WTA: A Static Taint Analysis Framework for PHP Webshell

Abstract

Webshells are a malicious scripts that can remotely control a webserver to execute arbitrary commands, steal sensitive files, and further invade the internal network. Existing webshell detection methods, such as using pattern matching for webshell detection, can be easily bypassed by attackers using the file include and user-defined functions. Furthermore, detecting unknown webshells has always been a problem in the field of webshell detection. In this paper, we propose a static webshell detection method based on taint analysis, which realizes accurate taint analysis based on ZendVM. We first converted the PHP code into Opline sequences, analyzed the Opline sequences in order, and marked the externally imported taint source. Then, the propagation of the taint variables was tracked, and the interprocedural analysis of the taint variables was performed. Finally, considering the dangerous functions’ call and the referencing of the taint variables at the point of the taint sink, we completed the webshell judgment. Based on this method, we constructed a taint analysis prototype system named WTA and evaluated it with a benchmark dataset by comparing its performance with popular webshell detection tools. The results showed that our method supports interprocedural analysis and has the ability to detect unknown webshells and that WTA’s performance surpasses well-known webshell detection tools such as D-shield, SHELLPUB, WebshellKiller, CloudWalker, ClamAV, LoKi, and findbot.pl.

AST-DF: A New Webshell Detection Method Based on Abstract Syntax Tree and Deep Forest

“…Currently, Webshell detection research can be divided into dynamic detection and static detection according to the detection method [16]. Dynamic detection can detect Webshell from both host and network levels, while static detection mainly uses various features of the source code to identify Webshell files and normal files.…”

Cefuzz: An Directed Fuzzing Framework for PHP RCE Vulnerability

“…The framework of the static taint analysis module in this paper is shown in Figure 4. This module uses our previous research achievement WTA [21], which is a prototype system that can perform fine-grained taint analysis on opcodes. On the basis of WTA, we expanded and improved the dangerous function part of the auxiliary data to meet the analysis requirements of RCE vulnerabilities, and modified the result output module to output information related to vulnerable code.…”