0

I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp client then I can use shell in hosting. my question is how to block the opening of the shell even if uploaded via ftp? any mod_security rule to use and if so what? I also use cPanel

Improve this question
2
  • Can you provide more detail about what you mean by "opening a shell"? I'm assuming this means opening SSH, or a reverse shell, like something that gives remote bash / powershell control of the machine?
    – Mike Ounsworth
    Jan 16, 2020 at 22:26
  • @schroeder understood me correctly. I want to detect when someone connects to an unknown shell in an unknown location. Thanks u for your understanding. Webshell
    – Квлади
    Jan 17, 2020 at 7:01

1 Answer 1

Reset to default
2

ModSecurity is a Web Application Firewall. FTP is not Web traffic, HTTP and HTTPS are. This means ModSecurity cannot be used for filtering FTP traffic not can it be used to filter mail traffic.

Also, ModSecurity does not protect against misuse of hacked accounts or severe server misconfiguration in general. If somebody is able to use FTP to upload malicious code which then can get executed as part of the website (like a webshell) then this can only be done if you either allow anonymous upload to your web hosting (misconfiguration - just don't!) or that the username and password to your account is known to the attacker.

Improve this answer
5
  • I I know what mod_security is. I'm trying to create a rule that checks the file that opens for malware, for example: (but doesn't work) SecRule RESPONSE_BODY "@inspectFile /usr/local/maldetect/modsec.sh" \ "log, auditlog, deny, severity: 2, phase: 2, t: none, status: 403, msg: 'Malicious open Identified.' "
    – Квлади
    Jan 16, 2020 at 20:40
  • 2
    Then why did you mention FTP? Do you mean that you can upload a shell via FTP to the web directory and access it via the web? And you want to detect when someone connects to an unknown shell in an unknown location? The remedy for that would appear to be to not let FTP users have access to the web directories ...
    – schroeder ♦
    Jan 16, 2020 at 20:50
  • 1
    @Квлади: There is no generic webshell. The parameters in the call of a webshell can be anything - it is fully up the malicious server side component how to interpret it. The command to execute can for example be "encrypted" (simple rot13 or variation might be enough) so that a simple pattern match will not work.
    – Steffen Ullrich
    Jan 16, 2020 at 20:53
  • 1
    @Квлади: Essentially your question boils down to detect misuse of a compromised webserver account using ModSecurity. But this is the wrong tool for the job. Instead you should check the integrity of the server and not just rely on analyzing the network traffic to the server.
    – Steffen Ullrich
    Jan 16, 2020 at 20:58
  • @schroeder understood me correctly. I want to detect when someone connects to an unknown shell in an unknown location. Thanks u for your understanding
    – Квлади
    Jan 16, 2020 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .