WTA: A Static Taint Analysis Framework for PHP Webshell

Jiazhen Zhao,Yuliang Lu,Lu Yu,Xin Wang,Kailong Zhu

doi:10.3390/app11167763

Jiazhen Zhao, Yuliang Lu + Show 3 more

Open Access

https://doi.org/10.3390/app11167763

Copy DOI

Abstract

Webshells are a malicious scripts that can remotely control a webserver to execute arbitrary commands, steal sensitive files, and further invade the internal network. Existing webshell detection methods, such as using pattern matching for webshell detection, can be easily bypassed by attackers using the file include and user-defined functions. Furthermore, detecting unknown webshells has always been a problem in the field of webshell detection. In this paper, we propose a static webshell detection method based on taint analysis, which realizes accurate taint analysis based on ZendVM. We first converted the PHP code into Opline sequences, analyzed the Opline sequences in order, and marked the externally imported taint source. Then, the propagation of the taint variables was tracked, and the interprocedural analysis of the taint variables was performed. Finally, considering the dangerous functions’ call and the referencing of the taint variables at the point of the taint sink, we completed the webshell judgment. Based on this method, we constructed a taint analysis prototype system named WTA and evaluated it with a benchmark dataset by comparing its performance with popular webshell detection tools. The results showed that our method supports interprocedural analysis and has the ability to detect unknown webshells and that WTA’s performance surpasses well-known webshell detection tools such as D-shield, SHELLPUB, WebshellKiller, CloudWalker, ClamAV, LoKi, and findbot.pl.

Highlights

With the rapid development of network technology, web applications [1] have become the dominant form by which Internet companies provide users with web services
We applied the Zend Virtual Machine (ZendVM) instruction set to the field of taint analysis for the first time and defined the taint propagation rules and taint sink rules of the instruction set; We proposed a novel static detection method based on taint analysis for PHP webshells
How to improve the capability of interprocedural analysis and improve the detection ability for unknown webshells are the main challenges of webshell detection

Summary

Introduction

With the rapid development of network technology, web applications [1] have become the dominant form by which Internet companies provide users with web services. All kinds of network attacks on web applications have become the main problem threatening Internet security. Webshells are a malicious network backdoor that can exist in multiple scripting languages [4], allowing attackers to gain system privileges or control the webserver by executing arbitrary commands [5]. Attackers can use webshells to carry out a series of malicious operations, such as accessing server databases and sensitive files, stealing and tampering with user data, modifying the home page of a website, and so on. PHP is a popular scripting language that is suited to web development. It runs in four modes: PHP-CLI, PHP-CGI, PHP-FPM, and PHP-MOD. In the process of the continuous development of PHP, it can take into account the performance and the current popular frameworks and has a good extension interface for developers to use

Methods

Results

Discussion

Conclusion