{"id":479647,"date":"2023-08-09T10:43:04","date_gmt":"2023-08-09T10:43:04","guid":{"rendered":""},"modified":"2023-09-05T11:19:16","modified_gmt":"2023-09-05T11:19:16","slug":"web-shell","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/web-shell\/","title":{"rendered":"V\u1ecf web"},"content":{"rendered":"

Web shell \u0111\u1ec1 c\u1eadp \u0111\u1ebfn m\u1ed9t t\u1eadp l\u1ec7nh ho\u1eb7c ch\u01b0\u01a1ng tr\u00ecnh \u0111\u1ed9c h\u1ea1i m\u00e0 t\u1ed9i ph\u1ea1m m\u1ea1ng tri\u1ec3n khai tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 web \u0111\u1ec3 gi\u00e0nh quy\u1ec1n truy c\u1eadp v\u00e0 ki\u1ec3m so\u00e1t tr\u00e1i ph\u00e9p. C\u00f4ng c\u1ee5 b\u1ea5t h\u1ee3p ph\u00e1p n\u00e0y cung c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng giao di\u1ec7n d\u00f2ng l\u1ec7nh t\u1eeb xa, cho ph\u00e9p ch\u00fang thao t\u00fang m\u00e1y ch\u1ee7, truy c\u1eadp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m v\u00e0 th\u1ef1c hi\u1ec7n nhi\u1ec1u ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i kh\u00e1c nhau. \u0110\u1ed1i v\u1edbi c\u00e1c nh\u00e0 cung c\u1ea5p m\u00e1y ch\u1ee7 proxy nh\u01b0 OneProxy (oneproxy.pro), vi\u1ec7c hi\u1ec3u c\u00e1c web shell v\u00e0 \u00fd ngh\u0129a c\u1ee7a ch\u00fang l\u00e0 r\u1ea5t quan tr\u1ecdng \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh b\u1ea3o m\u1eadt v\u00e0 t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a d\u1ecbch v\u1ee5 c\u1ee7a h\u1ecd.<\/p>\n

L\u1ecbch s\u1eed ngu\u1ed3n g\u1ed1c c\u1ee7a Web shell v\u00e0 l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn n\u00f3<\/h2>\n

Kh\u00e1i ni\u1ec7m web shell xu\u1ea5t hi\u1ec7n v\u00e0o cu\u1ed1i nh\u1eefng n\u0103m 1990 khi internet v\u00e0 c\u00f4ng ngh\u1ec7 web tr\u1edf n\u00ean ph\u1ed5 bi\u1ebfn. Ban \u0111\u1ea7u, ch\u00fang nh\u1eb1m m\u1ee5c \u0111\u00edch h\u1ee3p ph\u00e1p, cho ph\u00e9p qu\u1ea3n tr\u1ecb vi\u00ean web qu\u1ea3n l\u00fd m\u00e1y ch\u1ee7 t\u1eeb xa m\u1ed9t c\u00e1ch d\u1ec5 d\u00e0ng. Tuy nhi\u00ean, t\u1ed9i ph\u1ea1m m\u1ea1ng nhanh ch\u00f3ng nh\u1eadn ra ti\u1ec1m n\u0103ng c\u1ee7a web shell l\u00e0 c\u00f4ng c\u1ee5 m\u1ea1nh m\u1ebd \u0111\u1ec3 khai th\u00e1c c\u00e1c \u1ee9ng d\u1ee5ng v\u00e0 m\u00e1y ch\u1ee7 web d\u1ec5 b\u1ecb t\u1ea5n c\u00f4ng.<\/p>\n

L\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn web shell trong b\u1ed1i c\u1ea3nh t\u1ed9i ph\u1ea1m l\u00e0 v\u00e0o \u0111\u1ea7u nh\u1eefng n\u0103m 2000 khi nhi\u1ec1u di\u1ec5n \u0111\u00e0n v\u00e0 trang web hack kh\u00e1c nhau b\u1eaft \u0111\u1ea7u th\u1ea3o lu\u1eadn v\u1ec1 kh\u1ea3 n\u0103ng c\u1ee7a ch\u00fang c\u0169ng nh\u01b0 c\u00e1ch s\u1eed d\u1ee5ng ch\u00fang \u0111\u1ec3 x\u00e2m ph\u1ea1m c\u00e1c trang web v\u00e0 m\u00e1y ch\u1ee7. K\u1ec3 t\u1eeb \u0111\u00f3, m\u1ee9c \u0111\u1ed9 ph\u1ee9c t\u1ea1p v\u00e0 ph\u1ed5 bi\u1ebfn c\u1ee7a web shell \u0111\u00e3 t\u0103ng l\u00ean \u0111\u00e1ng k\u1ec3, d\u1eabn \u0111\u1ebfn nh\u1eefng th\u00e1ch th\u1ee9c \u0111\u00e1ng k\u1ec3 v\u1ec1 an ninh m\u1ea1ng \u0111\u1ed1i v\u1edbi c\u00e1c qu\u1ea3n tr\u1ecb vi\u00ean m\u00e1y ch\u1ee7 web v\u00e0 c\u00e1c chuy\u00ean gia b\u1ea3o m\u1eadt.<\/p>\n

Th\u00f4ng tin chi ti\u1ebft v\u1ec1 Web shell \u2013 M\u1edf r\u1ed9ng ch\u1ee7 \u0111\u1ec1 Web shell<\/h2>\n

Web shell c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c tri\u1ec3n khai b\u1eb1ng nhi\u1ec1u ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh kh\u00e1c nhau, bao g\u1ed3m PHP, ASP, Python v\u00e0 c\u00e1c ng\u00f4n ng\u1eef kh\u00e1c. Ch\u00fang khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng trong \u1ee9ng d\u1ee5ng web ho\u1eb7c m\u00e1y ch\u1ee7, ch\u1eb3ng h\u1ea1n nh\u01b0 x\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o kh\u00f4ng \u0111\u00fang, m\u1eadt kh\u1ea9u y\u1ebfu ho\u1eb7c phi\u00ean b\u1ea3n ph\u1ea7n m\u1ec1m l\u1ed7i th\u1eddi. Khi web shell \u0111\u01b0\u1ee3c tri\u1ec3n khai th\u00e0nh c\u00f4ng, n\u00f3 s\u1ebd c\u1ea5p quy\u1ec1n truy c\u1eadp tr\u00e1i ph\u00e9p v\u00e0o m\u00e1y ch\u1ee7 v\u00e0 cung c\u1ea5p m\u1ed9t lo\u1ea1t ch\u1ee9c n\u0103ng \u0111\u1ed9c h\u1ea1i, bao g\u1ed3m:<\/p>\n

    \n
  1. \n

    Th\u1ef1c thi l\u1ec7nh t\u1eeb xa:<\/strong> Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7 b\u1ecb x\u00e2m nh\u1eadp t\u1eeb xa, cho ph\u00e9p ch\u00fang t\u1ea3i xu\u1ed1ng\/t\u1ea3i t\u1ec7p l\u00ean, s\u1eeda \u0111\u1ed5i c\u1ea5u h\u00ecnh h\u1ec7 th\u1ed1ng, v.v.<\/p>\n<\/li>\n

  2. \n

    L\u1ecdc d\u1eef li\u1ec7u:<\/strong> Web shell cho ph\u00e9p t\u1ed9i ph\u1ea1m m\u1ea1ng truy c\u1eadp v\u00e0 \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef tr\u00ean m\u00e1y ch\u1ee7, ch\u1eb3ng h\u1ea1n nh\u01b0 th\u00f4ng tin \u0111\u0103ng nh\u1eadp, th\u00f4ng tin t\u00e0i ch\u00ednh v\u00e0 d\u1eef li\u1ec7u c\u00e1 nh\u00e2n.<\/p>\n<\/li>\n

  3. \n

    T\u1ea1o c\u1eeda sau:<\/strong> Web shell th\u01b0\u1eddng ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t c\u1eeda h\u1eadu, cung c\u1ea5p \u0111i\u1ec3m v\u00e0o b\u00ed m\u1eadt cho nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng ngay c\u1ea3 sau khi l\u1ed7 h\u1ed5ng khai th\u00e1c ban \u0111\u1ea7u \u0111\u00e3 \u0111\u01b0\u1ee3c v\u00e1.<\/p>\n<\/li>\n

  4. \n

    Tuy\u1ec3n d\u1ee5ng Botnet:<\/strong> M\u1ed9t s\u1ed1 web shell n\u00e2ng cao c\u00f3 th\u1ec3 bi\u1ebfn c\u00e1c m\u00e1y ch\u1ee7 b\u1ecb x\u00e2m nh\u1eadp th\u00e0nh m\u1ed9t ph\u1ea7n c\u1ee7a m\u1ea1ng botnet, l\u1ee3i d\u1ee5ng ch\u00fang \u0111\u1ec3 th\u1ef1c hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng T\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 ph\u00e2n t\u00e1n (DDoS) ho\u1eb7c c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i kh\u00e1c.<\/p>\n<\/li>\n

  5. \n

    L\u1eeba \u0111\u1ea3o v\u00e0 chuy\u1ec3n h\u01b0\u1edbng:<\/strong> Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng web shell \u0111\u1ec3 l\u01b0u tr\u1eef c\u00e1c trang l\u1eeba \u0111\u1ea3o ho\u1eb7c chuy\u1ec3n h\u01b0\u1edbng kh\u00e1ch truy c\u1eadp \u0111\u1ebfn c\u00e1c trang web \u0111\u1ed9c h\u1ea1i.<\/p>\n<\/li>\n<\/ol>\n

    C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a Web shell \u2013 C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Web shell<\/h2>\n

    C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a web shell c\u00f3 th\u1ec3 thay \u0111\u1ed5i \u0111\u00e1ng k\u1ec3 d\u1ef1a tr\u00ean ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng v\u00e0 m\u1ee5c ti\u00eau c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng. Tuy nhi\u00ean, h\u1ea7u h\u1ebft c\u00e1c web shell \u0111\u1ec1u c\u00f3 chung c\u00e1c th\u00e0nh ph\u1ea7n:<\/p>\n

      \n
    1. \n

      Giao di\u1ec7n web:<\/strong> Giao di\u1ec7n d\u1ef1a tr\u00ean web th\u00e2n thi\u1ec7n v\u1edbi ng\u01b0\u1eddi d\u00f9ng cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng t\u01b0\u01a1ng t\u00e1c v\u1edbi m\u00e1y ch\u1ee7 b\u1ecb x\u00e2m nh\u1eadp. Giao di\u1ec7n n\u00e0y th\u01b0\u1eddng gi\u1ed1ng v\u1edbi giao di\u1ec7n d\u00f2ng l\u1ec7nh ho\u1eb7c b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n.<\/p>\n<\/li>\n

    2. \n

      M\u00f4-\u0111un truy\u1ec1n th\u00f4ng:<\/strong> Web shell ph\u1ea3i c\u00f3 m\u1ed9t m\u00f4-\u0111un giao ti\u1ebfp cho ph\u00e9p n\u00f3 nh\u1eadn l\u1ec7nh t\u1eeb k\u1ebb t\u1ea5n c\u00f4ng v\u00e0 g\u1eedi l\u1ea1i ph\u1ea3n h\u1ed3i, cho ph\u00e9p ki\u1ec3m so\u00e1t m\u00e1y ch\u1ee7 theo th\u1eddi gian th\u1ef1c.<\/p>\n<\/li>\n

    3. \n

      Th\u1ef1c thi t\u1ea3i tr\u1ecdng:<\/strong> Ch\u1ee9c n\u0103ng c\u1ed1t l\u00f5i c\u1ee7a web shell l\u00e0 th\u1ef1c thi c\u00e1c l\u1ec7nh t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7. \u0110i\u1ec1u n\u00e0y \u0111\u1ea1t \u0111\u01b0\u1ee3c b\u1eb1ng c\u00e1ch khai th\u00e1c l\u1ed7 h\u1ed5ng ho\u1eb7c c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c y\u1ebfu.<\/p>\n<\/li>\n<\/ol>\n

      Ph\u00e2n t\u00edch c\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a Web shell<\/h2>\n

      C\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a web shell gi\u00fap ch\u00fang tr\u1edf th\u00e0nh c\u00f4ng c\u1ee5 m\u1ea1nh m\u1ebd cho t\u1ed9i ph\u1ea1m m\u1ea1ng bao g\u1ed3m:<\/p>\n

        \n
      1. \n

        T\u00e0ng h\u00ecnh:<\/strong> Web shell \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ho\u1ea1t \u0111\u1ed9ng b\u00ed m\u1eadt, ng\u1ee5y trang s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ch\u00fang v\u00e0 tr\u00e1nh b\u1ecb ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c bi\u1ec7n ph\u00e1p an ninh truy\u1ec1n th\u1ed1ng.<\/p>\n<\/li>\n

      2. \n

        T\u00ednh linh ho\u1ea1t:<\/strong> Web shell c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c \u0111i\u1ec1u ch\u1ec9nh \u0111\u1ec3 ph\u00f9 h\u1ee3p v\u1edbi \u0111\u1eb7c \u0111i\u1ec3m c\u1ee5 th\u1ec3 c\u1ee7a h\u1ec7 th\u1ed1ng b\u1ecb x\u00e2m nh\u1eadp, khi\u1ebfn ch\u00fang c\u00f3 kh\u1ea3 n\u0103ng th\u00edch \u1ee9ng v\u00e0 kh\u00f3 x\u00e1c \u0111\u1ecbnh.<\/p>\n<\/li>\n

      3. \n

        Ki\u00ean tr\u00ec:<\/strong> Nhi\u1ec1u web shell t\u1ea1o ra c\u00e1c c\u1eeda h\u1eadu, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng duy tr\u00ec quy\u1ec1n truy c\u1eadp ngay c\u1ea3 khi \u0111i\u1ec3m v\u00e0o ban \u0111\u1ea7u \u0111\u01b0\u1ee3c b\u1ea3o m\u1eadt.<\/p>\n<\/li>\n

      4. \n

        T\u1ef1 \u0111\u1ed9ng h\u00f3a:<\/strong> C\u00e1c web shell n\u00e2ng cao c\u00f3 th\u1ec3 t\u1ef1 \u0111\u1ed9ng h\u00f3a nhi\u1ec1u t\u00e1c v\u1ee5 kh\u00e1c nhau, ch\u1eb3ng h\u1ea1n nh\u01b0 trinh s\u00e1t, l\u1ecdc d\u1eef li\u1ec7u v\u00e0 leo thang \u0111\u1eb7c quy\u1ec1n, cho ph\u00e9p c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng nhanh ch\u00f3ng v\u00e0 c\u00f3 th\u1ec3 m\u1edf r\u1ed9ng.<\/p>\n<\/li>\n<\/ol>\n

        C\u00e1c lo\u1ea1i Web shell<\/h2>\n

        Web shell c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e2n lo\u1ea1i d\u1ef1a tr\u00ean nhi\u1ec1u ti\u00eau ch\u00ed kh\u00e1c nhau, bao g\u1ed3m ng\u00f4n ng\u1eef l\u1eadp tr\u00ecnh, h\u00e0nh vi v\u00e0 ch\u1ee9c n\u0103ng m\u00e0 ch\u00fang th\u1ec3 hi\u1ec7n. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ed1 lo\u1ea1i web shell ph\u1ed5 bi\u1ebfn:<\/p>\n\n\n\n\n\n\n\n\n\n
        Ki\u1ec3u<\/strong><\/th>\nS\u1ef1 mi\u00eau t\u1ea3<\/strong><\/th>\n<\/tr>\n<\/thead>\n
        Shell web PHP<\/strong><\/td>\n\u0110\u01b0\u1ee3c vi\u1ebft b\u1eb1ng PHP v\u00e0 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng ph\u1ed5 bi\u1ebfn nh\u1ea5t do t\u00ednh ph\u1ed5 bi\u1ebfn c\u1ee7a n\u00f3 trong ph\u00e1t tri\u1ec3n web. V\u00ed d\u1ee5 bao g\u1ed3m WSO, C99 v\u00e0 R57.<\/td>\n<\/tr>\n
        V\u1ecf web ASP<\/strong><\/td>\n\u0110\u01b0\u1ee3c ph\u00e1t tri\u1ec3n trong ASP (Trang m\u00e1y ch\u1ee7 ho\u1ea1t \u0111\u1ed9ng) v\u00e0 th\u01b0\u1eddng th\u1ea5y tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 web d\u1ef1a tr\u00ean Windows. V\u00ed d\u1ee5 bao g\u1ed3m ASPXSpy v\u00e0 CMDASP.<\/td>\n<\/tr>\n
        Shell web Python<\/strong><\/td>\n\u0110\u01b0\u1ee3c ph\u00e1t tri\u1ec3n b\u1eb1ng Python v\u00e0 th\u01b0\u1eddng \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng v\u00ec t\u00ednh linh ho\u1ea1t v\u00e0 d\u1ec5 s\u1eed d\u1ee5ng. V\u00ed d\u1ee5 bao g\u1ed3m Weevely v\u00e0 PwnShell.<\/td>\n<\/tr>\n
        Shell Web JSP<\/strong><\/td>\n\u0110\u01b0\u1ee3c vi\u1ebft b\u1eb1ng JavaServer Pages (JSP) v\u00e0 ch\u1ee7 y\u1ebfu nh\u1eafm m\u1ee5c ti\u00eau c\u00e1c \u1ee9ng d\u1ee5ng web d\u1ef1a tr\u00ean Java. V\u00ed d\u1ee5 bao g\u1ed3m JSPWebShell v\u00e0 AntSword.<\/td>\n<\/tr>\n
        V\u1ecf web ASP.NET<\/strong><\/td>\n\u0110\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1eb7c bi\u1ec7t cho c\u00e1c \u1ee9ng d\u1ee5ng ASP.NET v\u00e0 m\u00f4i tr\u01b0\u1eddng Windows. V\u00ed d\u1ee5 bao g\u1ed3m China Chopper v\u00e0 ASPXShell.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        C\u00e1ch s\u1eed d\u1ee5ng Web shell, c\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng<\/h2>\n

        C\u00e1c c\u00e1ch s\u1eed d\u1ee5ng Web shell<\/h3>\n

        Vi\u1ec7c s\u1eed d\u1ee5ng web shell b\u1ea5t h\u1ee3p ph\u00e1p xoay quanh vi\u1ec7c khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng trong \u1ee9ng d\u1ee5ng web v\u00e0 m\u00e1y ch\u1ee7. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng m\u1ed9t s\u1ed1 ph\u01b0\u01a1ng ph\u00e1p \u0111\u1ec3 tri\u1ec3n khai web shell:<\/p>\n

          \n
        1. \n

          Bao g\u1ed3m t\u1ec7p t\u1eeb xa (RFI):<\/strong> Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng khai th\u00e1c c\u01a1 ch\u1ebf bao g\u1ed3m t\u1ec7p kh\u00f4ng an to\u00e0n \u0111\u1ec3 \u0111\u01b0a m\u00e3 \u0111\u1ed9c v\u00e0o trang web, d\u1eabn \u0111\u1ebfn vi\u1ec7c th\u1ef1c thi web shell.<\/p>\n<\/li>\n

        2. \n

          Bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9 (LFI):<\/strong> L\u1ed7 h\u1ed5ng LFI cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng \u0111\u1ecdc t\u1ec7p tr\u00ean m\u00e1y ch\u1ee7. N\u1ebfu h\u1ecd c\u00f3 th\u1ec3 truy c\u1eadp c\u00e1c t\u1ec7p c\u1ea5u h\u00ecnh nh\u1ea1y c\u1ea3m, h\u1ecd c\u00f3 th\u1ec3 th\u1ef1c thi c\u00e1c web shell.<\/p>\n<\/li>\n

        3. \n

          L\u1ed7 h\u1ed5ng t\u1ea3i l\u00ean t\u1ec7p:<\/strong> Ki\u1ec3m tra t\u1ea3i l\u00ean t\u1ec7p y\u1ebfu c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng t\u1ea3i l\u00ean c\u00e1c t\u1eadp l\u1ec7nh web shell \u0111\u01b0\u1ee3c ng\u1ee5y trang d\u01b0\u1edbi d\u1ea1ng t\u1ec7p v\u00f4 t\u1ed9i.<\/p>\n<\/li>\n

        4. \n

          Ti\u00eam SQL:<\/strong> Trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p, l\u1ed7 h\u1ed5ng SQL SQL c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn vi\u1ec7c th\u1ef1c thi web shell tr\u00ean m\u00e1y ch\u1ee7.<\/p>\n<\/li>\n<\/ol>\n

          C\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p li\u00ean quan \u0111\u1ebfn vi\u1ec7c s\u1eed d\u1ee5ng Web shell<\/h3>\n

          S\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a web shell tr\u00ean m\u00e1y ch\u1ee7 g\u00e2y ra r\u1ee7i ro b\u1ea3o m\u1eadt \u0111\u00e1ng k\u1ec3 v\u00ec ch\u00fang c\u00f3 th\u1ec3 c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng to\u00e0n quy\u1ec1n ki\u1ec3m so\u00e1t v\u00e0 truy c\u1eadp v\u00e0o d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m. Gi\u1ea3m thi\u1ec3u nh\u1eefng r\u1ee7i ro n\u00e0y li\u00ean quan \u0111\u1ebfn vi\u1ec7c th\u1ef1c hi\u1ec7n c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt kh\u00e1c nhau:<\/p>\n

            \n
          1. \n

            Ki\u1ec3m tra m\u00e3 th\u00f4ng th\u01b0\u1eddng:<\/strong> Th\u01b0\u1eddng xuy\u00ean ki\u1ec3m tra m\u00e3 \u1ee9ng d\u1ee5ng web \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh v\u00e0 kh\u1eafc ph\u1ee5c c\u00e1c l\u1ed7 h\u1ed5ng ti\u1ec1m \u1ea9n c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng web shell.<\/p>\n<\/li>\n

          2. \n

            B\u1ea3n v\u00e1 b\u1ea3o m\u1eadt:<\/strong> Lu\u00f4n c\u1eadp nh\u1eadt t\u1ea5t c\u1ea3 ph\u1ea7n m\u1ec1m, bao g\u1ed3m c\u00e1c \u1ee9ng d\u1ee5ng v\u00e0 khung m\u00e1y ch\u1ee7 web, v\u1edbi c\u00e1c b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt m\u1edbi nh\u1ea5t \u0111\u1ec3 gi\u1ea3i quy\u1ebft c\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 bi\u1ebft.<\/p>\n<\/li>\n

          3. \n

            T\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng web (WAF):<\/strong> Tri\u1ec3n khai WAF \u0111\u1ec3 l\u1ecdc v\u00e0 ch\u1eb7n c\u00e1c y\u00eau c\u1ea7u HTTP \u0111\u1ed9c h\u1ea1i, ng\u0103n ch\u1eb7n vi\u1ec7c khai th\u00e1c web shell.<\/p>\n<\/li>\n

          4. \n

            Nguy\u00ean t\u1eafc \u0111\u1eb7c quy\u1ec1n t\u1ed1i thi\u1ec3u:<\/strong> H\u1ea1n ch\u1ebf quy\u1ec1n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng tr\u00ean m\u00e1y ch\u1ee7 \u0111\u1ec3 gi\u1ea3m thi\u1ec3u t\u00e1c \u0111\u1ed9ng c\u1ee7a s\u1ef1 x\u00e2m ph\u1ea1m web shell ti\u1ec1m \u1ea9n.<\/p>\n<\/li>\n<\/ol>\n

            C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 so s\u00e1nh kh\u00e1c v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1<\/h2>\n

            H\u00e3y so s\u00e1nh c\u00e1c web shell v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1 v\u00e0 hi\u1ec3u c\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh c\u1ee7a ch\u00fang:<\/p>\n\n\n\n\n\n\n\n\n
            Thu\u1eadt ng\u1eef<\/strong><\/th>\nS\u1ef1 mi\u00eau t\u1ea3<\/strong><\/th>\nS\u1ef1 kh\u00e1c bi\u1ec7t<\/strong><\/th>\n<\/tr>\n<\/thead>\n
            V\u1ecf Web<\/strong><\/td>\nM\u1ed9t t\u1eadp l\u1ec7nh \u0111\u1ed9c h\u1ea1i cho ph\u00e9p truy c\u1eadp tr\u00e1i ph\u00e9p v\u00e0o m\u00e1y ch\u1ee7.<\/td>\nWeb shell \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1eb7c bi\u1ec7t \u0111\u1ec3 khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng c\u1ee7a m\u00e1y ch\u1ee7 web v\u00e0 cung c\u1ea5p cho k\u1ebb t\u1ea5n c\u00f4ng quy\u1ec1n truy c\u1eadp v\u00e0 ki\u1ec3m so\u00e1t t\u1eeb xa.<\/td>\n<\/tr>\n
            Trojan truy c\u1eadp t\u1eeb xa (RAT)<\/strong><\/td>\nPh\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 truy c\u1eadp t\u1eeb xa tr\u00e1i ph\u00e9p.<\/td>\nRAT l\u00e0 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i \u0111\u1ed9c l\u1eadp, trong khi web shell l\u00e0 c\u00e1c t\u1eadp l\u1ec7nh n\u1eb1m tr\u00ean m\u00e1y ch\u1ee7 web.<\/td>\n<\/tr>\n
            C\u1eeda sau<\/strong><\/td>\nM\u1ed9t \u0111i\u1ec3m x\u00e2m nh\u1eadp \u1ea9n v\u00e0o h\u1ec7 th\u1ed1ng \u0111\u1ec3 truy c\u1eadp tr\u00e1i ph\u00e9p.<\/td>\nWeb shell th\u01b0\u1eddng ho\u1ea1t \u0111\u1ed9ng nh\u01b0 c\u1eeda sau, cung c\u1ea5p quy\u1ec1n truy c\u1eadp b\u00ed m\u1eadt v\u00e0o m\u00e1y ch\u1ee7 b\u1ecb x\u00e2m nh\u1eadp.<\/td>\n<\/tr>\n
            Rootkit<\/strong><\/td>\nPh\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 che gi\u1ea5u c\u00e1c ho\u1ea1t \u0111\u1ed9ng \u0111\u1ed9c h\u1ea1i tr\u00ean h\u1ec7 th\u1ed1ng.<\/td>\nRootkit t\u1eadp trung v\u00e0o vi\u1ec7c che gi\u1ea5u s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i, trong khi web shell nh\u1eb1m m\u1ee5c \u0111\u00edch cho ph\u00e9p \u0111i\u1ec1u khi\u1ec3n v\u00e0 thao t\u00e1c t\u1eeb xa.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            C\u00e1c quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 c\u1ee7a t\u01b0\u01a1ng lai li\u00ean quan \u0111\u1ebfn Web shell<\/h2>\n

            Khi c\u00f4ng ngh\u1ec7 ti\u1ebfn b\u1ed9, web shell c\u00f3 th\u1ec3 s\u1ebd ph\u00e1t tri\u1ec3n, tr\u1edf n\u00ean ph\u1ee9c t\u1ea1p h\u01a1n v\u00e0 kh\u00f3 ph\u00e1t hi\u1ec7n h\u01a1n. M\u1ed9t s\u1ed1 xu h\u01b0\u1edbng ti\u1ec1m n\u0103ng trong t\u01b0\u01a1ng lai bao g\u1ed3m:<\/p>\n

              \n
            1. \n

              Web Shell h\u1ed7 tr\u1ee3 AI:<\/strong> T\u1ed9i ph\u1ea1m m\u1ea1ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o \u0111\u1ec3 t\u1ea1o ra c\u00e1c web shell n\u0103ng \u0111\u1ed9ng v\u00e0 l\u1ea9n tr\u00e1nh h\u01a1n, l\u00e0m t\u0103ng t\u00ednh ph\u1ee9c t\u1ea1p c\u1ee7a vi\u1ec7c ph\u00f2ng th\u1ee7 an ninh m\u1ea1ng.<\/p>\n<\/li>\n

            2. \n

              B\u1ea3o m\u1eadt chu\u1ed7i kh\u1ed1i:<\/strong> Vi\u1ec7c t\u00edch h\u1ee3p c\u00f4ng ngh\u1ec7 blockchain trong c\u00e1c \u1ee9ng d\u1ee5ng web v\u00e0 m\u00e1y ch\u1ee7 c\u00f3 th\u1ec3 t\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt v\u00e0 ng\u0103n ch\u1eb7n truy c\u1eadp tr\u00e1i ph\u00e9p, khi\u1ebfn web shell kh\u00f3 khai th\u00e1c l\u1ed7 h\u1ed5ng h\u01a1n.<\/p>\n<\/li>\n

            3. \n

              Ki\u1ebfn tr\u00fac Zero Trust:<\/strong> Vi\u1ec7c \u00e1p d\u1ee5ng c\u00e1c nguy\u00ean t\u1eafc Zero Trust c\u00f3 th\u1ec3 h\u1ea1n ch\u1ebf t\u00e1c \u0111\u1ed9ng c\u1ee7a c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng web shell b\u1eb1ng c\u00e1ch th\u1ef1c thi c\u00e1c bi\u1ec7n ph\u00e1p ki\u1ec3m so\u00e1t truy c\u1eadp nghi\u00eam ng\u1eb7t v\u00e0 x\u00e1c minh li\u00ean t\u1ee5c ng\u01b0\u1eddi d\u00f9ng v\u00e0 thi\u1ebft b\u1ecb.<\/p>\n<\/li>\n

            4. \n

              Ki\u1ebfn tr\u00fac kh\u00f4ng c\u00f3 m\u00e1y ch\u1ee7:<\/strong> \u0110i\u1ec7n to\u00e1n kh\u00f4ng c\u00f3 m\u00e1y ch\u1ee7 c\u00f3 kh\u1ea3 n\u0103ng l\u00e0m gi\u1ea3m b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng v\u00e0 gi\u1ea3m thi\u1ec3u r\u1ee7i ro v\u1ec1 c\u00e1c l\u1ed7 h\u1ed5ng web shell b\u1eb1ng c\u00e1ch chuy\u1ec3n tr\u00e1ch nhi\u1ec7m qu\u1ea3n l\u00fd m\u00e1y ch\u1ee7 sang c\u00e1c nh\u00e0 cung c\u1ea5p \u0111\u00e1m m\u00e2y.<\/p>\n<\/li>\n<\/ol>\n

              C\u00e1ch s\u1eed d\u1ee5ng ho\u1eb7c li\u00ean k\u1ebft m\u00e1y ch\u1ee7 proxy v\u1edbi Web shell<\/h2>\n

              C\u00e1c m\u00e1y ch\u1ee7 proxy, gi\u1ed1ng nh\u01b0 c\u00e1c m\u00e1y ch\u1ee7 \u0111\u01b0\u1ee3c cung c\u1ea5p b\u1edfi OneProxy (oneproxy.pro), c\u00f3 th\u1ec3 \u0111\u00f3ng m\u1ed9t vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c gi\u1ea3m thi\u1ec3u v\u00e0 t\u1ea1o \u0111i\u1ec1u ki\u1ec7n thu\u1eadn l\u1ee3i cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng web shell:<\/p>\n

              Gi\u1ea3m thi\u1ec3u c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng Web Shell:<\/h3>\n
                \n
              1. \n

                \u1ea8n danh:<\/strong> M\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 cung c\u1ea5p cho ch\u1ee7 s\u1edf h\u1eefu trang web m\u1ed9t l\u1edbp \u1ea9n danh, khi\u1ebfn k\u1ebb t\u1ea5n c\u00f4ng kh\u00f3 x\u00e1c \u0111\u1ecbnh \u0111\u01b0\u1ee3c \u0111\u1ecba ch\u1ec9 IP m\u00e1y ch\u1ee7 th\u1ef1c t\u1ebf h\u01a1n.<\/p>\n<\/li>\n

              2. \n

                L\u1ecdc l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp:<\/strong> M\u00e1y ch\u1ee7 proxy \u0111\u01b0\u1ee3c trang b\u1ecb t\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng web c\u00f3 th\u1ec3 gi\u00fap l\u1ecdc l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp \u0111\u1ed9c h\u1ea1i v\u00e0 ng\u0103n ch\u1eb7n vi\u1ec7c khai th\u00e1c web shell.<\/p>\n<\/li>\n

              3. \n

                M\u00e3 h\u00f3a:<\/strong> Proxy c\u00f3 th\u1ec3 m\u00e3 h\u00f3a l\u01b0u l\u01b0\u1ee3ng gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 m\u00e1y ch\u1ee7, gi\u1ea3m nguy c\u01a1 ch\u1eb7n d\u1eef li\u1ec7u, \u0111\u1eb7c bi\u1ec7t l\u00e0 trong qu\u00e1 tr\u00ecnh giao ti\u1ebfp web shell.<\/p>\n<\/li>\n<\/ol>\n

                T\u1ea1o \u0111i\u1ec1u ki\u1ec7n cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng Web Shell:<\/h3>\n
                  \n
                1. \n

                  K\u1ebb t\u1ea5n c\u00f4ng \u1ea9n danh:<\/strong> Nh\u1eefng k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng m\u00e1y ch\u1ee7 proxy \u0111\u1ec3 \u1ea9n danh t\u00ednh v\u00e0 v\u1ecb tr\u00ed th\u1ef1c s\u1ef1 c\u1ee7a ch\u00fang trong khi tri\u1ec3n khai web shell, khi\u1ebfn vi\u1ec7c theo d\u00f5i ch\u00fang tr\u1edf n\u00ean kh\u00f3 kh\u0103n.<\/p>\n<\/li>\n

                2. \n

                  B\u1ecf qua c\u00e1c h\u1ea1n ch\u1ebf:<\/strong> M\u1ed9t s\u1ed1 k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 t\u1eadn d\u1ee5ng m\u00e1y ch\u1ee7 proxy \u0111\u1ec3 v\u01b0\u1ee3t qua c\u00e1c bi\u1ec7n ph\u00e1p ki\u1ec3m so\u00e1t truy c\u1eadp d\u1ef1a tr\u00ean IP v\u00e0 c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt kh\u00e1c, t\u1ea1o \u0111i\u1ec1u ki\u1ec7n thu\u1eadn l\u1ee3i cho vi\u1ec7c tri\u1ec3n khai web shell.<\/p>\n<\/li>\n<\/ol>\n

                  Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n

                  \u0110\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin v\u1ec1 Web shell v\u00e0 b\u1ea3o m\u1eadt \u1ee9ng d\u1ee5ng web, b\u1ea1n c\u00f3 th\u1ec3 kh\u00e1m ph\u00e1 c\u00e1c t\u00e0i nguy\u00ean sau:<\/p>\n

                    \n
                  1. B\u1ea3o m\u1eadt Web Shell c\u1ee7a OWASP<\/a><\/li>\n
                  2. T\u1ed5ng quan v\u1ec1 Web Shell c\u1ee7a US-CERT<\/a><\/li>\n
                  3. Web Shell: Ng\u01b0\u1eddi b\u1ea1n t\u1ed1t nh\u1ea5t c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng<\/a><\/li>\n<\/ol>\n

                    T\u00f3m l\u1ea1i, web shell g\u00e2y ra m\u1ed1i \u0111e d\u1ecda \u0111\u00e1ng k\u1ec3 cho c\u00e1c m\u00e1y ch\u1ee7 v\u00e0 \u1ee9ng d\u1ee5ng web, \u0111\u1ed3ng th\u1eddi qu\u00e1 tr\u00ecnh ph\u00e1t tri\u1ec3n c\u1ee7a ch\u00fang ti\u1ebfp t\u1ee5c th\u00e1ch th\u1ee9c c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng. Vi\u1ec7c hi\u1ec3u c\u00e1c lo\u1ea1i, ch\u1ee9c n\u0103ng v\u00e0 c\u00e1c bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u ti\u1ec1m n\u0103ng li\u00ean quan \u0111\u1ebfn web shell l\u00e0 \u0111i\u1ec1u c\u1ea7n thi\u1ebft \u0111\u1ed1i v\u1edbi c\u00e1c nh\u00e0 cung c\u1ea5p m\u00e1y ch\u1ee7 proxy nh\u01b0 OneProxy (oneproxy.pro) \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh b\u1ea3o m\u1eadt v\u00e0 t\u00ednh to\u00e0n v\u1eb9n c\u1ee7a d\u1ecbch v\u1ee5 c\u1ee7a h\u1ecd, c\u0169ng nh\u01b0 b\u1ea3o v\u1ec7 kh\u00e1ch h\u00e0ng c\u1ee7a h\u1ecd kh\u1ecfi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ea1ng ti\u1ec1m \u1ea9n. Nh\u1eefng n\u1ed7 l\u1ef1c li\u00ean t\u1ee5c nh\u1eb1m c\u1ea3i thi\u1ec7n b\u1ea3o m\u1eadt \u1ee9ng d\u1ee5ng web v\u00e0 lu\u00f4n c\u1eadp nh\u1eadt nh\u1eefng ti\u1ebfn b\u1ed9 m\u1edbi nh\u1ea5t v\u1ec1 an ninh m\u1ea1ng s\u1ebd \u0111\u00f3ng m\u1ed9t vai tr\u00f2 quan tr\u1ecdng trong vi\u1ec7c ch\u1ed1ng l\u1ea1i m\u1ed1i \u0111e d\u1ecda c\u1ee7a web shell v\u00e0 b\u1ea3o v\u1ec7 h\u1ec7 sinh th\u00e1i tr\u1ef1c tuy\u1ebfn.<\/p>","protected":false},"featured_media":479648,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-479647","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about Web Shell: A Comprehensive Overview<\/mark>","faq_items":[{"question":"What is a Web shell?","answer":"

                    A Web shell is a malicious script or program cybercriminals use to gain unauthorized access and control over web servers. It provides attackers with a remote command-line interface, enabling them to manipulate the server and carry out malicious activities.<\/p>"},{"question":"How did Web shells originate?","answer":"

                    Web shells first emerged in the late 1990s as tools for legitimate remote server management. However, cybercriminals soon recognized their potential for illegal activities. The first known mentions of Web shells in criminal contexts date back to the early 2000s on hacking forums.<\/p>"},{"question":"How does a Web shell work?","answer":"

                    Web shells exploit vulnerabilities in web applications or servers to gain entry. Once deployed, they grant attackers remote access and control. Web shells have a web-based interface for communication, enabling attackers to execute commands and steal data.<\/p>"},{"question":"What are the key features of Web shells?","answer":"

                    Web shells are stealthy, versatile, and can create backdoors for persistent access. They offer automation for various tasks, making them powerful tools for cybercriminals.<\/p>"},{"question":"What are the different types of Web shells?","answer":"

                    Web shells come in various types based on the programming language used:<\/p>