WEBSHELL_JSP_HTTP_Proxy
Description
Webshell JSP HTTP proxy
Query · yara
strings:
$jh1 = "OutputStream" fullword wide ascii
$jh2 = "InputStream" wide ascii
$jh3 = "BufferedReader" fullword wide ascii
$jh4 = "HttpRequest" fullword wide ascii
$jh5 = "openConnection" fullword wide ascii
$jh6 = "getParameter" fullword wide ascii
//strings from private rule capa_jsp_safe
$cjsp_short1 = "<%" ascii wide
$cjsp_short2 = "%>" wide ascii
$cjsp_long1 = "<jsp:" ascii wide
$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
// JSF
$cjsp_long3 = "/jstl/core" ascii wide
$cjsp_long4 = "<%@p" nocase ascii wide
$cjsp_long5 = "<%@ " nocase ascii wide
$cjsp_long6 = "<% " ascii wide
$cjsp_long7 = "< %" ascii wide
condition:
filesize < 10KB and (
$cjsp_short1 at 0 or
any of ( $cjsp_long* ) or
($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
(
$cjsp_short2 and (
$cjsp_short1 in ( 0..1000 ) or
$cjsp_short1 in ( filesize-1000..filesize )
)
)
)
and all of ( $jh* )
}
rule WEBSHELL_JSP_Writer_Nano
{
meta:
description = "JSP file writer"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
score = 75
date = "2021/01/24"
modified = "2024-12-09"
hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"
strings:
// writting file to disk
$payload1 = ".write" wide ascii
$payload2 = "getBytes" fullword wide ascii
$payload3 = ".decodeBuffer" wide ascii
$payload4 = "FileOutputStream" fullword wide ascii
// writting using java logging, e.g 9f1df0249a6a491cdd5df598d83307338daa4c43
$logger1 = "getLogger" fullword ascii wide
$logger2 = "FileHandler" fullword ascii wide
$logger3 = "addHandler" fullword ascii wide
//strings from private rule capa_jsp_input
// request.getParameter
$input1 = "getParameter" fullword ascii wide
// request.getHeaders
$input2 = "getHeaders" fullword ascii wide
$input3 = "getInputStream" fullword ascii wide
$input4 = "getReader" fullword ascii wide
$req1 = "request" fullword ascii wide
$req2 = "HttpServletRequest" fullword ascii wide
$req3 = "getRequest" fullword ascii wide
$jw_sus1 = /getParameter\("."\)/ ascii wide // one char param
$jw_sus4 = "yoco" fullword ascii wide // webshell coder
//strings from private rule capa_jsp_safe
$cjsp_short1 = "<%" ascii wide
$cjsp_short2 = "%>" wide ascii
$cjsp_long1 = "<jsp:" ascii wide
$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
// JSF
$cjsp_long3 = "/jstl/core" ascii wide
$cjsp_long4 = "<%@p" nocase ascii wide
$cjsp_long5 = "<%@ " nocase ascii wide
$cjsp_long6 = "<% " ascii wide
$cjsp_long7 = "< %" ascii wide
condition:
//any of them or
(
any of ( $input* ) and
any of ( $req* )
) and (
filesize < 200 or
(
filesize < 1000 and
any of ( $jw_sus* )
)
)
and (
$cjsp_short1 at 0 or
any of ( $cjsp_long* ) or
($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
(
$cjsp_short2 and (
$cjsp_short1 in ( 0..1000 ) or
$cjsp_short1 in ( filesize-1000..filesize )
)
)
)
and (
2 of ( $payload* ) or
all of ( $logger* )
)
}
rule EXT_WEBSHELL_JSP_Generic_Tiny
{
meta:
description = "Generic JSP webshell tiny"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
score = 75
date = "2021/01/07"
modified = "2024-12-16"
hash = "8fd343db0442136e693e745d7af1018a99b042af"
hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
id = "fad14524-de44-52ea-95e6-3e5de3138926"
strings:
$payload1 = "ProcessBuilder" fullword wide ascii
$payload2 = "URLClassLoader" fullword wide ascii
// Runtime.getRuntime().exec(
$payload_rt1 = "Runtime" fullword wide ascii
$payload_rt2 = "getRuntime" fullword wide ascii
$payload_rt3 = "exec" fullword wide ascii
$jg_sus1 = "xe /c" ascii wide // of cmd.exe /c
$jg_sus2 = /getParameter\("."\)/ ascii wide // one char param
$jg_sus3 = "</pre>" ascii wide // webshells like fixed font wide
$jg_sus4 = "BASE64Decoder" fullword ascii wide
//strings from private rule capa_jsp_safe
$cjsp_short1 = "<%" ascii wide
$cjsp_short2 = "%>" wide ascii
$cjsp_long1 = "<jsp:" ascii wide
$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
// JSF
$cjsp_long3 = "/jstl/core" ascii wide
$cjsp_long4 = "<%@p" nocase ascii wide
$cjsp_long5 = "<%@ " nocase ascii wide
$cjsp_long6 = "<% " ascii wide
$cjsp_long7 = "< %" ascii wide
//strings from private rule capa_jsp_input
// request.getParameter
$input1 = "getParameter" fullword ascii wide
// request.getHeaders
$input2 = "getHeaders" fullword ascii wide
$input3 = "getInputStream" fullword ascii wide
$input4 = "getReader" fullword ascii wide
$req1 = "request" fullword ascii wide
$req2 = "HttpServletRequest" fullword ascii wide
$req3 = "getRequest" fullword ascii wide
// no web input but fixed command to create reverse shell
$fixed_cmd1 = "bash -i >& /dev/" ascii wide
$fp1 = "Find Security Bugs is a plugin that aims to help security audit.</Details>"
condition:
//any of them or
(
(
filesize < 1000 and
any of ( $jg_sus* )
) or
filesize < 250
) and (
$cjsp_short1 at 0 or
any of ( $cjsp_long* ) or
($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
(
$cjsp_short2 and (
$cjsp_short1 in ( 0..1000 ) or
$cjsp_short1 in ( filesize-1000..filesize )
)
)
)
and (
(
any of ( $input* ) and
any of ( $req* )
) or (
any of ( $fixed_cmd* )
)
)
and
( 1 of ( $payload* ) or all of ( $payload_rt* ) )
and not any of ( $fp* )
}
rule WEBSHELL_JSP_Generic
{
meta:
description = "Generic JSP webshell"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
score = 75
date = "2021/01/07"
modified = "2025-08-18"
hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
id = "7535ade8-fc65-5558-a72c-cc14c3306390"
strings:
$susp0 = "cmd" fullword nocase ascii wide
$susp1 = "command" fullword nocase ascii wide
$susp2 = "shell" fullword nocase ascii wide
$susp3 = "download" fullword nocase ascii wide
$susp4 = "upload" fullword nocase ascii wide
$susp5 = "Execute" fullword nocase ascii wide
$susp6 = "\"pwd\"" ascii wide
$susp7 = "\"</pre>" ascii wide
$susp8 = /\\u00\d\d\\u00\d\d\\u00\d\d\\u00\d\d/ ascii wide
$susp9 = "*/\\u00" ascii wide // perfect match of 2 obfuscation methods: /**/\u00xx :)
$fp1 = "command = \"cmd.exe /c set\";"
//strings from private rule capa_bin_files
$dex1 = "dex\n0"
$dex2 = "dey\n0"
$pack = { 50 41 43 4b 00 00 00 02 00 }
//strings from private rule capa_jsp_safe
$cjsp_short1 = "<%" ascii wide
$cjsp_short2 = "%>" wide ascii
$cjsp_long1 = "<jsp:" ascii wide
$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
// JSF
$cjsp_long3 = "/jstl/core" ascii wide
$cjsp_long4 = "<%@p" nocase ascii wide
$cjsp_long5 = "<%@ " nocase ascii wide
$cjsp_long6 = "<% " ascii wide
$cjsp_long7 = "< %" ascii wide
//strings from private rule capa_jsp_input
// request.getParameter
$input1 = "getParameter" fullword ascii wide
// request.getHeaders
$input2 = "getHeaders" fullword ascii wide
$input3 = "getInputStream" fullword ascii wide
$input4 = "getReader" fullword ascii wide
$req1 = "request" fullword ascii wide
$req2 = "HttpServletRequest" fullword ascii wide
$req3 = "getRequest" fullword ascii wide
//strings from private rule capa_jsp_payload
$payload1 = "ProcessBuilder" fullword ascii wide
$payload2 = "processCmd" fullword ascii wide
// Runtime.getRuntime().exec(
$rt_payload1 = "Runtime" fullword ascii wide
$rt_payload2 = "getRuntime" fullword ascii wide
$rt_payload3 = "exec" fullword ascii wide
condition:
filesize < 300KB and not (
uint16(0) == 0x5a4d or
$dex1 at 0 or
$dex2 at 0 or
$pack at 0 or
// fp on jar with zero compression
uint16(0) == 0x4b50
)
and (
$cjsp_short1 at 0 or
any of ( $cjsp_long* ) or
($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
(
$cjsp_short2 and (
$cjsp_short1 in ( 0..1000 ) or
$cjsp_short1 in ( filesize-1000..filesize )
)
)
)
and (
any of ( $input* ) and
any of ( $req* )
)
and (
1 of ( $payload* ) or
all of ( $rt_payload* )
)
and not any of ( $fp* ) and any of ( $susp* )
}
rule WEBSHELL_JSP_Generic_Base64
{
meta:
description = "Generic JSP webshell with base64 encoded payload"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
score = 75
date = "2021/01/24"
modified = "2025-08-18"
hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
id = "2eabbad2-7d10-573a-9120-b9b763fa2352"
strings:
// Runtime
$one1 = "SdW50aW1l" wide ascii
$one2 = "J1bnRpbW" wide ascii
$one3 = "UnVudGltZ" wide ascii
$one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
$one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
$one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
// exec
$two1 = "leGVj" wide ascii
$two2 = "V4ZW" wide ascii
$two3 = "ZXhlY" wide ascii
$two4 = "UAeABlAGMA" wide ascii
$two5 = "lAHgAZQBjA" wide ascii
$two6 = "ZQB4AGUAYw" wide ascii
// ScriptEngineFactory
$three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
$three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
$three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
$three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
$three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
$three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii
//strings from private rule capa_jsp_safe
$cjsp_short1 = "<%" ascii wide
$cjsp_short2 = "%>" wide ascii
$cjsp_long1 = "<jsp:" ascii wide
$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
// JSF
$cjsp_long3 = "/jstl/core" ascii wide
$cjsp_long4 = "<%@p" nocase ascii wide
$cjsp_long5 = "<%@ " nocase ascii wide
$cjsp_long6 = "<% " ascii wide
$cjsp_long7 = "< %" ascii wide
//strings from private rule capa_bin_files
$dex1 = "dex\n0"
$dex2 = "dey\n0"
$pack = { 50 41 43 4b 00 00 00 02 00 }
condition:
(
$cjsp_short1 at 0 or
any of ( $cjsp_long* ) or
($cjsp_short1 and $cjsp_short2 in ( filesize-100..filesize )) or
(
$cjsp_short2 and (
$cjsp_short1 in ( 0..1000 ) or
$cjsp_short1 in ( filesize-1000..filesize )
)
)
)
and not (
uint16(0) == 0x5a4d or
$dex1 at 0 or
$dex2 at 0 or
$pack at 0 or
// fp on jar with zero compression
uint16(0) == 0x4b50
)
and filesize < 300KB and
( any of ( $one* ) and any of ( $two* ) or any of ( $three* ) )
}
rule WEBSHELL_JSP_Generic_ProcessBuilder
{
meta:
description = "Generic JSP webshell which uses processbuilder to execute user input"
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
author = "Arnim Rupp (https://github.com/ruppde)"
reference = "Internal Research"
score = 75
date = "2021/01/07"
modified = "2023-04-05"
hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
strings:
$exec = "ProcessBuilder" fullword wide ascii
$start = "start" fullword wide ascii
//strings from private rule capa_jsp_input
// request.getParameter
$input1 = "getParameter" fullword ascii wide
// request.getHeaders
$input2 = "getHeaders" fullword ascii wide
$input3 = "getInputStream" fullword ascii wide
$input4 = "getReader" fullword ascii wide
$req1 = "request" fullword ascii wide
$req2 = "HttpServletRequest" fullword ascii wide
$req3 = "getRequest" fullword ascii wide
condition:
filesize < 2000 and (
any of ( $input* ) and
any of ( $req* )
)
and $exec and $start