CAPEC-650: Upload a Web Shell to a Web Server

MITRE CAPEC attack pattern

Description

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-287, CWE-553

ATT&CK techniques: T1505.003

Prerequisites

• The web server is susceptible to one of the various web application exploits that allows for uploading a shell file.

Consequences

• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Gain Privileges
• Confidentiality, Integrity, Availability: Execute Unauthorized Commands

Mitigations

• Make sure your web server is up-to-date with all patches to protect against known vulnerabilities.
• Ensure that the file permissions in directories on the web server from which files can be execute is set to the "least privilege" settings, and that those directories contents is controlled by an allowlist.

Source

• MITRE CAPEC CAPEC-650