{"id":1524,"date":"2026-01-14T19:58:00","date_gmt":"2026-01-14T19:58:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1524"},"modified":"2026-01-14T14:58:34","modified_gmt":"2026-01-14T14:58:34","slug":"detecting-web-shells","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1524","title":{"rendered":"Detecting Web Shells"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/detectingwebshells<\/a>
Created by: tryhackme, ryla, TactfulTurtle<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Before we begin, THM links to other rooms. Check these out if you need to:

Web Application Basics<\/a>: HTTP Request Methods & Responses

MITRE<\/a>: Initial Access & Persistence Tactics

Intro to Log Analysis<\/a>: Common Log Formats<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which MITRE ATT&CK Persistence sub-technique are web shells associated with?”

https:\/\/attack.mitre.org\/techniques\/T1505\/003\/<\/a><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What file extension is commonly used for web shells targeting Microsoft Exchange?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

In Task 3, Anatomy of a Web Shell, we are tasked with launching our VM and launching our webshell.

“Access the shell and determine which account you have access to by running the\u00a0whoami<\/code>\u00a0command.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“List the directory contents and find the flag using the\u00a0ls<\/code>\u00a0and\u00a0cat<\/code>\u00a0commands.”

ls -la, then cat flag.txt to obtain the flag.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 4, Log-based Detection! THM shows great examples and snippets in this task to look at and read over.<\/p>\n\n\n\n

\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

For question: “What is the part of the URL that associates values to parameters and can be a valuable indicator of web shell activity?” and “What auditd syscall would confirm that a file was written to disk following a suspicious POST request to\u00a0\/upload.php<\/code>?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 5, Beyond Logs!<\/p>\n\n\n\n

\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n

For questions: “What command would you use to locate\u00a0.php<\/code>\u00a0files in the\u00a0\/var\/www\/<\/code>\u00a0directory?” and “Which Wireshark filter would you use to search specifically for\u00a0PUT<\/code>\u00a0requests?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to task 6, Investigation!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which IP address likely belongs to the attacker?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the first directory that the attacker successfully identifies?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the name of the\u00a0.php<\/code>\u00a0file the attacker uses to upload the web shell?”

I used the command cat access.log | grep “php”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the first command run by the attacker using the newly uploaded web shell?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“After gaining access via the web shell, the attacker uses a command to download a second file onto the server. What is the name of this file?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“The attacker has hidden a secret within the web shell.
Use cat<\/code> to investigate the web shell code and find the flag.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/detectingwebshellsCreated by: tryhackme, ryla, TactfulTurtle Before we begin, THM links to other rooms. Check these out if you need to: Web Application Basics: HTTP Request Methods & Responses MITRE: Initial Access & Persistence Tactics Intro to Log Analysis: Common Log Formats “Which MITRE ATT&CK Persistence sub-technique are web shells associated with?” https:\/\/attack.mitre.org\/techniques\/T1505\/003\/ “What file extension is commonly used for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1524","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1524","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1524"}],"version-history":[{"count":2,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1524\/revisions"}],"predecessor-version":[{"id":1550,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1524\/revisions\/1550"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1524"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1524"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1524"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}