0

I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp client then I can use shell in hosting. my question is how to block the opening of the shell even if uploaded via ftp? any mod_security rule to use and if so what? I also use cPanel

2
  • Can you provide more detail about what you mean by "opening a shell"? I'm assuming this means opening SSH, or a reverse shell, like something that gives remote bash / powershell control of the machine? Jan 16 '20 at 22:26
  • @schroeder understood me correctly. I want to detect when someone connects to an unknown shell in an unknown location. Thanks u for your understanding. Webshell Jan 17 '20 at 7:01
2

ModSecurity is a Web Application Firewall. FTP is not Web traffic, HTTP and HTTPS are. This means ModSecurity cannot be used for filtering FTP traffic not can it be used to filter mail traffic.

Also, ModSecurity does not protect against misuse of hacked accounts or severe server misconfiguration in general. If somebody is able to use FTP to upload malicious code which then can get executed as part of the website (like a webshell) then this can only be done if you either allow anonymous upload to your web hosting (misconfiguration - just don't!) or that the username and password to your account is known to the attacker.

5
  • I I know what mod_security is. I'm trying to create a rule that checks the file that opens for malware, for example: (but doesn't work) SecRule RESPONSE_BODY "@inspectFile /usr/local/maldetect/modsec.sh" \ "log, auditlog, deny, severity: 2, phase: 2, t: none, status: 403, msg: 'Malicious open Identified.' " Jan 16 '20 at 20:40
  • 2
    Then why did you mention FTP? Do you mean that you can upload a shell via FTP to the web directory and access it via the web? And you want to detect when someone connects to an unknown shell in an unknown location? The remedy for that would appear to be to not let FTP users have access to the web directories ...
    – schroeder
    Jan 16 '20 at 20:50
  • 1
    @Квлади: There is no generic webshell. The parameters in the call of a webshell can be anything - it is fully up the malicious server side component how to interpret it. The command to execute can for example be "encrypted" (simple rot13 or variation might be enough) so that a simple pattern match will not work. Jan 16 '20 at 20:53
  • 1
    @Квлади: Essentially your question boils down to detect misuse of a compromised webserver account using ModSecurity. But this is the wrong tool for the job. Instead you should check the integrity of the server and not just rely on analyzing the network traffic to the server. Jan 16 '20 at 20:58
  • @schroeder understood me correctly. I want to detect when someone connects to an unknown shell in an unknown location. Thanks u for your understanding Jan 16 '20 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.