” the two agencies said. “Attackers frequently chain together web shells on multiple compromised systems to route traffic across networks, such as from internet-facing systems to internal networks.”<\/p>\n

The two agencies have now published a joint 17-page report [PDF<\/a>] that contains tools to help system administrators detect and deal with these types of threats. The advisory includes:<\/p>\n