How can I detect whether a webshell exploit has been run?

Question

My forum was running MyBB 1.6.10 and maldet found a JPG file with the webshell by Orb malware code at the end (php.cmdshell.unclassed.352). I'm using nginx and had secured against arbitrary files being processed as PHP files per this guide.

Still - how could I check whether the exploit has indeed been executed from the malformed JPG file that the attacker uploaded as their avatar?

Answer 1

You can do a self pen-testing by:

1. Executing that php file in your case the arbitrary jpeg file in your browser and see if it displays or execute a simple Linux command say ls.

Example: say the jpeg file is in your <path>/uploads/ you shoulbe be able to get a shell from your browser if you enter http://yourSite.com/uploads/shell.jpeg

1. You can also detect such web malware by analysing your HTTP access logs. Because these malwares depends on the HTTP protocol having your ewb server serving the requests; it should log all access and errors. For Nginx your logs should be under
   • access: /var/log/nginx/access.log
   • error: /var/log/nginx/error.log

Example: cat /var/log/nginx/access.log | grep -i 'name_of_file.jpeg.php'

---

Note: You do not want to remove the web malware until you see what the uploader has done or doing to your server, so you can recover from any damage.

Post Mitigation: After you mitigate the damage, fix your application vulnerability by updating to restricting who can upload files, in addition you may want to disable PHP execution entirely in you /uploads/ folder (how?)