Today we will discuss to how to find shells on the web servers. Its a real pain for web server admins once either the web server is rooted, sites defaced or backdoored. Hackers are getting smarter today. To keep the control on the websites or web server, they either backdoor on the servers or web pages. Generally PHP evil codes are using these days to backdoor web sites. So the objective of this post is to find the hidden shells, shells on the server  using their names, searching through files scanning for the evil  PHP codes. These evil codes can be found specially in the .PHP files. Below is the example of such code:-

"<? php $_Get(['cmd']) ?>. 

There are many versions of this code floating around the web. Hackers uses the system, exec variants of this code. 

Though this code looks like a single line of code but believe me it is one of the most dangerous code used by hackers. It is so powerful that it can take the complete web server down. So our objective is not going to discuss to how to achieve this but to look out some ways to how to search the backdoors on the web server.


Look at this perl script.

#code cut

#!/usr/bin/perl -w 
# findshell v1.0 - by no way this code is mine, credit to authors
#usage: ./findshell.pl <sensitivity 1-50> <directory to scan> 
use strict; 
use File::Find; 
my $sens = shift  || 10; 
my $folder = shift || './'; 
find(&backdoor, "$folder"); 
sub backdoor { 
    if ((/.(php|txt)/)){ 
       open (my $IN,"<$_") || die "can not open datei $File::Find::name: $!"; 
       my @file =  <$IN>; 
       #maybe evil stuffs 
       my $score = grep (/function_exists(|phpinfo(|safe_?mode|shell_exec(|popen(|passthru(|system(|myshellexec(|exec(|getpwuid(|getgrgid  (|fileperms(/i,@file); 
       #probably evil stuffs 
       my $tempscore = grep(/`\$\_(post|request|get).{0,20}\`|(include|require|eval|system|passthru|shell_exec).{0,10}\$\_(post|request|get)|eval.{0,10}base64_decode|back_connect|backdoor|r57|PHPJackal|PhpSpy|GiX|Fx29SheLL|w4ck1ng|milw0rm|PhpShell|k1r4|FeeLCoMz|FaTaLisTiCz|Ve_cENxShell|UnixOn|C99madShell|Spamfordz|Locus7s|c100|c99|x2300|cgitelnet|webadmin|STUNSHELL|Pr!v8|PHPShell|KaMeLeOn|S4T|oRb|tryag|sniper|noexecshell|\/etc\/passwd|revengans/i, @file); 
       $score +=  50 *  $tempscore; 
       print "$score - Possible backdoor : $File::Find::name\n" if ($score > $sens-1 ); 
       close $IN; 
  }elsif((/\.(jpg|jpeg|gif|png|tar|zip|gz|rar|pdf)/)){ 
       open (my $IN,"<$_") || (print "can not open datei $File::Find::name: $!" && next); 
       print "5000 - Possible backdoor (php in non-php file): $File::Find::name\n" if grep /(\<\?php|include(\ |\())/i, <$IN>; 
       close $IN; 
  } 
}  

#code cut

Execute:Perl findshell . PL 10  / srv / www / htdocs  >  scanout . txt 
sort scanout . txt  

*By no means this is my code. I gives full credit to the author of this code.


This script searches though the entire file system and try to look for the hidden shells scirpts, code.

The code can be modified easily and add different shells names to have better result.

Remember: Perl must be installed to run the script.

Thanks,
Mike