Technique
technique:web_shell
Also: ASPX web shell, web shells
Server-side shell uploaded through a file-upload process to obtain command execution on a web server.
Server-side shell uploaded through a file-upload process to obtain command execution on a web server.
“you put an ASPX web shell on there, upload it as part of that ticket”
Remote command-line access installed on internet-facing firewalls so attackers could log in directly.
“they’re putting just regular old web shells on the firewalls”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Project Raven | Explicit | 47 |
| incoming | INVOLVES | Baja | Explicit | 174 |
Project Raven USES web shell
The team uploaded an ASPX web shell through the Managed Engine ticket system to obtain access to a server.
Explicit Confidence 99% · David EP 47 Details
“you put an ASPX web shell on there, upload it as part of that ticket”
The attackers used web shells to obtain direct remote access to Sophos Firewalls.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“they’re putting just regular old web shells on the firewalls”