Microsoft Details Cookie-Controlled PHP Web Shells Using Cron for Linux Persistence
Summary
Microsoft says threat actors use HTTP cookies to activate PHP web shells on Linux servers and cron jobs to recreate loaders. It recommends stronger authentication, cron and web-directory audits, and restricting shell execution.
Key points
- The web shells use attacker-supplied cookie values to trigger execution while remaining inactive during ordinary traffic.
- Microsoft describes obfuscated loaders, cookie-segmented payload reconstruction, and single-cookie markers for execution or file uploads.
- In at least one case, attackers used valid credentials or exploited a known vulnerability to set up a cron job.
- The scheduled task can recreate a removed PHP loader, preserving remote code execution access.
- Microsoft recommends MFA for administrative access, monitoring unusual logins, auditing cron jobs and web directories, and restricting shell execution.
Article Details
- Event Type
- Report on cookie-controlled PHP web shells and cron-based persistence on Linux servers
- Impact
- The technique can provide persistent remote code execution on compromised hosted Linux environments. Cookie-gated activation, obfuscation, and cron-based recreation can keep web shells dormant during normal traffic, restore removed loaders, and reduce visibility in routine logs.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe PHP loaders use obfuscation to conceal functionality and payloads.T1053.003 · CronCron jobs periodically invoke a shell routine to recreate the obfuscated PHP loader, providing persistence.T1505.003 · Web ShellPHP web shells are deployed on compromised Linux servers to provide remote code execution.