Hello and welcome to
another application of the under
attack framework discussion
today we're looking at Web
Chelm. So with that, let's
go ahead and jump in to our
objectives.
So today's objectives are
as follows.
We're going to be describing what
Web shell is within the modern
attack framework.
We're going to look at some examples
of how it has been used.
We're going to look at some mitigation
techniques and then we're going
to discuss some detection techniques
as well.
So within minor
web, shell is essentially
a script that takes
advantage of accessible
Web servers.
And so something that is either
internal, that maybe is serving up
Web content, which is sometimes
the case with internal file systems
or like SharePoint servers or things
of that nature. But that's changed a
lot.
And then typically what I
see are you've
got some type of
device, this case, it's
a server and that's w
w w there and
it sits out on the
Internet somewhere and then
it connects back into
some type of infrastructure
or whatever the case may be there.
And so you probably have some type
of firewall or something like that
in place that's helping to
keep this safe and keep it DMZ.
But sometimes what we see
is these aren't always the most
secure and they kind of work
outside of the firewall in
some cases, depending on how your
rule sets are set up or whatever the
case may be.
And so this allows a threat actor to
use the system
in a way or in ways that the
administrator may not have intended
to either attack end users and
steal personal information or to
further compromise the organization
systems. Essentially, using this
device is a point to move laterally
further into the network.
Now, some types of web show
tools upon doing some research
and looking through these are just a
few. So we've got aspects
SPI, which is a Web shell
that takes advantage of dot net HSP.
We've got George, which is
uses Python to DOT seven
and allows users to create
a TCP circuit through valid HTTP
requests.
We've got Untack, which is a
Web show written in ASPEY, that net
which utilizes PowerShares.
So we've talked a lot about power
sharing and how powerful it is.
It's in the name Folks Power Shell.
We looked at China chopper here, so
essentially this is a simple back
door to key components
web show that provides command and
control functions and
text based Web shell
payload. So
these are just a small
percentage of the tools that
are out there.
And what I see a lot of times,
especially with like bug downie's
or with Web
attacks and things of that nature,
most of the time threat actors
are taking advantage of things like
fuel injection, cross-shaped script
and things of that nature.
But this particular
vector is one of many
ways in which Web
services, web applications,
externally facing Web
devices are taking being
taken advantage of.
Now, let's go ahead and talk at a
high level on some mitigation
techniques so we can ensure
that at least privilege is practiced
on account. So we've talked about
this time and time again,
but ensuring that users only
have what is required to do their
jobs and their tasks is important.
And then when we look at external
server accounts,
they should not match internal
accounts in the event of a
compromise. And you're saying, well,
OK, well, that's an interesting
statement.
How does that work?
I mean, so essentially what you're
doing again is we've got
a Web server, right?
And that Web server has
essentially an account that either
you have locally or
elsewhere. But the problem is, is
that the way I'm looking at this is
if you've got a domain account
that allows internal access to,
let's say, your workstation
and things of that nature and you
can use it on other systems, then
you have this domain account on this
is compromised or it's used and
a threat actually gets into it.
They now have access to everything
else. But if this account is
local to the system
for management purposes or whatever
the case may be, and for some reason
that account is compromised for
some reason, then
really that access is local.
Right. And so that kind of cuts
everything off and keeps that threat
actor at least on that system for
the time being until they're able to
maybe do something else or attempt
to move laterally through some other
vulnerability.
But if you've done the proper
segmentation and this device is DMZ
and the accounts are separate and
things of that nature, then you
don't have to worry about it.
But except for, of course,
cleaning up the system.
But when you
use the same account across
the organization, as well as for
managing the system, let's
say it's an Office 365 account, the.
It's tied to it.
OK, they may not be able to get any
further here because we've got a
DMZ, but
they can then just go and use that
account to maybe log into Office
365.
And chances are if you're
administering a Web server and
you're not practicing these
privilege and kind
of what's necessary to do your job
function, chances are you're
probably the person where in the
office three six five had as well.
And so that could lead to a
compromise of the tenet if
you're not separating out your
administrator from your normal
account and then, of course,
ensure that server software is up to
date. That's a really
good point as far as what I've
seen with especially
external scanning, just an external
scanning and things of that nature.
A number of times we find that
the systems that are not up to date
are compounded with issues
because they're not running current
versions of Apache Persay
and they're also not running
current versions of.
And so it's very odd most of
the time for me that I run into
an organization that's running its
own systems externally.
And I find that Apache's not up to
date, but is good.
Right. I usually see both of
those instances where there's a
number of things that aren't updated
and that just makes the attack
surface that much wider
on that particular system.
So keeping things up today and doing
this privilege is a great way
to reduce the threat surface
here, the attack surface.
So as far as detection is concerned,
process monitoring may be used to
detect Web servers that perform
suspicious activity, such as running
a command prompt or accessing
files that are not in the Web
directories. And so threat actors
will try to bypass the
Web directory to get into other
system directories and get to
sensitive files and things of that
nature. So those activities are
taking place.
You could have a threat actor on
your hands that's trying to get into
something and then log
authentication attempts and look for
unusual patterns
again. Any time you start to
see maybe a systems
being hammered.
Right, with login attempts and
it's trying maybe dictionary style
attacks or something like that, if
you can't block every IP
address, there may be some level
of risk that you have to accept that
you can do your best there to
prevent folks from pounding
away at the server. But if somebody
suddenly gets in
and then those attacks stop.
Did they get in or did they move on,
right? So you have to make sure
that you're reviewing those things
regularly and as you're going
through like a dictionary type
attack and reviewing it and you
see, OK, they tried.
They tried. They tried, they tried.
They tried.
And suddenly there's this last line
and they fail
and it stops.
And then you notice, oh, there
is an account that would have come
after that. If we're doing
alphabetical order here and it's
successfully logged in, OK, you
probably need to do some review and
you may have somebody on your
system.
So let's go ahead and do a quick
check on learning true
or false web,
allow threat actors to take
advantage of Web servers to
gain redundant access or persistence
on the system.
All right, well, if you need
additional time, please pause the
video and take it now.
So this particular statement
makes sense, right?
They can take advantage of Web
servers using Web
shells and you can gain
redundant access.
Persistence is essentially what
both of these things mean.
So it's either persistence or
redundant access, however you want
to say it on the system.
So in this case, this particular
statement is a true
statement.
Now, let's go ahead and jump over to
our summary.
So in summary, today we
described what a web shell is.
We looked at some tools,
we talked about some mitigation
techniques and we talked detection
techniques. Again, there's no silver
bullet in any of these areas.
You'll probably start to notice
some Interlaken between
like Web shell could also use
power shell and some of
the mitigation techniques.
Here are mitigation techniques and
privilege escalation areas.
And some of the detection techniques
are detection techniques elsewhere.
And so there's a lot of dovetailing
between these different components.
And you'll see a number of the ATP
groups and things of that nature
between multiple vectors
and things of that nature.
But it's still beneficial to talk
about, you know, a lot of these
individually and bring up some
unique cases with each.
So with that, I want to thank you
for your time today, and I look
forward to seeing you again soon.