Web shell
Also: Webshell
A small script planted on a web server that turns ordinary HTTP requests into a command channel, giving an attacker a way back in after the original route is closed.
A web shell is a file the server will execute, placed where the server already serves from. Once there it needs no listening port, no outbound connection and no unusual protocol: commands arrive as web requests and answers return as web responses. That is why it survives firewall rules written around everything else.
Why it is among the first things planted
It is the cheapest form of persistence. In the BeyondTrust Remote Support intrusions the operators used an authentication bypass for access, escalated to root by enabling Set User ID permissions, then deployed a web shell named Sawfly alongside a tunneler called Bareclaw and wiped the logs. The sequence is ordinary: get in once, leave something that removes the need to do it again.
Unit 42's CL-UNK-1211 campaign showed the same preference at scale, combining open-source tools, custom cross-platform backdoors and web shells deployed widely, so that finding one component does not end the access.
What makes it hard to find
It looks like the application. The file sits among files the server is meant to execute, and its traffic is the traffic the server is meant to receive. Detection usually comes from file integrity monitoring rather than from watching the network.
Questions
- What does a web shell do?
- It turns ordinary web requests into a command channel on the server. Commands arrive as HTTP requests and output returns as HTTP responses, so the attacker needs no new port and no outbound connection.
- Why plant one after already getting in?
- For persistence. The original route may be patched, and a web shell allows a return without repeating the exploit. In the BeyondTrust intrusions the operators deployed one named Sawfly together with a tunneler, then wiped the logs.