P.A.S. Webshell

Executive Summary

P.A.S. Webshell is a widely available multifunctional PHP backdoor that grants attackers remote command execution and extensive system manipulation on Linux and Windows web servers. Its stealthy operation within standard web application processes makes detection difficult without targeted controls. Detection and mitigation require file integrity monitoring, strict access controls on upload directories, and disabling or limiting PHP functions that enable shell execution.

P.A.S. Webshell, also known as Fobushell, is a versatile PHP-based web shell that has been publicly available since at least 2016. Discovered by ANSSI in January 2021 during an investigation into the Sandworm operation, it is designed to provide attackers with remote access and execution capabilities on compromised web servers running either Linux or Windows. The tool supports a wide range of functions common to advanced backdoors: arbitrary command execution, file upload/download, database interaction, user enumeration, privilege escalation utilities, and network reconnaissance tools. Because it operates entirely within the PHP runtime, P.A.S. Webshell is hard to detect with traditional antivirus products that focus on executable binaries. Instead, it hides its presence by exploiting legitimate server processes, leveraging standard web application paths or disguised filenames. Once a shell file is placed on the target, attackers can issue commands through HTTP requests, effectively gaining persistence and control over both the application layer and underlying operating system. The impact of a successful installation is significant: threat actors gain persistent remote command execution, ability to exfiltrate data, deploy additional malware, pivot across corporate networks, or stage denial‑of‑service attacks. It has been observed in multiple intrusion campaigns, including cyber espionage operations against critical infrastructure and commercial targets. Security teams must treat P.A.S. Webshell as a high‑severity threat that can be introduced via compromised credentials, software updates, or file upload misconfigurations. Ongoing monitoring of web server logs, file integrity verification, and strict controls over PHP execution functions are essential to mitigate the risk posed by this multifunctional backdoor.

Key Capabilities

• Remote command execution via HTTP requests
• Arbitrary file read/write and upload/download
• Database interaction capabilities
• User account enumeration and privilege escalation tools
• Built‑in network reconnaissance utilities (e.g., ping, traceroute)

ATT&CK Techniques

Recommended Actions

• Deploy a Web Application Firewall with rules to detect anomalous PHP functions such as eval(), system(), exec() usage in user‑submitted content
• Implement file integrity monitoring for web root directories to alert on new or modified *.php files
• Limit upload directory permissions and scan uploaded files for known shell signatures
• Enforce least privilege for web server processes and disable unnecessary shell execution capabilities
• Apply regular patches and harden PHP configuration (e.g., turn off allow_url_fopen, disable shell_exec)
• Review and restrict the use of legacy modules that provide command execution

Suggested Tags