Identifying Traffic from Shell Finder Bots – WordPress Security Alert

WordPress Security Alert

A shell finder is a reconnaissance tool used by threat actors to locate compromised websites that harbor backdoor shells—malicious scripts that allow unauthorized access to a site even after vulnerabilities have been patched. This is akin to a burglar creating secret entry points after breaking into a building, enabling them to re-enter undetected.

Backdoor shells are often hidden using various techniques to evade detection, which is why shell finders are preferred over standard search engines for locating them. These tools function similarly to web crawlers but are specifically programmed to search for and compile lists of known backdoor shells based on predefined filenames and popular directories.

Typically, shell finders are written in Python and include a static list of filenames, which are sent in crafted requests to websites during the scanning process. For example, a typical list might include filenames like 1337.php, wp-god.php, and many others that are known to be associated with backdoor shells.

Some shell finders come with user-friendly interfaces to encourage use and expand their user base. Authors might distribute these tools for free to mobilize a larger community to assist in the crawling process, thereby increasing the number of compromised websites they can exploit. Criminals often sell access to these compromised sites in illicit marketplaces, targeting buyers who need quick access for malicious activities, such as phishing.

Identifying Shell Finder Traffic

The prevalence of shell finders means that their traffic is common. However, it is possible to detect this traffic through log analysis and by recognizing hard-coded patterns in their requests:

1. User Agents: Shell finders often use unique, suspicious user agents that can be easily identified, as they typically contain misspellings or unusual words not found in legitimate traffic.

   • Examples of suspicious user agents might include:
     • Mozilla/5.0 (Linux; Android 7.0; SM‑G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
     • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36/8mqULwuL-67
     • wp_is_mobile

2. Referer URLs: Shell finders often use common search engine URLs as their Referer headers to mask their true intent and potentially bypass access controls.

   • Common Referer URLs include:
     • google.com
     • bing.com
     • binance.com

By analyzing these identifiers, website administrators can implement measures to block or mitigate the impact of shell finder tools on their sites.

What This Means

This issue may affect your WordPress website if you are using the mentioned plugin or theme. Taking quick action can help prevent security risks.

How to Fix

• Update the affected plugin or theme immediately
• Deactivate and remove unused plugins
• Run a malware scan on your website
• Keep your WordPress core updated

Risk Level

This vulnerability could potentially allow attackers to exploit your website if not fixed in time.

Source: View Original Report