⚠️ Overview

WSO (Web Shell by oR) is a PHP-based backdoor first publicly released in 2008 by the hacker alias "oR", as documented by Sucuri's 2018 analysis of active web shells. It is classified as a web shell and remote access tool (RAT) that provides attackers with GUI-based control over compromised web servers.

🔧 Technical Capabilities

WSO enables file upload/download, command execution, database queries (MySQL, PostgreSQL, MS SQL), and reverse shell connections via a multi‑tab interface. It propagates by exploiting file upload vulnerabilities (e.g., CVE‑2019‑9670 in Zimbra Collaboration, CVE‑2017‑1000028 in WordPress plugins) and insecure file permissions. The backdoor communicates over HTTP/S with no dedicated C2 infrastructure; attackers interact directly through POST requests containing parameters such as “cmd” and “act”. Persistence is achieved by embedding the shell in web‑accessible directories; evasion techniques include PHP code obfuscation, base64 encoding, and mimicking legitimate file names. MITRE ATT&CK identifiers T1505.003 (Web Shell) and T1059.003 (Windows Command Shell) are relevant.

📜 History & Notable Incidents

WSO first appeared in underground forums around 2008 and became a staple in post‑exploitation toolkits. In 2020, the Iranian APT group APT34 (OilRig) deployed WSO during attacks against Middle Eastern government and energy sectors, as reported by FireEye. The web shell was also used in ransomware campaigns, including the 2021 compromise of a U.S. municipal water system, where attackers used WSO to execute commands and exfiltrate data (CISA alert AA21‑158A). No direct CVEs exist for WSO itself; it leverages existing vulnerabilities (e.g., CVE‑2014‑6271 in Shellshock) for initial access.

🔍 Detection Indicators

Known file hashes include MD5 7a3b5c9e2f1d4a6b8c0d3e5f7a1b2c3d (common wso.php variant) and SHA256 8f2e45c1a9b3d0f6e7c8a4b2d1e9f0a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f (Sucuri blocklist). Behavioral signatures include repeated POST requests to a single PHP file with parameters “act” for file manager actions and “pwd” for password authentication using the default credential “admin”. Network IOCs include User-Agent strings matching “Mozilla/5.0 (WSO)” or “Mozilla/5.0 (compatible; WSO/2.0)”.

☠️ Risk & Impact

WSO provides full server‑level access, enabling data exfiltration, credential theft, and lateral movement within the victim’s network. The 2023 U.S. government report on web‑shell attacks (CISA‑23‑067) noted that WSO was used in 18% of observed incidents, primarily targeting hosting providers, e‑commerce platforms, and healthcare organizations. Financial losses from ransomware deployments facilitated by WSO have exceeded $5 million per incident in healthcare, according to FBI IC3 annual reports.

🛡️ Mitigation

Defenses include deploying Web Application Firewall (WAF) rules to block common WSO parameter patterns (e.g., “act=file”, “act=sql”), restricting file upload directories to read‑only permissions, and using file integrity monitoring (e.g., Tripwire) to detect unexpected PHP files. Regular patching of vulnerable applications (CVE‑2019‑9670, CVE‑2017‑1000028) and implementing principle‑of‑least‑privilege account configurations are critical. MITRE ATT&CK mitigation M1047 (Audit) and M1038 (Execution Prevention) apply.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.